Set up Azure AD Single Sign-on Integration (Legacy)

  • Updated

TABLE OF CONTENTS

 

Azure AD integration

 

The Azure AD SSO support allows you to:

  • Synchronize users and groups from Azure AD into Lucid Filespaces.
  • Log in to Lucid Filespaces using your Azure AD account.

 

Currently, Lucid has the following requirements for user synchronization (no special requirements for regular user login are needed):

  • You will need to use an Azure AD user with sufficient administrative rights when synchronizing users into Lucid.
  • Lucid uses the Microsoft Graph API to perform the following operations on behalf of the logged-in admin user:
    • Fetch users and groups;
    • Read application assignments;
    • Write a custom attribute into the profile of users that are assigned to the LucidLink application.


Upon completion of this guide you will:

  • Have a configuration for your LucidLink application inside your Azure AD account;
  • Be able to integrate Azure AD with your LucidLink Filespace, and synchronize the assigned Azure AD users and groups to Lucid;
  • Be able to log in to LucidLink Filespace using Azure AD identity provider.

 

 

1. Log in as an administrator to your Azure AD portal.

2. Open the App registrations service.

 

AA1.png

 

3. Click New registration.

 

AA2.png

 

4. Enter the following data for registering the new application 

Name: LucidLink

Redirect URI: Public client/native (mobile & desktop)  http://127.0.0.1:8909/

Click Register.

 

AA3.png

 

 

5. Navigate to the Authentication menu and add the following URIs in the Mobile and desktop applications section 

URIs:

http://127.0.0.1:8908/

http://127.0.0.1:8907/

http://127.0.0.1:8906/

 

Click Save to preserve the settings.

 

AA4.png

 

6. Navigate to the Token configuration menu and Add optional claim ->  select ID token -> check the upn -> click Add

 

AA5.png

7.  Check the Turn on the Microsoft Graph profile permission checkbox (required for claims to appear in token). Click Add.

 

AA6.png

 

 

8. (optional)  If you have external users in your AD: Go to the claim, click the three dots on the right and select Edit. Make sure Externally authenticated is set to Yes. If this option is not selected, those users will not be able to log in. Click Save. 

 

 

AA7.png

 

9. Navigate to API permissions -> Click on Microsoft Graph and then on Delegated permissions.

 

AA8.png

10. Select the following permissions and click Update (result in the image below).

  • offline_access
  • openid
  • profile
  • User.Read

 

AA9.png

11. While on the same screen click Grant admin consent for XXX and select Yes.

 

AA10.png

 

12. Navigate to Enterprise applications -> LucidLink -> Properties and set User assignment required? to Yes. Click Save. 

 

 

AA11.png

 

 

13. You will need to have at least one Azure AD admin user assigned to the LucidLink application. To add users and groups that will be using the LucidLink application:

  • Go to Enterprise applications -> LucidLink -> Users and groups
  • Click Add users
  • Click on Users and groups and select one or more admin or non-admin users. Click Select. Click Assign.

 

AA12.png

 

 

 

 

1. Log in as the root user to a LucidLink Filespace and open the Control Panel. Click the SSO menu.

 

SSOopt.png

 

2. Select Configure Azure AD.

 

AA14.png

 

 

3. Back in the Azure AD portal, go to App Registrations -> LucidLink -> Overview, copy the Application (client) ID and enter it in the Application (client) ID field in the Lucidlink client.

 

AA15.png

 

4. While still on App Registrations -> LucidLink -> Overview, click Endpoints, copy the OpenID Connect metadata document URL and enter it in the OpenID Connect metadata document field in the LucidLink client.

 

AA16.png

 

5. In the Azure AD portal, go to Enterprise Applications -> LucidLink -> Overview, copy Object ID, and enter it in the Service Principal Object ID field in the LucidLink client.

 

AA17.png

 

 

6. In the LucidLink client, click Connect.

 

7. In the opened browser window, log in with an Azure AD admin user. After a successful login, go back to the LucidLink client where you should see a list of users and groups from Azure AD ready to synchronize with the Lucid application. 

 

8. Click Synchronize now to add the assigned users and groups to the LucidLink client.

 

User login in Lucid through Azure AD

 

1. Open the Login screen and enter the Filespace name that has Azure AD integration.

 

1.png

 

2. In the next step, the Azure AD integration will be detected and a new button will allow for Azure AD login.

 

azure1.png

 

You will be taken to your Azure AD domain in a new browser window where you can log in. Upon successful login, Lucid will connect to the Filespace.

 

3. You can confirm this by checking the username at the top of the dashboard:

Was this article helpful?

0 out of 0 found this helpful