Entra (Azure Active Directory)

App Registration

1. Open the Azure Portal on the tenant hosting your Entra instance.

2. Navigate to App Registrations.

   

3. Select New Registration.

   

4. Complete the registration details.

   

   • Name: Choose a recognisable and environment-specific name (e.g. Bragi-Production).

   • Supported account types: Select Accounts in this organisational directory only (Single tenant).

   • Redirect URI: Optional at this stage; consult the "Redirect URIs" section below for guidance.

5. Once submitted, you will see your new app registration.

   

6. Collect the configuration values needed for Bragi integration (example below):

   { "ConnectionStrings": { "BragiMetaData": "" }, "IdentityProvider": "AzureAd", "AzureAd": { "Instance": "https://login.microsoftonline.com", "Domain": "CompanyName.com", "ClientId": "bfe431f8-6b47-4dfd-a9b5-f99a72a649b1", "TenantId": "18065655-4e82-4410-9c4c-0e5547768b96", "CallbackPath": "/signin-oidc", "ClientSecret": "" } }

   • Add these details to your appsettings.json, then restart Bragi for the changes to take effect.

7. Generate a client secret separately; see "Client Credentials" below.

Redirect URIs

Redirect URIs enforce security by ensuring Azure only directs authentication results to permitted endpoints.

1. In the created app registration, locate and select Add a Redirect URI.

   

2. Choose Add a platform.

   

3. Select Web.

   

4. Configure:

   • Redirect URI: Use the fully-qualified domain or IP for your Bragi install, including port (if used) and /signin-oidc suffix.
     Example: https://bragi.internal:8080/signin-oidc

   • Enable Access tokens (for implicit flows).

   • Enable ID tokens (for implicit and hybrid flows).

   

Client Credentials

A client secret is required for Bragi to authenticate requests.

1. From your app registration, click Add a certificate or secret.

   

2. Click New client secret.

   

3. Enter a descriptive name and choose an expiry to suit operational/security policies.

4. For security, scope secrets narrowly and manage lifecycle actively.

5. Copy the "Value" immediately—it is only visible once and is required for integration.
   Store securely (ideally in an approved secrets manager).

6. Insert the value into appsettings.json under ClientSecret, as shown earlier.

Using Active Directory Groups to Control Permissions

To control permissions within Bragi using Active Directory, ensure that logical groups are created in Active Directory representing different user roles or access levels. These groups will be used to determine the corresponding Bragi roles.

Once the Active Directory groups are set up, you can create app roles in Bragi which map users from a given Active Directory group to specific permission sets in Bragi. When configuring an app role in Bragi, the Active Directory Group field must contain the unique name of the group as defined in Active Directory.

This mapping allows Bragi to enforce permissions according to group membership managed externally via Active Directory, simplifying administration and maintaining consistent access policies.

Assigning Roles

Bragi leverages Entra roles (Azure AD App Roles) mapped to app roles for granular permission control.

1. Open your app registration.

2. Select App roles.

3. Click Create app role.

4. Complete the app role configuration:

   • Display name and Description are shown to users.

   • Value is used for permission matching. Ensure it corresponds to Active Directory group names or your team’s mapped convention.

   

5. Navigate to Enterprise Applications.

   

6. Select your registered application.

7. Open Users and groups.

8. Choose Add user/group.

9. Assign the roles to relevant users or groups.
   Note: Group assignments may be restricted by your Entra subscription plan.

10. Click Assign to finalise.

For role updates, users may need to sign out and back in for changes to take effect.