Configuring integration with Microsoft Azure Active Directory

Integration is based on two-way communication between ASAP and Azure AD. This connection on the Active Directory side is configured in the Microsoft Azure Administration Console and involves the following stages:

On the ASAP platform side, you must provide the Azure AD service URL, platform ID in Azure AD, and the content of the certificate used to encrypt communications between the platform and Azure AD.

To configure integration with Microsoft Azure Active Directory:

  1. Sign in to the Microsoft Azure Active Directory administration console as an admin.
  2. Add the Kaspersky Automated Security Awareness Platform application to the list of Active Directory applications. To do this, perform the following actions:
    1. In the left panel, select the Enterprise applications section.

      AD1

    2. Click New application.

      The Browse Azure AD Gallery (Preview) will open.

      AD2

    3. Click Create your own application.

      The Create your own application will open.

      AD3

    4. In the What's the name of your app field, enter any name you want to use to find the added application in the list of Active Directory applications.
    5. Click Create.

    The added application will appear in the workspace in the Enterprise applications section. The Overview window will open.

    AD4

  3. In the left panel, select the Single sign-on section.

    Azure_SSO1

  4. In the workspace, select SAML as the authentication method.

    The SAML-based Sign-on page opens.

    Azure_SSO2

  5. In the Basic SAML Configuration settings section, click the Edit button.

    The Basic SAML Configuration window opens.

    Azure_SSO3

  6. In the Identifier field, enter any arbitrary name to serve as the ASAP platform ID for the Azure AD service.
  7. Copy the ID from the previous step and paste it in the ASAP web interface in the Company settings section → SSO in the Entity ID field.
  8. In the Azure AD console in the Reply URL field, enter the ASAP URL (ACS claim handler service address) where the SAML token is located.

    You can copy this address in the ASAP web interface in the Company settings section → SSO → SSO Callback (ACS) URL by clicking the copy button.

  9. In the Sign on URL field, enter the URL that users will use to log in to the training portal.

    You can copy this address in the ASAP web interface in the Company settings section → SSO → SSO Sign-in URL by clicking the copy button.

    Entering this address in a browser will redirect the user to Azure AD to log in with a Microsoft account.

  10. In the Logout Url field, enter the URL that will be used to send responses to the platform when the SAML session ends.

    You can copy this address in the ASAP web interface in the Company settings section → SSO → SSO Sign-out URL by clicking the copy button.

    Azure_SSO4

  11. Click Save.
  12. If required, change the SAML values of the account attributes in the User Attributes & Claims section.

    Don't change the emailaddress and Unique User Identifier attributes in order to ensure proper integration with the platform

  13. In the SAML Signing Certificate setting section, download the SAML token-signing certificate (Base64 format) sent to the platform.
  14. In any convenient way (for example, by opening the certificate file in a text editor) copy the contents of the certificate and paste them in the ASAP web interface in the Company settings section → SSO in the Signing certificate field.
  15. In the Set up <application name in Azure AD> field of settings, copy the URL of the Azure AD service in the Login URL field and paste it in the ASAP web interface in the Company settings section→ SSO in the Identity provider URL field. Click Save.

Integration of the ASAP platform with Microsoft Azure Active Directory is now configured. Enable SSO in the ASAP web interface so users can log in to the training portal via SSO.

To the top