Microsoft Entra ID (OIDC)

Prerequisites

Permissions required for registering and configuring an app in Microsoft Entra ID.

The account must have permission to manage applications in Microsoft Entra ID. Ideally, the account should be in the Global Admin role to grant admin consent.

Implement single sign-on (SSO)

It is recommended to use two separate browser tabs for the Azure (A) and Keycloak (K) portals to make it easier to apply the settings.

(A) In the first tab sign in to the Azure Portal.
(A) Search for Microsoft Entra ID. Expand Manage in the left pane and select App registrations.
(A) Select Endpoints.
(A) Copy the value from the OpenID Connect metadata document field.
(K) Open a new tab in your browser and sign in to the target Spark tenant. Access the Keycloak console from the User menu.
(K) Select Identity Providers from the left pane.
(K) Expand the Add Provider dropdown and choose OpenID Connect v1.0.
(K) Find the Discovery Endpoint field and paste the OpenID Connect metadata document.
(K) Select on the Show metadata link. You'll notice that some metadata fields are automatically filled in.
(K) Enter values for the Alias and Display Name fields. The Alias should be a lowercase name without special symbols. Please note this Display Name will appear in the button on the Spark sign in page.
(K) Copy the Redirect URI value.
(A) Switch to Microsoft Entra ID. Select App registrations, then select New registration.
(A) Enter a name for the application, e.g. Coherent Spark UAT.
(A) Select the supported account type that is appropriate for your organization.
(A) Under Redirect URI, copy the edited Redirect URI value from before.
(A) Select Register.
(A) Copy the Application (Client) ID from the Overview page.
(K) Return to Keycloak. In the Client ID field, paste the value copied in the previous step.
(A) Switch to Microsoft Entra ID. Go to Certificates & secrets.
(A) Select New Client Secret and fill out the Description and Expiration fields.
(A) Select Add and copy the value.
(K) Return to Keycloak. In the Client Secret field, paste the value copied in the previous step.
(K) Scroll to the bottom of the page and select Save.
(A) Switch to Microsoft Entra ID. Go to API permissions.
(A) Select Grant admin consent for <your Microsoft Entra ID> to grant permissions to the application.
Navigate to your Spark tenant and sign in using the newly created provider. The Keycloak sign-in page shows a button with the display name you defined earlier.

Configure certificate-based client authentication

It is recommended to replace the client secret configured in the previous section with certificate-based client authentication.

(K) In the Keycloak Admin Console, select Realm settings from the left pane, then select the Keys tab.
(K) Locate the active RSA key and select Certificate.
(K) Copy the certificate content displayed in the Certificate window and save it as a .cer file, for example RSA.cer.
(K) Select Identity Providers from the left pane, then select the identity provider configured in the previous section.
(K) In the OpenID Connect settings section, change Client Authentication to JWT signed with private key.
(K) Set Add X.509 Headers to the JWT to On.
(K) Scroll to the bottom of the page and select Save.
(A) Switch to Microsoft Entra ID. Select App registrations, then select the application created for the identity provider.
(A) Select Certificates & secrets, then select the Certificates tab.
(A) Select Upload certificate and upload the .cer file created in step 3.
(A) Select Add to complete the certificate upload.
Sign in to your Spark tenant using the identity provider to confirm that authentication is successful.

Certificate-based authentication avoids the use of a shared client secret. Keycloak instead signs a short-lived JWT client assertion with its private key, while Microsoft Entra ID uses the uploaded public certificate to verify the signature. The private key remains under Keycloak's control and is not shared with Microsoft Entra ID.

Configure app roles to Spark user groups

Do not configure a mapper for the user:pf group. This is the default minimal Spark group that users must belong to in order to sign in to Spark. Configuring a mapper for this group unnecessarily duplicates sign-in permission management already controlled by your Identity Provider.

It is recommended to use two separate browser tabs for the Azure (A) and Keycloak (K) portals to make it easier to apply the settings. In this guide, you will set up the automatic roles for the tenant-admin role.

(A) In the first tab sign in to the Azure Portal.
(A) Search for and select Microsoft Entra ID.
Select App registrations, then select the application you previously created and select App roles.
(A) Select Create app role.
(A) Provide the following values then select Apply.
Key
Value
Allowed member types
User/Groups
Display name
tenant-admin
Value
tenant-admin
Description
Your app role description
Do you want to enable this app role?
True
(A) Select Overview in the left pane and then select your application in Managed application in local directory.
(A) Select Properties from the left pane.
(A) Set Assignment required? to True and select Save.
(A) Select Users and Groups from the left pane and then Add user/group.
(A) Assign your test account to the tenant-admin role.
(K) Open a new tab in your browser and sign in to the target Spark tenant. Access the Keycloak console from the User menu.
(K) Select Identity Providers from the left pane and then the identity provider you configured in the previous section.
(K) Select the Mappers tab and then Add mapper.
(K) Provide the following values.
Name
Value
Name
tenant-admin
Sync mode override
force
Mapper type
Advanced Claim to Group
(K) Select Add Claims.
(K) Provide the following values:
Key
Value
roles
tenant-admin
(K) Leave Regex Claim Values as Off (which is the default).
(K) Select Select Group, choose tenant-admin , then select Select.
(K) Select Save.
Sign in to Coherent Spark with your test account. Select your initials and hover over the groups icon to confirm your membership in tenant-admin.
We highly recommend creating at least a few additional app groups relevant for Private tenants:
- Group for supervisor:pf user accounts. In Spark, supervisor:pf members can manage permissions across all folders.
- Groups for "standard" user accounts, e.g. user:teamA, user:teamB. These groups can be assigned to the users in your organization not responsible for tenant administration. Creating multiple roles for "standard" user accounts can be useful to separate access between teams.

Enable privileged identity management (PIM)

See Microsoft Entra ID privileged identity management (PIM).

Create an enterprise application for Coherent Spark

See Microsoft Apps.

Last updated 11 days ago