Azure AD SAML Configuration for LightBeam

Configure Https for LightBeam endpoint before Azure AD SAML Configuration.

Azure AD Configuration

1. Navigate to the Azure portal.

2. Locate 'Enterprise applications' and select 'New Application'.

3. Choose 'Create your own application' and name it appropriately.

Fig. 1 Azure AD SAML - Create your own application

1. In the global search bar, type 'App registrations' and find your application by name.

Fig. 2. Azure AD SAML - App registrations

1. Select your application and click on 'Application ID URI'.

Fig. 3. Azure AD SAML - Application ID URI

1. Click on 'Add'.

Fig. 4. Azure AD SAML - Add Application ID URI

5. Enter the Application ID URI. Click on 'Save'.

Fig. 5. Azure AD SAML - Save Application ID URI

Fig. 6. Azure AD SAML - Application ID URI

1. Click on 'Overview' in the left navigation menu. Click on 'Endpoints'.

2. Copy the URL from the 'Federation metadata document'.

Note: We need to use this URL to configure Azure AD as auth provider in LightBeam.

1. Overview -> Managed application in the local directory (Click on app name)

2. Next, we need to configure SAML and Assign users and groups.

Setup Single sign-on:

• To configure SAML settings, click on Set up single sign on.

Fig. 7. Azure AD SAML - Set up single sign on

• Click on SAML.

Fig. 8. Azure AD SAML - SAML

• To configure basic SAML settings, select 'Edit' which will open a configuration window.

Fig. 9. Azure AD SAML - Basic SAML Configuration

• Identifier (Entity ID): <LIGHTBEAM_ENDPOINT>/auth/realms/master

• Reply URL: <LIGHTBEAM_ENDPOINT>/auth/realms/master/broker/AzureAD/endpoint

Click on Save.

Fig. 10. Azure AD SAML - Basic SAML Configuration - ID & Reply URL

• Now click on the Edit button to update user Attributes and Claims.

Fig. 11. Azure AD SAML - Basic SAML Configuration - Attributes & Claims

• Click on Add a group claim.

Fig. 12. Azure AD SAML - Add a Group Claim

Fig. 13. Azure AD SAML - Add a Group Claim - Source attribute

• After making the necessary changes, click 'Save'. The configured attributes and claims will then be displayed.

Fig. 14. Azure AD SAML - Updated Attributes & Claims

Add users and groups

• Assign the necessary users and groups in Azure AD for integration.

Fig. 15. Azure AD SAML - Assign users & groups

• Use the search functionality to find specific users or groups you want to assign. Select the users you want to integrate with the SAML application.

Fig. 16. Azure AD SAML - Assign users & groups - Search for user

• Assign the necessary roles and permissions for each user.

Fig. 17. Azure AD SAML - Assign users & groups - Assign user

• Add new users or groups as needed.

Fig. 18. Azure AD SAML - Assign users & groups - Add user/group

• Ensure that each user or group has the appropriate level of access for the integration.

Fig. 18.1 Azure AD SAML - Assign users & groups - Add user/group

With the above steps Azure AD SAML configuration is done.

Configure Auth Provider

• Now, the next step is to log in to LightBeam UI using admin user credentials and configure the Auth Provider.

Note: Before auth provider configuration we need to configure SMTP so role of the users can be changed.

• Before Azure AD configuration, the login page looks like this:

Fig. 19 Azure AD SAML - Configure Auth Provider - Login Page

• Once the login is successful, click on the settings option from the top right (⚙️) gearbox.

• Click on Auth Provider.

• Select AzureAD from the drop-down list.

• Select protocol as SAML

• Provide the metadata URL copied above.

• Choose the default role that an onboarded user assumes and click on Save.

  

  Fig. 19 Azure AD SAML - Configure Auth Provider - Select default role
• After a successful Save message, click on Logout from the top right user profile icon.

Fig. 19 Azure AD SAML - Configure Auth Provider - Select Auth Provider

• On the login page, Azure AD option should now be visible.

Fig. 20 Azure AD SAML - Configure Auth Provider - New Login Page

Configure Keycloak Mappers - Mappers

• Log into your Keycloak instance and navigate to the 'Identity Providers' section.

• Select 'AzureAD' from the list of identity providers, which will open a new page offering two tabs: 'Settings' and 'Mappers'.

It will open another page where we have 2 options Settings and Mappers.

Fig. 26 Azure AD SAML - Keycloak Mappers - Identity Providers

We need to configure the following 4 different mappers

AzureAD Mappers Configuration

Scroll to the top of the page and click on 'Mappers', located next to the 'Settings' tab. Here, you'll create mappings for various user attributes.

• Username Mapper:

  • For this Mapper, the Mapper Type will be “Username Template Importer” from the drop-down menu

  • The template will be ${ATTRIBUTE.http://schemas/xmlsoap.org/ws/2005/05/identity/claims/name}

• Firstname Mapper:

  • For this Mapper, the Mapper Type will be “Attribute Importer” from the drop-down menu.

  • The Attribute Name will be the AD schema http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

  • The User Attribute Name will be “firstName”.

  
• Lastname Mapper:

  • For this Mapper, the Mapper Type will be “Attribute Importer” from the drop-down menu.

  • The Attribute Name will be the AD schema http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

  • The User Attribute Name will be “lastName”.

  
• Email mapper:

  • For this Mapper, the Mapper Type will be “Attribute Importer” from the drop-down menu.

  • The Attribute Name will be the AD schema http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

  • The User Attribute Name will be “email”.

  

Once all the mappers are configured it looks like the following:

Sign-in with AzureAD SSO from LightBeam login page.

LightBeam login page.

Once you click on the Sign in with Azure AD option from the login page, it redirects to Microsoft and asks to select the user and provide credentials.

Fig. 32 Azure AD SAML - Sign in with Azure AD

Update the user details.

If the user exists select add to existing account.

Once you have successfully logged in, the LightBeam Dashboard will be displayed. On the User Management screen, you will find a list of users along with their respective roles. By default, when a user is onboarded from Azure AD to the LightBeam system, they are assigned the "View Only" role. However, an admin can modify the "View Only" role to any other available role within the system.

Fig. 32 Azure AD SAML - User Management Screen

As Azure AD users begin to log in to the LightBeam app, all the successfully logged-in users will be listed on the user management page.

Updating LightBeam in myapps.microsoft.com Portal

Add a site.

Provide LightBeam HTTPS FQDN

---

About LightBeam

LightBeam automates Privacy, Security, and AI Governance, so businesses can accelerate their growth in new markets. Leveraging generative AI, LightBeam has rapidly gained customers’ trust by pioneering a unique privacy-centric and automation-first approach to security. Unlike siloed solutions, LightBeam ties together sensitive data cataloging, control, and compliance across structured and unstructured data applications providing 360-visibility, redaction, self-service DSRs, and automated ROPA reporting ensuring ultimate protection against ransomware and accidental exposures while meeting data privacy obligations efficiently. LightBeam is on a mission to create a secure privacy-first world helping customers automate compliance against a patchwork of existing and emerging regulations.

For any questions or suggestions, please get in touch with us at: [email protected].