Identity Provider Application Registration

The EMu application must be registered with an identity provider such as Microsoft via Azure Active Directory (AD) and Google via Google Cloud Platform. Most EMu customers will probably find that Microsoft is the most convenient provider as this allows a user to be authorized to access the Windows desktop, Office 365 and EMu using the same credentials.

As registering an application with an identity provider requires privileged access, it is typically done by the customer. Once the EMu application has been registered, you will need to provide Axiell with certain details which we use to configure your EMu client / server.

The requirements for registering an application with an identity provider and the registration information that must be provided to Axiell can be different depending on the identity provider. Differences for Microsoft Azure AD and Google Cloud Platform are highlighted below.

Tip: An example of registering the EMu application on the Microsoft Azure AD identity platform is provided below.

There are three main considerations when registering the EMu application (reviewing the example registration below should clarify what is required):

#

Consideration

Details

1

Desktop application registration

The registration should be configured for a desktop or public client / application.

For example, when configuring the Redirect URI in Microsoft Azure AD you would select:

Public client / native (mobile & desktop)

2

Specify the Redirect URI

The Redirect URI itself must be:

http://127.0.0.1/emu

Differences between Microsoft and Google:

  • Google: it is not necessary to specify the Redirect URI when registering a desktop application with Google Cloud Platform.

3

Specify access to the required scopes

Scope values specify the user information that the application is allowed to access. Access to the following scopes is required:

  • openid

    Used to indicate that the application intends to use OIDC to verify the user's identity.

  • profile

    Allows the application to access details about a user, including their name.

  • email

    Allows the application to access the user's primary email address.

Details about scope values can be found on the Microsoft documentation site: Permissions and consent in the Microsoft identity platform.

Differences between Microsoft and Google:

  • Microsoft: it is not necessary to specify access to the required scopes when registering an application with Azure AD.

Full details about registering an application with Microsoft and Google are available here:

Once the EMu application has been registered with an identity provider, information must be obtained from the application registration and provided to Axiell. This may include:

  • Application (client) ID
  • OAuth 2.0 authorization endpoint (v2)
  • OAuth 2.0 token endpoint (v2)
  • OpenID Connect metadata document

The following information may need to be obtained from the application registration and provided to Axiell:

  • Application (client) secret

This information is used by Axiell to configure a customer's EMu client and server to use the OIDC protocol.

Differences between Microsoft and Google:

Microsoft:

  1. Microsoft Azure AD uses specific endpoint and metadata document values for each organization (AKA tenant). These values must be provided to Axiell.
  2. Microsoft Azure AD does not use or provide the Application (client) secret value for registered desktop or public applications. Therefore, it is not necessary to provide this value to Axiell.

Google:

  1. It appears that Google Cloud Platform uses the same endpoint and metadata document values for all organizations, specifically:
    • Authorization endpoint:
      https://accounts.google.com/o/oauth2/v2/auth
    • Token endpoint:
      https://oauth2.googleapis.com/token
    • Metadata document:
      https://accounts.google.com/.well-known/openid-configuration
  2. Google Cloud Platform requires the use of the Application (client) secret value when authorizing registered desktop applications. Therefore, this value must be provided to Axiell.

The steps are:

  1. Sign into the Azure portal.
  2. If you have access to multiple tenants, use the Directory + subscription filter in the top menu to select the tenant in which you want to register an application.
  3. Search for and select Azure Active Directory.
  4. Under Manage, select App registrations>New registration.
  5. Set the application Name:

    EMu

  6. Set the Supported account types.

    The value for this setting depends on the Azure AD setup but is likely to be:

    Accounts in this organizational directory only (Axiell Group AB only -
Single tenant)
  7. Set the Redirect URI.

    It should be specified for:

    Public client/native (mobile & desktop)

    And the Redirect URI should have the value:

    http://127.0.0.1/emu

    See the following screenshot for an example:

    Azure

  8. Obtain the registration details.

    To configure the EMu client and server to use OIDC, some information about the application registration must be provided to Axiell. The required information is:

    • Application (client) ID
    • OAuth 2.0 authorization endpoint (v2)
    • OAuth 2.0 token endpoint (v2)
    • OpenID Connect metadata document

    The Application and Directory IDs can be found on the Overview page of the Application Registration, for example:

    Registration

    The endpoint and metadata document information can be found on the Endpoints page accessible via the Endpoints button on the Overview page of the Application Registration, for example:

    Endpoints