Search code examples
azureazure-active-directorysingle-sign-onopenid-connectopenid

How SSO with OpenID and Azure AD works?

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much information about this. If you could help me understand these doubts of concept, I would be very grateful.

Here's the context: WebApp-OpenID using SSO - Azure AD with no permissions or roles for users.

Please, correct me if I am missing something.

  • User came from our system and reach the vendor website (RP).
  • RP calls our Authorization endpoint to get the Authorization code - sending client_secret, client_id, application_id, redirect_uri, ... -
  • User reach our Authorization endpoint and... QUESTION: Are the user asked for credentials or are implicit in SSO?
  • Authorization code is granted and sent to the Redirect URI provided and registered.
  • RP wants to get the Access Token + ID Token from this user. Therefore, calls our Token endpoint using Client ID + Client Secret + Authorization Code and so on. MY QUESTION IS HERE: To get the Access Token, it is not necessary to send information about the user in the request? Does the RP get it from the browser directly? What information does the RP get to be sent?
  • Access Token + ID Token are sent to The Redirect URI registered.

Many Thanks

Solution

  • I tried to reproduce the same in my environment and got the results like below:

    I created an Azure AD Application:

    enter image description here

    To generate the Authorization code, I used the below endpoint:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
 
client_id=ClientId
&response_type=code  
&redirect_uri=RedirectUri
&response_mode=query  
&scope=scope
&state=12345

    While generating the code, I got the sign-in prompt like below:

    enter image description here

    The Authorization code generated successfully:

    enter image description here

    To generate the Access token and ID token I used the below parameters:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
grant_type:authorization_code
scope:scope
code:code
redirect_uri:RedirectUri

    enter image description here

    When I decoded the Access token, I am able to see the user information like below:

    enter image description here

    How SSO with OpenID and Azure AD works?

    • Once the user calls Authorization endpoint, the user will be prompted sign-in screen to enter the credentials.
    • If the consent is not given, then the user will get a screen like below to accept

    enter image description here

    • After successful sign-in the Authorization code will be successfully generated.
    • By calling the token parameter the Access + ID token will be successfully generated and are sent to the Redirect URI.

    If you are already logged in with a valid session, then there is no need to input credentials. SSO capabilities are stored at the browser's level while having an authenticated valid session.

    Reference:

    Bizagi, One Platform; Every Process. User Guide Studio