DYNAMICS AX 2012 R3 ENTERPRISE PORTAL SETUP WITH AUTH0

Transcription

1 DYNAMICS AX 2012 R3 ENTERPRISE PORTAL SETUP WITH AUTH0 Introduction This document walks through the setup of Dynamics AX 2012 R3 Enterprise Portal with Auth0 as the identity provider instead of Azure Access Control Service (ACS), which is being retired in November It assumes that SharePoint is already installed on a "1-box" developer environment, where Dynamics AX 2012 R3 CU8+ is installed. It also assumes that no current Enterprise Portal sites are setup (i.e. using Azure Access Control Service (ACS) instead of Auth0). For migrating an existing environment from Azure ACS to Auth0 or for setting up an environment in production, it is expected that knowledge about SharePoint and Enterprise Portal already exists and that this documentation will help to see how to setup Auth0, SharePoint and Enterprise Portal to work together. Pre-Requisites For the changes to support address as the identifier claim type (step 3.3), the changes released under KB are required.

2 Setup 1. Setup SharePoint sites and install Enterprise Portal 1.1. Decide on the following parameters: Variable name Example Your Value <Public site SharePoint application name> <Public site SharePoint username> <Public site SharePoint port> 80 <Public site SharePoint URL> <Public site Enterprise Portal URL> <Private site SharePoint application name> <Private site SharePoint port> 8080 SharePoint80 MyDomain\MySharePointUser SharePoint8080 <Private site SharePoint URL> <Private site Enterprise Portal URL> Set up public SharePoint site From SharePoint 2013 Management Shell: New-SPWebApplication -Name "<Public site SharePoint application name>" - ApplicationPool "<Public site SharePoint application name>" -AllowAnonymousAccess - ApplicationPoolAccount (Get-SPManagedAccount "<Public site SharePoint username>") - Port <Public site SharePoint port> -URL <Public site SharePoint URL> 1.3. Install Enterprise Portal for public site Start AX setup Select to "Add or modify components" Select "Enterprise Portal (EP)" and click "OK" to install a new instance Continue through the wizard. After validating the pre-requisites, specify the Business Connector proxy account information On the next page, set "Web Application" to "<Public site SharePoint application name>" and "Site URL" to "<Public site Enterprise Portal URL>" Complete setup.

3 1.4. Set up private SharePoint site Open SharePoint 2013 Central Administration Go to Application Management > Manage web applications Click New Select to "Create a new IIS web site" and set Name to "<Private site SharePoint application name>" Set Port to <Private site SharePoint port> Under Claims Authentication Types, check "Enable Windows Authentication" and "Integrated Windows Authentication" (default options) Under Public URL, set "URL" to "<Private site SharePoint URL>" Under Application Pool, set "Application pool name" to "<Private site SharePoint application name>" and set the security account to use for the application pool Click OK to create the web application Install Enterprise Portal for private site Start AX setup Select to "Add or modify components" Select "Enterprise Portal (EP)" and click "OK" to install a new instance After validating the pre-requisites, specify the Business Connector proxy account information On the next page, set "Web Application" to "<Private site SharePoint application name>" and "Site URL" to "<Private site Enterprise Portal URL>" Complete setup. 2. Set up Auth Decide on the following parameters: Variable name Example Your Value <VendRequestSignUp Auth0 client name> <UserRequestLoginAzure Auth0 client name> <Auth0 SharePoint name> Enterprise Portal VendRequestSignUp Enterprise Portal UserRequestLoginAzure Enterprise Portal 2.2. As you walk through these steps, capture the following variables: Variable name <Auth0 certificate thumbprint> <Auth0 SharePoint domain> <Auth0 SharePoint client id> <Auth0 SharePoint client secret> <VendRequestSignUp Auth0 WS-Federation login URL> <UserRequestLoginAzure Auth0 WS-Federation login URL> Your Value

4 2.3. Create Auth0 Application for VendRequestSignUp Log in to Auth Create a new application with name "<VendRequestSignUp Auth0 client name>" of type "Regular Web Application" On the "Connections" tab, configure which identity providers you want to use. This setting should be identical for all clients On the "Addons" tab, click on "WS-FED WEB APP" "Realm" should be set to "<Public site Enterprise Portal URL>" and "Application Callback URL" should be "<Public site Enterprise Portal URL>/Enterprise%20Portal/VendRequestSignUp.aspx". Click Save Go to the "Usage" tab and save "Identity Provider Login URL" to variable <VendRequestSignUp Auth0 WS-Federation login URL> above Create Auth0 Application for UserRequestLoginAzure Log in to Auth Create a new application with name "<UserRequestLoginAzure Auth0 client name>" of type "Regular Web Application" On the "Connections" tab, configure which identity providers you want to use. This setting should be identical for all clients On the "Addons" tab, click on "WS-FED WEB APP" Both "Realm" and "Application Callback URL" should be set to "<Public site Enterprise Portal URL>/Enterprise%20Portal/UserRequestLoginAzure.aspx". Click Save Go to the "Usage" tab and save "Identity Provider Login URL" to variable <UserRequestLoginAzure Auth0 WS-Federation login URL> above Create Auth0 SharePoint Client Log in to Auth Go to "SSO Integrations" and click the button to "Create SSO Integration" In the list that appears, select "SharePoint" Set the name to "<Auth0 SharePoint name>" and click Create From the tutorial tab, save this information to the variables above: Domain Client ID Client Secret <Auth0 SharePoint domain> <Auth0 SharePoint client id> <Auth0 SharePoint client secret> Go to the "Settings" tab and enter "<Private site SharePoint URL>" in the "SharePoint URL" field. Click Save On the "Connections" tab, configure which identity providers you want to use. This setting should be identical for all clients.

5 2.6. Install Auth0 Claims Provider for SharePoint Follow the steps from the "Tutorial" tab of the Auth0 SharePoint client created in the previous step. They are included here for convenience Open SharePoint 2013 Central Administration Run: iex ((new-object net.webclient).downloadstring(" Run: Enable-Auth0 -auth0domain:"<auth0 SharePoint domain>" -clientid:"<auth0 SharePoint client id>" -webappurl:"<private site SharePoint URL>" - identifierclaimtype:" ss" - claims:@(" "Client ID "Given Name "Surname "Picture -allowwindowsauth Note: Keep address as the identifierclaimtype. The other claims can be adjusted if required Run: Enable-ClaimsProvider Open SharePoint 2013 Central Administration and go to Security > General Security > Configure Auth0 Claims Provider Input the Domain, Client ID, and Client Secret values from the variables saved above. Click OK Install Auth0 Certificate Log in to Auth Navigate to any of the applications created Click "Show Advanced Settings" and go to "Certificates". Save "Signing Certificate Thumbprint" to <Auth0 certificate thumbprint> above and select to download the certificate in "CER" format Right-click the certificate file that was downloaded. Select "Install Certificate" Set Store Location to "Local Machine" and click Next Choose option "Place all certificates in the following store" and click "Browse " Select "Trusted People" and click OK Click Next, followed by Finish You should receive a message saying that the import was successful. 3. Enable Guest Access for Public Site 3.1. Enable Anonymous Access for the EP Site from Inside the AX Client Open the Dynamics AX 2012 R3 client and go to System administration > Setup > Enterprise Portal > Web sites Select the public web site (<Public site Enterprise Portal URL>) and go to the General tab Select "Anonymous access" Close the form.

6 3.2. Enable Guest User in AX Open the Dynamics AX 2012 R3 client and go to System administration > Common > Users > Users Find and select the user with User ID "Guest" and click "Edit" Select the "Enabled" checkbox Click on "Assign roles". Select roles "Customer anonymous (external)" and/or "Vendor anonymous (external)" and click OK Close the form Setup User Provisioning Parameters in AX Open the Dynamics AX 2012 R3 client and go to System administration > Setup > Enterprise Portal > Enterprise Portal parameters Click "User provisioning" Set the following fields: Vendor self-service portal website Unsolicited vendor authentication Unsolicited vendor domain Vendor authentication method Vendor claims provider name Customer self-service portal website Customer authentication method Customer claims provider name Public portal website Identifier claim type <Private site Enterprise Portal URL> Azure ACS Auth0 Azure ACS Auth0 <Private site Enterprise Portal URL> Azure ACS Auth0 <Public site Enterprise Portal URL> address 3.4. Enable Anonymous Access in SharePoint Open a web browser and navigate to <Public site Enterprise Portal URL> Go to Site actions > Site Permissions In the ribbon, under the "Manage" group, click "Anonymous Access" Select "Entire Web site" and click "OK" Disable Windows Authentication Open Internet Information Services (IIS) Manager and find site <Public site SharePoint application name> Double-click on "Authentication" Select "Windows Authentication" and click "Disable" Web.config Changes for Public Site Open Internet Information Services (IIS) Manager and find site <Public site SharePoint application name> Right-click the site and select "Explore" Back up your current web.config file Open the web.config file in your favorite text editor.

7 Add to bottom of <sectiongroup name="sharepoint">: <section name="applicationauthentication" type="microsoft.sharepoint.identitymodel.applicationauthenticationconfigurationsectio n, Microsoft.SharePoint.IdentityModel, Version= , Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> Add before <sectiongroup name="microsoft.dynamics">: <section name="microsoft.identitymodel" type="microsoft.identitymodel.configuration.microsoftidentitymodelsection, Microsoft.IdentityModel, Version= , Culture=neutral, PublicKeyToken=31bf3856ad364e35" /> Add to bottom of file, before </configuration> <microsoft.identitymodel> <service savebootstraptokens="true"> <securitytokenhandlers> <securitytokenhandlerconfiguration> <audienceuris> <add value="<public site Enterprise Portal URL>/Enterprise%20Portal/UserRequestLoginAzure.aspx" /> <add value="<public site Enterprise Portal URL>" /> </audienceuris> <issuernameregistry type="microsoft.identitymodel.tokens.configurationbasedissuernameregistry, Microsoft.IdentityModel, Version= , Culture=neutral, PublicKeyToken=31bf3856ad364e35"> <trustedissuers> <add thumbprint="<auth0 certificate thumbprint>" name="<public site SharePoint URL>" /> </trustedissuers> </issuernameregistry> <issuertokenresolver type="microsoft.sharepoint.identitymodel.spissuertokenresolver, Microsoft.SharePoint.IdentityModel, Version= , Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> </securitytokenhandlerconfiguration> <clear /> <add type="microsoft.identitymodel.tokens.x509securitytokenhandler, Microsoft.IdentityModel, Version= , Culture=neutral, PublicKeyToken=31bf3856ad364e35" /> <add type="microsoft.sharepoint.identitymodel.spsaml11securitytokenhandler, Microsoft.SharePoint.IdentityModel, Version= , Culture=neutral, PublicKeyToken=71e9bce111e9429c"> <samlsecuritytokenrequirement> <nameclaimtype value=" /> </samlsecuritytokenrequirement> </add> <add type="microsoft.sharepoint.identitymodel.sptokencache, Microsoft.SharePoint.IdentityModel, Version= , Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> </securitytokenhandlers>

8 <federatedauthentication> <wsfederation passiveredirectenabled="false" issuer=" realm=" /> <cookiehandler mode="custom" path="/" name="techsfedauth"> <customcookiehandler type="microsoft.sharepoint.identitymodel.spchunkedcookiehandler, Microsoft.SharePoint.IdentityModel, Version= , Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> </cookiehandler> </federatedauthentication> </service> </microsoft.identitymodel> 3.7. Add Application Settings for Public Site Open Internet Information Services (IIS) Manager and find site <Public site SharePoint application name> Double-click "Application Settings" Right-click and select "Add ". Set Name to "STSSignInURL" and Value to "<VendRequestSignUp Auth0 WS-Federation login URL>". Click OK Right-click and select "Add ". Set Name to "STSSignInURLContact" and Value to "<UserRequestLoginAzure Auth0 WS-Federation login URL>". 4. Give Auth0 Users Permission to Private Site 4.1. Open SharePoint 2013 Central Administration and go to Security > Users > Specify web application user policy Make sure you are working with the correct web application - "Web Application" should be set to "<Private site SharePoint URL>" Click "Add Users" Select Zone "(All zones)" and click Next For the "Users" field, click the icon to Browse for users. In the "All Users" directory, select "All Users (Auth0)". Click the Add button, followed by OK For the "Permissions" field, select "Full Control" Click Finish. 5. Restart IIS 5.1. Open Internet Information Services (IIS) Manager and select the server where SharePoint and Enterprise Portal are hosted Click "Restart".