Skip to main content
Tridion

Return to Answer

added 1454 characters in body
Source Link
Velmurugan ♦
Velmurugan ♦
  • 8.2k
  • 2
  • 15
  • 27

Yes, Rick was correct. Authority for Azure AD **httpshttps://login.microsoftonline.com/<TenentDomian or TenentId>**TenentId>

Note: also make sure to configure the access management redirect Url on the azure side.

Updated:

AccessManagement-Service-Install.ps1 PowerShell script only generates the signing certificate and does the installation only for HTTP endpoint.

If you want to Enabling HTTPS for Access Management running as a Windows service, after the service installation install the certificate on the server and update the appsettings.json as mentioned below, and restart the access management service.

Replace "URLs": "http://*:80",

To

"Kestrel":  {
  "EndPoints":  {
 
     "HttpsInlineCertFile": {
        "Url":  "https://*:443",
          "Certificate":  {
              "Subject":  "*.tridiondemo.com",
              "Store":  "Root",
              "Location":  "LocalMachine"
          }
      }
  }      
}

For the Linux system installation, a certificate should be created as a file and a path should be configured. refer to the documentation.

In case if you looking for the script to generate the certificate to update the config for https, R&D provided a script for Add-on service which can also be re-used for Access Management, here is the script: [Installation-Media]\Add-on Service\generateCertificate.ps1

Note: To match the Subject config to your certificate subject which is installed on the server.

Yes, Rick was correct. Authority for Azure AD **https://login.microsoftonline.com/<TenentDomian or TenentId>**

Note: also make sure to configure the access management redirect Url on the azure side.

Yes, Rick was correct. Authority for Azure AD https://login.microsoftonline.com/<TenentDomian or TenentId>

Note: also make sure to configure the access management redirect Url on the azure side.

Updated:

AccessManagement-Service-Install.ps1 PowerShell script only generates the signing certificate and does the installation only for HTTP endpoint.

If you want to Enabling HTTPS for Access Management running as a Windows service, after the service installation install the certificate on the server and update the appsettings.json as mentioned below, and restart the access management service.

Replace "URLs": "http://*:80",

To

"Kestrel":  {
  "EndPoints":  {
 
     "HttpsInlineCertFile": {
        "Url":  "https://*:443",
          "Certificate":  {
              "Subject":  "*.tridiondemo.com",
              "Store":  "Root",
              "Location":  "LocalMachine"
          }
      }
  }      
}

For the Linux system installation, a certificate should be created as a file and a path should be configured. refer to the documentation.

In case if you looking for the script to generate the certificate to update the config for https, R&D provided a script for Add-on service which can also be re-used for Access Management, here is the script: [Installation-Media]\Add-on Service\generateCertificate.ps1

Note: To match the Subject config to your certificate subject which is installed on the server.

Source Link
Velmurugan ♦
Velmurugan ♦
  • 8.2k
  • 2
  • 15
  • 27

Yes, Rick was correct. Authority for Azure AD **https://login.microsoftonline.com/<TenentDomian or TenentId>**

Here is the sample OpenIdConnect Idp provider JSON example, In case if you want to install and configure the IDP provider config using the PowerShell script.

    {
    "key": "AzureAd",
    "name": "AzureAd",
    "isEnabled": true,
    "description": "AzureAd",
    "type": "OpenIdConnect",
    "iconUrl": "/access-management/ui/idpIcons/AzureAd.png",
    "accessControlList": [
        {
            "applications": [
                {
                    "id": 4,
                    "name": "Access Management"
                },
                {
                    "id": 1,
                    "name": "Add-ons"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Classic (UI only)"
                },
                {
                    "id": 2,
                    "name": "Tridion Sites Experience Space"
                }
            ],
            "apiResources": [
                {
                    "id": 1,
                    "name": "Access Management API"
                },
                {
                    "id": 2,
                    "name": "Add-ons API"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Content Manager API"
                }
            ],
            "apiResourceRoles": [
                {
                    "id": 1,
                    "name": "Administrator"
                },
                {
                    "id": 2,
                    "name": "Administrator"
                },
                {
                    "id": 5,
                    "name": "Administrator"
                }
            ]
        }
    ],
    "forwardedClaims": [],
    "parameters": {
        "$type": "",
        "clientId": "xxxx-xxxx-xxxx-xxx-xxxx",
        "authority": "https://login.microsoftonline.com/xxx365.onmicrosoft.com",
        "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "endSessionEndpoint": "",
        "responseType": "",
        "sendIdTokenHintDuringLogout": false,
        "separator": "",
        "usernameClaim": "upn",
        "fullNameClaim": "name"
    }
}

Note: also make sure to configure the access management redirect Url on the azure side.