Yes, Rick was correct. Authority for Azure AD https://login.microsoftonline.com/<TenentDomian or TenentId>
Here is the sample OpenIdConnect Idp provider JSON example, In case if you want to install and configure the IDP provider config using the PowerShell script.
{
"key": "AzureAd",
"name": "AzureAd",
"isEnabled": true,
"description": "AzureAd",
"type": "OpenIdConnect",
"iconUrl": "/access-management/ui/idpIcons/AzureAd.png",
"accessControlList": [
{
"applications": [
{
"id": 4,
"name": "Access Management"
},
{
"id": 1,
"name": "Add-ons"
},
{
"id": 3,
"name": "Tridion Sites Classic (UI only)"
},
{
"id": 2,
"name": "Tridion Sites Experience Space"
}
],
"apiResources": [
{
"id": 1,
"name": "Access Management API"
},
{
"id": 2,
"name": "Add-ons API"
},
{
"id": 3,
"name": "Tridion Sites Content Manager API"
}
],
"apiResourceRoles": [
{
"id": 1,
"name": "Administrator"
},
{
"id": 2,
"name": "Administrator"
},
{
"id": 5,
"name": "Administrator"
}
]
}
],
"forwardedClaims": [],
"parameters": {
"$type": "",
"clientId": "xxxx-xxxx-xxxx-xxx-xxxx",
"authority": "https://login.microsoftonline.com/xxx365.onmicrosoft.com",
"clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"endSessionEndpoint": "",
"responseType": "",
"sendIdTokenHintDuringLogout": false,
"separator": "",
"usernameClaim": "upn",
"fullNameClaim": "name"
}
}
Note: also make sure to configure the access management redirect Url on the azure side.
Updated:
AccessManagement-Service-Install.ps1 PowerShell script only generates the signing certificate and does the installation only for HTTP endpoint.
If you want to Enabling HTTPS for Access Management running as a Windows service, after the service installation install the certificate on the server and update the appsettings.json as mentioned below, and restart the access management service.
Replace "URLs": "http://*:80",
To
"Kestrel": {
"EndPoints": {
"HttpsInlineCertFile": {
"Url": "https://*:443",
"Certificate": {
"Subject": "*.tridiondemo.com",
"Store": "Root",
"Location": "LocalMachine"
}
}
}
}
For the Linux system installation, a certificate should be created as a file and a path should be configured. refer to the documentation.
In case if you looking for the script to generate the certificate to update the config for https, R&D provided a script for Add-on service which can also be re-used for Access Management, here is the script: [Installation-Media]\Add-on Service\generateCertificate.ps1
Note: To match the Subject config to your certificate subject which is installed on the server.
