On Microsoft Entra ID add Enterprise application with URL to your Open OnDemand. For example: https://ood.example.com/oidc
Three pieces of information are needed for Open OnDemand:
- Client Secret: NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY
- Client ID: 22222222-ffff-4444-aaaa-333333333333
- Tenant ID: 99999999-8888-4444-aaaa-cccccccccccc
Tenant ID is used in URL template: https://login.microsoftonline.com/{TenantID}/.well-known/openid-configuration
Add these lines to /etc/ood/config/ood_portal.yml
oidc_uri: "/oidc"
oidc_provider_metadata_url: https://login.microsoftonline.com/99999999-8888-4444-aaaa-cccccccccccc/v2.0/.well-known/openid-configuration
oidc_client_id: "22222222-ffff-4444-aaaa-333333333333"
oidc_client_secret: "NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY"
user_map_match: '^([^@]+)@.*$'
NOTE: You may need to user_map_match to map users. I needed.
Generate new Open OnDemand config and reload httpd:
/opt/ood/ood-portal-generator/sbin/update_ood_portal
systemctl reload httpd
Optional 1:
While testing it is possible to change these lines manually in the file /etc/httpd/conf.d/ood-portal.conf
OIDCProviderMetadataURL https://login.microsoftonline.com/99999999-8888-4444-aaaa-cccccccccccc/v2.0/.well-known/openid-configuration
OIDCClientID 22222222-ffff-4444-aaaa-333333333333
OIDCClientSecret NNN8Q~4444444444pa4wAww79rBrmNOaYYYYYYYY
OIDCRedirectURI /oidc
And reload HTTPD:
systemctl reload httpd
Optional 2:
It is possible to configure Microsoft Entra ID to return user name in different forms: email, full name, short, and so on by changing: OIDCRemoteUserClaim.
But by default most of them are not configured on Entra ID side.
Example with preferred_username:
# cat /etc/httpd/conf.d/ood-portal.conf
. . .
OIDCRemoteUserClaim preferred_username
. . .
SetEnv OOD_USER_MAP_MATCH "^([^@]+)@.*$"
. . .
Possible OIDCRemoteUserClaim here: https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference#v10-and-v20-optional-claims-set