Microsoft Sign in usage: Difference between revisions

From VoIPmonitor.org
No edit summary
No edit summary
 
(8 intermediate revisions by one other user not shown)
Line 1: Line 1:
{{DISPLAYTITLE:How to Set Up Microsoft Sign-In}}
{{DISPLAYTITLE:Microsoft Sign-In (SSO) Configuration}}
[[Category:Configuration]]
[[Category:Authentication]]


== Part 1: How to Register an Application in Microsoft Entra ==
== Overview ==


This guide will walk you through the necessary steps to register a new application in your Microsoft Entra ID (formerly Azure Active Directory) and correctly configure it for integration with the VoIPmonitor GUI.
Microsoft Sign-In allows VoIPmonitor GUI users to authenticate using their Microsoft Entra ID (formerly Azure AD) accounts, providing Single Sign-On (SSO) capability.


=== 1. Sign in to the Microsoft Entra admin center ===
<kroki lang="mermaid">
Open a web browser and navigate to [https://entra.microsoft.com https://entra.microsoft.com].
%%{init: {'flowchart': {'nodeSpacing': 15, 'rankSpacing': 40}}}%%
flowchart LR
    subgraph Entra["Microsoft Entra"]
        A[Register App] --> B[Get IDs]
        B --> C[Assign Users]
    end
    subgraph GUI["VoIPmonitor GUI"]
        D[Enable MS Sign-In] --> E[Enter IDs]
        E --> F[Map Users]
    end
    C --> D
</kroki>


Sign in using an account with administrative privileges.
=== User Mapping Order ===


=== 2. Navigate to App registrations ===
When a user signs in with Microsoft, VoIPmonitor maps them to a GUI user profile in this order:
In the left-hand menu, go to '''App registrations'''.


=== 3. New registration ===
# '''Direct email match''' - Username in VoIPmonitor matches Microsoft email
At the top of the page, click the '''+ New registration''' button.
# '''Secure users list''' - Microsoft email is listed in user's "Microsoft Sign In emails" field
# '''Default user''' - Falls back to the user marked as "Default Microsoft Sign In account"


=== 4. Basic Application Information ===
== Quick Reference ==
;Name:
:Enter a meaningful name for your application (e.g., "VoIPmonitor SSO").


;Supported account types:
{| class="wikitable"
:Choose who can use the application. For internal use, the most common option is ''Accounts in this organizational directory only''.
|-
! Parameter !! Where to Get !! Where to Enter
|-
| '''Client ID''' || Microsoft Entra > App registration > Overview > ''Application (client) ID'' || GUI > Settings > System configuration > Advanced
|-
| '''Tenant ID''' || Microsoft Entra > App registration > Overview > ''Directory (tenant) ID'' || GUI > Settings > System configuration > Advanced
|-
| '''Redirect URI''' || Your VoIPmonitor GUI URL || Microsoft Entra > App registration > Redirect URIs
|}


In the '''Redirect URI''' section, you need to select the platform type and URI.
== Part 1: Microsoft Entra Configuration ==


;Platform selection:
=== Register the Application ===
:Choose '''Single page application'''.


;Redirect URIs:
# Go to [https://entra.microsoft.com entra.microsoft.com] > '''App registrations''' > '''+ New registration'''
:Enter the URL where your VoIPmonitor GUI is installed.
# Configure:
#* '''Name:''' e.g., "VoIPmonitor SSO"
#* '''Supported account types:''' "Accounts in this organizational directory only"
#* '''Redirect URI - Platform:''' '''Single page application'''
#* '''Redirect URI - URL:''' Your VoIPmonitor GUI URL
# Click '''Register'''
# Note the '''Application (client) ID''' and '''Directory (tenant) ID''' from the Overview page


'''IMPORTANT:'''
{{Note|1='''Redirect URI format:'''
* Do not include ''admin.php'' or ''index.php'' at the end.
* Correct: <code>https://voipmonitor.example.com</code>
* Do not include a trailing slash (/) at the end.
* Wrong: <code>https://voipmonitor.example.com/</code> (trailing slash)
* Wrong: <code>https://voipmonitor.example.com/admin.php</code> (page name)}}


Correct format example:
=== Assign Users ===
https://voipmonitor.yourdomain.com


Click the '''Register''' button at the top of the page.
In Microsoft Entra, go to '''Users''' and add users who should have access to VoIPmonitor via Microsoft Sign-In.


== Part 2: How to Assign Users to the Application ==
== Part 2: VoIPmonitor GUI Configuration ==


After registering the application, you must assign the users who will be allowed to sign in.
=== Enable Microsoft Sign-In ===


=== 1. Navigate to Users ===
# Go to '''Settings > System configuration > Advanced'''
In the left-hand menu, go to '''Users'''.
# Enable '''Enable Microsoft Sign in'''
# Enter:
#* '''Microsoft client ID''' - from Entra
#* '''Microsoft tenant ID''' - from Entra
#* '''Redirect URI''' - leave empty (auto-detected)


=== 2. Assign Users ===
=== Map Users ===
Click the '''+ Add user'''.


The wizard will guide you through adding a user.
For each user who will use Microsoft Sign-In:


== Part 3: VoIPmonitor GUI Configuration ==
# Go to '''Users & Audit > Users''' > edit user
# '''Secure users''' tab > fill '''Microsoft Sign In emails''' with their Microsoft email


=== 1. Enable Microsoft Sign-In ===
=== Default User (Optional) ===
Navigate to '''Settings > System configuration'''.


Scroll down to the '''Advanced''' section.
To set a fallback user for unmapped Microsoft accounts:


Enable the option '''Enable Microsoft Sign in'''.
# Edit the desired user > '''Basic data''' tab
# Check '''Default Microsoft Sign In account'''


Fill in the '''Microsoft client ID''' and '''Microsoft tenant ID''' fields. Use the ''Application (client) ID'' and ''Directory (tenant) ID'' values from the Overview page of your app registration in Microsoft Entra.
== Troubleshooting ==


Leave the '''Redirect URI for Microsoft Sign in''' field empty. The system will automatically detect it during the sign-in process. This field is available as a fallback in case automatic detection fails.
=== SSO Fails Behind Reverse Proxy ===


=== 2. Configure Users ===
'''Symptom:''' Redirect loops or "too many redirects" errors when using AWS ALB, Nginx, or other reverse proxies with SSL termination.
Navigate to '''Users & Audit > Users'''.


For each user who should use Microsoft Sign-In, edit their profile and go to the '''secure users''' tab. Fill in the '''Microsoft Sign In emails''' field with their corresponding Microsoft account email.
'''Cause:''' The proxy terminates HTTPS but forwards HTTP to the backend, breaking the OAuth callback flow.


If you want to define a default user for Microsoft Sign-In (for users who are not explicitly mapped), edit that user's profile, go to the '''basic data''' tab, and check the '''Default Microsoft Sign In account''' option.
'''Solution:''' Pass the original protocol via <code>X-Forwarded-Proto</code> header:
 
<syntaxhighlight lang="nginx">
# Nginx configuration
proxy_set_header X-Forwarded-Proto $scheme;
</syntaxhighlight>
 
For AWS ALB, this header is automatic but ensure intermediate proxies pass it through. See [[Nginx]] for complete configuration.
 
== See Also ==
 
* [[Google_Sign_in_usage]] - Google OAuth integration
* [[User_Management]] - User account management
* [[WEB_API#Custom_Login|Custom Login]] - LDAP/custom authentication scripts
 
== AI Summary for RAG ==
 
'''Summary:''' Microsoft Sign-In (SSO) integration for VoIPmonitor GUI using Microsoft Entra ID (formerly Azure AD). Currently in development branch only. Setup requires: (1) Register application in Microsoft Entra as Single Page Application, get Client ID and Tenant ID. (2) Configure GUI in Settings > System configuration > Advanced with IDs. (3) Map users via Secure users tab or set default fallback user. User mapping order: direct email match, Secure users list, default user. Redirect URI must be exact GUI URL without trailing slash or page names. For reverse proxy setups (AWS ALB, Nginx), configure X-Forwarded-Proto header to prevent redirect loops.
 
'''Keywords:''' Microsoft Sign-In, SSO, Single Sign-On, Microsoft Entra, Azure AD, Azure Active Directory, authentication, OIDC, OAuth, GUI login, enterprise authentication, tenant ID, client ID, redirect URI, user mapping, X-Forwarded-Proto, reverse proxy, AWS ALB
 
'''Key Questions:'''
* How do I enable Microsoft Sign-In in VoIPmonitor?
* How do I configure SSO with Microsoft Entra for VoIPmonitor?
* What is the correct Redirect URI format for Microsoft Sign-In?
* Where do I find the Microsoft client ID and tenant ID?
* How do I map VoIPmonitor users to Microsoft accounts?
* Is Microsoft Sign-In available in the stable GUI version?
* How do I set up a default user for Microsoft Sign-In?
* Why does Microsoft Sign-In fail behind a reverse proxy?
* What is the user mapping order for Microsoft Sign-In?

Latest revision as of 17:06, 8 January 2026


Overview

Microsoft Sign-In allows VoIPmonitor GUI users to authenticate using their Microsoft Entra ID (formerly Azure AD) accounts, providing Single Sign-On (SSO) capability.

User Mapping Order

When a user signs in with Microsoft, VoIPmonitor maps them to a GUI user profile in this order:

  1. Direct email match - Username in VoIPmonitor matches Microsoft email
  2. Secure users list - Microsoft email is listed in user's "Microsoft Sign In emails" field
  3. Default user - Falls back to the user marked as "Default Microsoft Sign In account"

Quick Reference

Parameter Where to Get Where to Enter
Client ID Microsoft Entra > App registration > Overview > Application (client) ID GUI > Settings > System configuration > Advanced
Tenant ID Microsoft Entra > App registration > Overview > Directory (tenant) ID GUI > Settings > System configuration > Advanced
Redirect URI Your VoIPmonitor GUI URL Microsoft Entra > App registration > Redirect URIs

Part 1: Microsoft Entra Configuration

Register the Application

  1. Go to entra.microsoft.com > App registrations > + New registration
  2. Configure:
    • Name: e.g., "VoIPmonitor SSO"
    • Supported account types: "Accounts in this organizational directory only"
    • Redirect URI - Platform: Single page application
    • Redirect URI - URL: Your VoIPmonitor GUI URL
  3. Click Register
  4. Note the Application (client) ID and Directory (tenant) ID from the Overview page

ℹ️ Note: Redirect URI format:

Assign Users

In Microsoft Entra, go to Users and add users who should have access to VoIPmonitor via Microsoft Sign-In.

Part 2: VoIPmonitor GUI Configuration

Enable Microsoft Sign-In

  1. Go to Settings > System configuration > Advanced
  2. Enable Enable Microsoft Sign in
  3. Enter:
    • Microsoft client ID - from Entra
    • Microsoft tenant ID - from Entra
    • Redirect URI - leave empty (auto-detected)

Map Users

For each user who will use Microsoft Sign-In:

  1. Go to Users & Audit > Users > edit user
  2. Secure users tab > fill Microsoft Sign In emails with their Microsoft email

Default User (Optional)

To set a fallback user for unmapped Microsoft accounts:

  1. Edit the desired user > Basic data tab
  2. Check Default Microsoft Sign In account

Troubleshooting

SSO Fails Behind Reverse Proxy

Symptom: Redirect loops or "too many redirects" errors when using AWS ALB, Nginx, or other reverse proxies with SSL termination.

Cause: The proxy terminates HTTPS but forwards HTTP to the backend, breaking the OAuth callback flow.

Solution: Pass the original protocol via X-Forwarded-Proto header: 

# Nginx configuration
proxy_set_header X-Forwarded-Proto $scheme;

For AWS ALB, this header is automatic but ensure intermediate proxies pass it through. See Nginx for complete configuration.

See Also

AI Summary for RAG

Summary: Microsoft Sign-In (SSO) integration for VoIPmonitor GUI using Microsoft Entra ID (formerly Azure AD). Currently in development branch only. Setup requires: (1) Register application in Microsoft Entra as Single Page Application, get Client ID and Tenant ID. (2) Configure GUI in Settings > System configuration > Advanced with IDs. (3) Map users via Secure users tab or set default fallback user. User mapping order: direct email match, Secure users list, default user. Redirect URI must be exact GUI URL without trailing slash or page names. For reverse proxy setups (AWS ALB, Nginx), configure X-Forwarded-Proto header to prevent redirect loops.

Keywords: Microsoft Sign-In, SSO, Single Sign-On, Microsoft Entra, Azure AD, Azure Active Directory, authentication, OIDC, OAuth, GUI login, enterprise authentication, tenant ID, client ID, redirect URI, user mapping, X-Forwarded-Proto, reverse proxy, AWS ALB

Key Questions:

  • How do I enable Microsoft Sign-In in VoIPmonitor?
  • How do I configure SSO with Microsoft Entra for VoIPmonitor?
  • What is the correct Redirect URI format for Microsoft Sign-In?
  • Where do I find the Microsoft client ID and tenant ID?
  • How do I map VoIPmonitor users to Microsoft accounts?
  • Is Microsoft Sign-In available in the stable GUI version?
  • How do I set up a default user for Microsoft Sign-In?
  • Why does Microsoft Sign-In fail behind a reverse proxy?
  • What is the user mapping order for Microsoft Sign-In?
Retrieved from "https://www.voipmonitor.org/doc/index.php?title=Microsoft_Sign_in_usage&oldid=10225"