Skip to content
LogScale Self-Hosted
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

### Entra ID (formerly Azure Active Directory)

LogScale can integrate Entra ID (formerly known as Azure Active Directory or Azure AD) for identity and access management. Find detailed steps for creating an Entra ID application, configuring SAML-based single sign-on, and setting up group synchronization between the two platforms. For cloud customers, the integration process requires working with Support to complete the configuration while following specific requirements for security controls and permissions.

Entra ID is Microsoft's enterprise cloud-based identity and access management (IAM) solution. It can be used to access your LogScale repositories. Microsoft365 also uses this interface, for more information see Tag Fields Created by Parser microsoft365.

#### Prerequisites to configure Entra ID

Prior to configuring Entra ID for authentication with LogScale make sure to have the following:

- Microsoft account

#### Integrate Entra ID with LogScale

To integrate Entra ID with LogScale, three main operations are required:

1. Create Entra ID application

2. Set up LogScale IDP configuration

3. Set up group mapping (optional).

##### Step 1 — Create an application

1. Sign in to the Azure portal and choose the Entra ID ID card:

   Figure 40. Azure Active Directory

2. Open Groups and click New group: here you create the groups that will be added later in LogScale for synchronization. For example, you can create a logscale_admin group.

   Figure 41. Groups in Azure AD

3. Open Enterprise Applications and click New application:

   Figure 42. Enterprise Applications in Azure AD

4. From the Browse Entra ID App Gallery page:

   - Click + Create your own application

   - Enter a name for the app, e.g., logscale_idp

   - Choose Integrate any other application you don't find in the gallery option

   Figure 43. Create your application in Azure

5. Click Create: your application is now added successfully.

##### Step 2 — Set up LogScale IDP configuration

1. In the new application page, click Single sign on and then choose SAML as your single sign-on method:

   Figure 44. Select SAML single sign-on

2. In the Basic SAML Configuration window:

   - Click Add identifier. Set Identifier (Entity ID) to `$YOUR_LOGSCALE_URL/api/v1/saml/metadata`

   - Click Add reply URL. Set Reply URL to `$YOUR_LOGSCALE_URL/api/v1/saml/acs`

   - If needed, set Sign on URL if you want to perform identity provider-initiated single sign-on. Contact LogScale Support to get the Sign on URL.

   - If needed, populateRelay State with an integration URL to instruct the application where to redirect users after authentication, for example, the URL to a specific location within the application.

   Figure 45. Basic SAML Configuration settings

3. In the SAML-based Sign-on page of your newly created application, copy the Login URL, Azure ID Identifier, and the text of the Certificate (Base 64) as you will need them later for LogScale.

   Figure 46. SAML-based Sign-on information

##### Step 3 — Set up group mapping (optional)

1. Go to `Attributes and Claims`. Click + Add a group claim and select which groups you want to be associated with the users (except None) and the source attribute. Click Save.

   Figure 47. Add a group claim

2. Still in the `Attributes and Claims` page, click the first claim Unique User Identifier to assign users to LogScale on the IDP side.

   Figure 48. Edit the Unique User Identifier claim

3. In the `Manage claim` window, ensure that Name identifier format and Source are set as in figure below:

   Figure 49. Manage claim

4. Still in the `Manage claim` window, expand Claim conditions and click Scoped Groups to select the new group and assign user type (e.g. Members, Admin) and user.mail as the value:

   Figure 50. Add user types to group

#### Configure LogScale to use Entra ID

When Entra ID is configured to work with LogScale, you must configure LogScale to work with Entra ID.

To configure Entra ID to work with LogScale, navigate to the configuration files and add the environment variables shown below and configure the configuration variables as described in Configure SAML for LogScale Self-Hosted.

ini

    AUTHENTICATION_METHOD=saml
    PUBLIC_URL=http://localhost:8080

    SAML_IDP_SIGN_ON_URL=

    SAML_IDP_ENTITY_ID=

    SAML_IDP_CERTIFICATE=

    AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN=true
    PERMISSION_MODEL_MODE=advanced
    EMERGENCY_USERS=true

#### Group synchronization

After LogScale has been configured to use Entra ID, you need to align the Entra ID groups' Object ID in LogScale.

1. Go back to Azure AD and from your group's page, copy the Object ID:

   Figure 51. Copy Object ID from Azure AD

2. In LogScale, first create the group manually (provide a name that is similar to the group name set in Azure AD) and then paste the Object ID into the Mapping Name field, under the External provider tab:

   Figure 52. Mapping Name

#### Test the Entra ID integration setup

Once all of the necessary steps to set up the Entra ID authentication for LogScale are completed, you need to test the setup.

1. Go to a Terminal and start LogScale with the following command:

   shell

       ./run.sh

   Allow two to three minutes for LogScale to start.

2. Connect to localhost in a browser. It should redirect you to a Microsoft login.

3. Sign into your Entra ID. You should be taken to LogScale.

#### Other references for Entra ID configuration

Other documentation about Entra ID configuration that may be helpful includes:

- Entra ID ID for more information on SAML 2.0 integration

- Microsoft Entra ID documentation for more information on Entra ID ID.

#### Enter search term