Hi, I'm Jelan from Sophos Techvids and today I'll be walking you through the new Azure AD
Single Sign On feature introduced in Sophos Firewall version 19.5.
The Azure AD integration allows you to natively integrate your organization's
Azure active directory with Sophos Firewall to authenticate Azure AD
users signing into their web admin console.
This feature essentially eliminates the overhead of pre-configuring
administrator users with different roles and access rights on the firewall.
This is great for organizations with multiple or dynamic administrators who
need to access the web admin console with varying roles and access rights to
integrate Azure AD with Sophos Firewall.
First, we need to configure App registration in the Azure Portal
then add the Azure AD application in our Sophos Firewall.
Let's jump in.
So starting off in the Azure Portal, we need to create an application.
Let's navigate to active directory
and the directory of your choice. Navigate to the "App registration" page,
click "New Registration".
Let's give that a name. Call it firewall-sso-integration.
Under Supported Account Types, select
“Accounts in this organizational directory only (Default Directory only - Single tenant)”.
Under "Redirect URI", let's select "Web" and click "Register."
Now our App is created, great.
Copy these IDs for later.
We're going to need them when configuring the firewall.
Next we'll need to assign the appropriate API permissions so the App
is actually able to read the user profile and group information once users log
into the firewall.
All right, let's navigate to the API permissions page,
click "Add Permissions", then "Microsoft Graph", then "Delegated Permissions".
In the select permissions box search for "User.ReadAll", select that
then "Group.ReadAll" and select that
those are the only two permissions we need. Go ahead and click
"Add permissions".
Next we need to click "Grant Admin Consent".
This is essentially signing off on the users being able to access the data
without being prompted every time to consent to the permission which we've granted.
Okay, next we need to create a client secret to allow for secure
communication between the firewall and azure.
Navigate to "Certificates and secrets" and click "New client secret".
Name the secret and select how long it's valid for and hit add.
Now make sure you copy this value because the secret key will only show
one time, you won't be able to see it next time you come back to this page.
Okay, next we need to create an application role.
This is what is actually going to allow you to control access and assign the
appropriate roles to user signing into the firewall.
Navigate to the App roles page and click Create app role.
Enter a display name for the app role. I'll call this “adminFullAccess”.
In Allowed member types, select "Both (Users/Groups+Applications)".
In Value, enter a value for this application role.
Now this value is actually what needs to match when users authenticate,
so careful when naming this.
When a user signs into the Sophos Firewall,
Azure Ad returns a token containing information about that user.
The token includes the application role value associated with that user.
Enter a description for the role.
Yes we do want to enable this app role, so leave that checked and click apply.
Now of course you can create multiple roles for example adminFullAccess,
adminReadOnlyAccess and assign appropriate roles to different users.
Okay, now we'll actually assign users to this application who need access to the firewall.
Go back to the applications "Overview" and
click "manage application in location director".
Click on "Properties" and select "Yes" for "Assignment required".
Next we'll go to "Users and groups"
and click "Add user/group". Select a user from the list.
Assign the required role from the roles we created previously.
And that's it for the Azure AD side of things.
Now let's take a look at the firewall configuration needed to add an Azure Ad server.
In the Sophos Firewall Web admin console will
go to Authentication, Servers and click Add.
From the server type list, select "Azure AD SSO".
Enter a name for the server.
Now we need to fill in the "Application client ID", "Director tenant ID" and the
"Client Secret" values that we got earlier from the Azure portal.
The "Redirect URI" is where users are signing in from.
My user is connecting from the Lan network, so
I'll leave that as is.
Later we'll copy this information and bring it into Azure.
For "Fallback user group", select a group to put users into when no local group
match is found on Authentication.
For Role mapping, Select the identifier type you want to use to authenticate administrators.
If you created application roles in Azure, then select roles and if you
created groups of Administrators in Azure then select groups.
Enter the value of the application role or group you created
and keep in mind this needs to match exactly the value you specified for the
roller group in Azure, so make sure you double-check.
For the profile Select a device access profile you want to assign for the roll or group
and if you created multiple roles you can expand to add more identifier types.
Let's make sure this connection works by clicking "Test connection".
The connection looks good.
Last thing here, we just need to copy the Redirect URI information into Azure.
In the Redirect URI section click copy.
Next to the Web admin console URL.
Alright, let's click save and let's jump back to Azure.
In Azure, go to the application you created for the firewall and under
Essentials, Redirect URI,
add a Redirect URI.
Click "Add a platform", " Web" and in Redirect URLs, paste the URL and click configure.
Now go ahead and hit Save.
Great, now our last step.
Let's jump back to the firewall.
Go to Authentication, Services
and in the Administrator authentication methods move "azure-integration" to the top.
Click on Apply and Ok.
Perfect.
So everything is now configured, so if we log out we'll now see that we have
Single Sign On enabled.
At Techvids we love making these kinds of videos for you.
If you find them useful, let us know by giving us a thumbs up.
Check out the documentation for this video in the video description and for
further assistance, view and post questions on Community.Sophos.com
For more great videos like this one, definitely check out
Techvids.Sophos.com
Thanks for watching. Stay safe out there.