Azure AD OIDC

1. Create an Enterprise Application in Azure AD

1. Log in to the Azure portal and navigate to Entra ID.
2. Select Enterprise applications and then click on New application.
3. Click Create your own application
4. Choose Register an application to integrate with Microsoft Entra ID (App you're developing) and provide a name for the application (e.g., GoRules BRMS DEV).
5. Next, in Supported account types, select Accounts in this organizational directory only (Default Directory Only - Single tenant).
6. In Redirect URI section, for select platform chose Web from the dropdown and enter app_url/oauth/azure where your self-hosted BRMS is hosted for example at https://gorules-dev.your-company.com and the complete URI would be https://gorules-dev.your-company.com/oauth/azure.
7. After creation, navigate to the application's overview page, navigate to the Single sign-on menu and click on Go to application to open App registrations experience
8. From the new page copy and save Application (client) ID for later use.

2. (Optional) Add Azure AD Group Claims

1. In the Apps registration experience for the application open Token configuration section.
2. Click on Add group claim to include group membership information in the token.
3. Configure the claims according to your organization's requirements (e.g., include groups assigned to the application and for Access and ID select sAMAccountName). and press Save.

3. Create Credentials for the Enterprise Application

1. In the Apps registration experience for the application open Certificates & secrets.
2. Under Client secrets, click New client secret.
3. Add a description for the secret, set an expiry period, and click Add.
4. Once created, copy and save the client secret value for later use (Note: It will not be visible again after you leave this page).

4. Copy endpoints

1. In the Apps registration experience for the application, in the section Overview click on the Endpoints.
2. Copy
   1. OAuth 2.0 authorization endpoint (v2)
   2. OAuth 2.0 token endpoint (v2)
3. For a Single tenant setup copy Authority / Tenant Endpoint: e.g. https://login.microsoftonline.com/TENANT_ID

5. Configure GoRules BRMS Environment Variables

To configure Azure AD SSO you will need to add Environment Variables for the BRMS. Table below represents environment variable mapping.

📘

Upon setting configuration you will need to restart BRMS for changes to take effect.

6. Optional Environment Variables

To configure group mapping use SSO_OAUTH2_GROUPS_MAPPING variable and add groups into scopes.

Mapping is represented as {{azure_group_uuid}}->{{brms_role}} comma , separated with the next mapping.

There are 4 levels of global permissions: owner, admin, author, and member.

📘

Multiple groups can map to the same role.

📘

Group uuid is unique group id from Entra ID, if variable is not set, permissions will be managed from inside BRMS. If variable is set and existing user is not found in the mapping string, user will be added to the member group.