Skip to main content

Setting up WWPass SAML Service Provider for Microsoft Azure with External Users

The purpose of this guide is to use WWPass Authentication when logging into Azure or Entra ID Resources such as Outlook. By using SAML (Security Assertion Markup Language) we can easily integrate into Azure without requiring any additional coding using the SAML standard.

Table of Contents​

  1. Overview
  2. Domain Verification
  3. For External Users

Overview​

Microsoft Azure (specifically Entra ID) manages the user identities and provides access to applications, WWPass provides secure user authentication, and SAML allows the systems to exchange authentication information.

Together, they enable secure, simplified single sign-on (SSO) so users can access applications after verifying their identity through WWPass.

Domain Verification​

Your domain must be verified inside of Azure if you want to use any external Identity Provider (IdP).
By going here: Azure Portal Domain Names, you can see if its verified through the GUI.

Domain Verified

To verify the domain please follow the Microsoft Domain Verification Steps found here.

For External Users​

The setup is different for External Users and requires more configuration, accounts will have an #EXT# in their UPN.

Step 1: Manage Config​

  1. Log in to the WWPass Management Portal Manage Main Page
  2. Create an account if you do not have one, follow the steps and accept the terms. Mange New Account
  3. Click "Add new Application" and give it a name New App Registration
  4. Choose "SAML 2.0" and hit continue Saml New App Registration
  5. Provide Card details into Stripe
    Stripe Checkout
  6. Continue without using a domain. If you would like you can add your custom domain but it requires DNS TXT verification. No Custom Domain
  7. Choose "Microsoft Entra External Identities". This way the correct variables are assigned to the SAML application for Microsoft Internal Users. External Identities Top Scroll down until you reach the 2nd option for inputting variables: External Identities Bottom

Input them as so:
Entity ID: "https://login.microsoftonline.com/{YOUR-TENANT-ID-HERE}"
Assertion Consumer Service URL: "https://login.microsoftonline.com/login.srf"

Step 2: Create an External SAML Identity Provider​

Go to "External Identities" then click on "All Identity Providers", then "Custom" and finally "Add new" and "SAML/WS-Fed"

External Identity Page

Now provide a name while using the SAML protocol.
Next check the "Domainless" box.

External Identity Domainless Config

Choose to input metadata manually and input like:
Issuer URI: "https://saml.wwpass.com"
Passive authentication endpoint: "https://saml.wwpass.com/saml/sso"
Certificate: "MIIDhTCCAm2gAwIBAgIULn7V/L3LR4f+kxAkcYfawS8F5VIwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEldXUGFzcyBDb3Jwb3JhdGlvbjEYMBYGA1UEAwwPc2FtbC53d3Bhc3MuY29tMB4XDTI2MDQxMTE0NTIwM1oXDTM2MDQwODE0NTIwM1owRDELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEldXUGFzcyBDb3Jwb3JhdGlvbjEYMBYGA1UEAwwPc2FtbC53d3Bhc3MuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqAYsO9hEc3XlbqeOI+3Enjqxv0PJKsv7kKcTkEBK6HkE18w/8zANzwUxN3i6NOymANchpFnkIQsK5xw6cveZ5SuvnqSYxFW/o7vP2cVoiyZ/Wm568WUr4+b6fTN3Uk2AmIY8c/S/orC4q/7JHmm4kgMhE5JG6Q79kRnxIc+DUxQRugbdUE6CkZDqbz/bc6k5hIGLJGA71c5PJZvbSXwG34hH87TLmfa/tZN1RN2gHRt1kMM01uhoIktU5Wa5v7nqYDztLx0JUWEub7WuhhmMm3iGk7ZiK+09AAlXwCnDRDfiSDRE68g2axdhIm9F1rmpmf6KuhzUvBzUQIHiK4EOYQIDAQABo28wbTAdBgNVHQ4EFgQU7YNe5ihKb9rZC9C7zfrl4GdkHfEwHwYDVR0jBBgwFoAU7YNe5ihKb9rZC9C7zfrl4GdkHfEwDwYDVR0TAQH/BAUwAwEB/zAaBgNVHREEEzARgg9zYW1sLnd3cGFzcy5jb20wDQYJKoZIhvcNAQELBQADggEBAJIYHTZpixsCU8WlVz+eHDwXHx0HdY/1j82U8BGckPJLuXfirBFO+S3t+f2JoxKijDlWkvWfCY8gu6qHn47BjgENr3BBGW4JkGqtDQSLxukEBJ91O7VV8+wcPsEzGdORT+U7Tehyp4/qGpMhMrp09Npf65IqXtvVYHbDOkXuujgz084N8qR4WMacnx9mdg6Ih6Htu4lhZCYrChJ7KsEPoBbZF7Go/F3nWuJazlDq5VBQCq2EK5jhuDbyKJs4c27ld8lwRYkpol84klyWZ3kFtnj7IsgbUkrx2/fcNSCWzP5p+P297Ox8IoZrr+CVH2Y51XZI5FY8W6yPJ8CBx/5c4Xk="
Metadata URL: "https://saml.wwpass.com/idp/metadata"

Step 3: Invite External Users using Entra ID​

Go to "Entra ID" click on "Users" then like creating a user but instead click on: "Invit External User" and finally type in their email and add the required: "&domain_hint=https%3A%2F%2Fsaml.wwpass.com" at the end of the invite redirect url.

Invite External User

Step 4: Test​

The easiest method to test is to go to portal.azure.com and type in your account.
j.doe@company.com Portal Azure Login

Then it should redirect to the WWPass SAML page, Scan the QR code using your phone and create an account.
WWPass SAML Page

Note: is that Azure is known to have bugs where it might take a day for the configuration to take effect inside your Azure instance so it may redirect to password sometimes.