Configuring Single Sign-On with Microsoft Entra ID (OIDC)

To configure single sign-on with Microsoft Entra ID, you need to complete steps in both Azure and in the JAMS Web Client.

Complete the steps in all sections below to complete the setup.

1. Azure Configuration

1.1 Registering the Application in the Azure Portal

1. Go to the Azure Portal.

2. From the menu in the upper left corner, select Microsoft Entra ID.

3. Expand the Manage menu.

4. Click App registrations.

5. Click New registration.

6. Configure the following items:

   • In the Name field, enter JAMS Web Identity OIDC (or your preferred name).

   • In the Supported account types field, select Single tenant.

   • In the Platform drop-down menu, select Web.

   • In the URI field, enter https://server:port/signin/scheme. For example, you may use https://public-IPAddress:443/signin/azuread as this is the default for the JAMS Web Client. You can change the server and port combinations if you have a different configuration for the JAMS Web Client.

     • The scheme must only contain letters, numbers, an underscore, or a hyphen. Also, it must always start with a letter.
     • Copy the scheme value entered in the URI. You will need to enter it in the Scheme field when creating the OIDC Identity Provider in the JAMS Web Client.

7. Click Register.

1.2 Configuring Authentication

1. Go to your registered app.
2. Select Authentication.
3. Under Redirect URI, ensure your callback URL is listed.
   Example: https://public-IPAddress:443/signin/azuread.

1.3 Creating the Client Secret

1. Expand the Manage menu.
2. Click Certificates & secrets | Client secrets.
3. Click New client secret.
4. Add a description and expiration date.
5. Click Add.
6. Copy the Secret Value from the Value column. This value is shown only once.
   Example: 1234a~5678B901234c5678d901234e5~67890123
7. Click Overview from the menu on the left.
8. Copy the Application (client) ID.
   Example: 12345678-1234-1234-1234-123456789abc
9. Click Endpoints. A list of Authority URLs is displayed.
10. Copy the Authority URL. Several may be listed. You may want the option that has the same value as your tenant ID in Azure.
    Example: https://login.microsoftonline.com/1234a567-8b91-c123-4d56-7891e1234f1

1.4 Configuring the Token

1. Expand the Manage menu.
2. Click Token configuration.
3. Click Add optional claim.
4. In the Token type section, select ID.
5. Select the email, onprem_sid, preferred_username options.
6. Click Add.

1.5 Optional - Verify the Manifest

1. Click the Manifest menu.
2. Ensure the Microsoft Graph App Manifest tab is selected.
3. Scroll down until you see the following and verify "onprem_sid" is listed.
   

  "idToken": [ 
    {....}, 
     { 
      "name": "onprem_sid", 
      "source": null, 
      "essential": false, 
      "additionalProperties": [] 
      }, 
    {....}

1.6 Adding the Groups Claim

1. Click Token Configuration.
2. Click Add groups claim.
3. For the group types, select Security groups.
4. Expand the ID option under Customize token properties by type.
5. Select On Premises Group Security Identifier.
6. Click Add.

1.7 Optional - Verify the Manifest

1. Click the Manifest menu.
2. Ensure the Microsoft Graph App Manifest tab is selected.
3. Scroll down until you see the following and verify it has the "on_premise_security_identifier".
   

"idToken": [ 
  {....}, 
     { 
       "name": "groups", 
       "source": null, 
       "essential": false, 
       "additionalProperties": [ 
        "on_premise_security_identifier" 
        ] 
      }, 
  {....}

1.8 Adding API Permissions

1. Click API permissions.
2. Under API/Permission name, click Microsoft Graph.
3. Click Delegated Permissions.
4. Add Group.Read.All and User.Read.
5. Click Update Permissions.
6. Under API/Permission name, click Microsoft Graph.
7. Click Application Permissions.
8. Add GroupMember.Read.All and User.Read.All.
9. Click Update Permissions.
10. Grant admin consent.

note

Group claim limits with large Microsoft Entra group memberships

If a user belongs to more than 150 groups (SAML2) or 200 groups (OIDC), Microsoft Entra omits the groups claim from the token entirely. JAMS then treats that user as having no group memberships, and they will lose all group-based ACL access. To avoid this, configure the Entra app registration to emit only Groups assigned to the application rather than all of the user's groups. This keeps the emitted group count under Entra's limit.

2. JAMS Web Client Configuration

2.1 Adding the Microsoft Entra ID Identity Provider in the JAMS Web Client

After you have configured Azure, you can add the Identity Provider in JAMS.

1. Click Access from the main menu.
2. Click Identity Providers.
3. Click Add.
4. In the Provider field, select Microsoft Entra ID via OpenID Connect.
5. In the Scheme field, enter the scheme name for this Identity Provider that you used in Azure for the URI, such as azuread.
6. In the Display Name field, enter the text that you want displayed as the button text on the JAMS Web Client Log in screen. For example, you can enter Entra ID OIDC.
7. Click Save and Continue to Edit.
8. In the Authority field, enter the Authority URL that you previously saved from the Azure portal.
   Example: https://login.microsoftonline.com/1234a567-8b91-c123-4d56-7891e1234f1.
9. In the Client ID field, enter the Application (client) ID that you previously saved from the Azure portal.
   Example: 12345678-1234-1234-1234-123456789abc.
10. Click Save.
11. Click Change to enter the Client Secret.
12. In the New Client Secret and Reenter Client Secret fields, enter the Client Secret value.
    Example: 1234a~5678B901234c5678d901234e5~67890123
13. Click Save on the Change Client Secret box.
    
14. To use this new Identity Provider, click ENABLE in the top right corner of the Summary table.
    A message is displayed prompting you to restart the Identity Service for this change to take effect. Complete the remaining steps to restart this service. When an Identity Provider is enabled, the JAMS Web Client makes the input fields read-only and activates the Identity Provider. To edit it again, the Identity Provider must be disabled.
15. Log out of the JAMS Web Client.
16. Open the Windows Services manager.
17. Right-click the JAMS Identity service and select Restart.
18. Go to the JAMS Web Client Log in screen. A button for this Identity Provider is now displayed under the or continue with label.