Using Microsoft Entra ID for SAML 2.0 Authentication

Scenarios

When logging in to Workspace using Single Sign-On (SSO), Workspace functions as the Service Provider (SP), and the enterprise's identity management system functions as the Identity Provider (IdP). This section describes how to set up SAML 2.0-based SSO connecting Workspace and an enterprise IdP. Workspace trusts the IdP based on configured metadata, and the IdP allows users to log in to Workspace using SSO. With SAML 2.0 SSO, when an enterprise employee attempts to log in to the client, the system automatically redirects the user to the enterprise's trusted authentication platform for identity authentication.

This section uses interconnection between Workspace and Microsoft Entra ID as an example to explain how to set up SAML 2.0 SSO.

Step 1: Creating an Application in Microsoft Entra ID

1. Log in to the Azure portal as a Microsoft Entra ID administrator.
2. In the navigation pane, choose Microsoft Entra ID > Manage > Enterprise applications > All applications.
3. Click New application. On the Browse Microsoft Entra App Gallery page, click Create your own application.

   

4. On the Create your own application page, enter an application name (for example, WorkspaceOAuth2), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

   

5. On the Overview page, assign Workspace users to the application.

   

6. Click the created application and click Get started under Set up single sign on.

   

7. Under Select a single sign-on method, select SAML.

   

   

8. Set basic SAML parameters.

   Table 1 SAML parameters

   Parameter	Example Setting
   Identifier	urn:huawei:workspace
   Reply URL	{access_url}/v2/access/auth/{project_id}/saml2/assertion-consumer
   Logout Url	{access_url}/v2/access/auth/{project_id}/saml2/logout

   

   Replace access_url and project_id with the actual values.

   

9. Under SAML Certificates, click Download next to Federation Metadata XML to download the XML file.

   

Step 2: Enabling Third-Party SSO Authentication on the Workspace Console

• When SAML 2.0 is enabled, the system redirects the user to the IdP for authentication, and password-based login is no longer supported for Workspace.
• The IdP has obtained the corresponding IdP metadata file from the third-party platform (Microsoft Entra ID).

1. Log in to the management console.
2. In the navigation pane, choose Tenant Configuration > Authentication Configuration. On the Primary Authentication page, click Modify.
3. Select Third-party SSO authentication as the primary authentication type.
4. Select SAML2.0 as the protocol type and configure the settings as described in Table 2.

   Table 2 SAML 2.0 configuration items

   Configuration Item	Description	Reference Value	Provider
   Identity Provider Name	The name is user-defined and can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are supported.	Azure	Defined by the tenant
   Access Server Address	Internet access address or Direct Connect access address. The value contains 1 to 255 characters and cannot be empty.	https://vdesk.huawei.com:8443	Provided by the tenant. It can be obtained from the Workspace console.
   IDP Metadata	An IdP metadata file. It contains the IdP configuration details, including the IdP's entity ID, supported authentication methods, and signature certificates. The file must be a valid UTF-8-encoded XML file, and the file size cannot exceed 1 MB.	Click Add File to upload the metadata file downloaded in 9. NOTE: The metadata file is provided by the IdP in XML format. It includes the IdP's login service address and its X.509 public key certificate, which is used to verify signatures on SAML assertions issued by the IdP.	Provided by the SAML IdP
   User ID	The user ID in URL format. The user ID must be the same as the Workspace username.	http://schemax.xxx.xxx	Provided by the SAML IdP

5. Click Save.
6. Click Download next to SP Metadata and save the downloaded SP metadata for backup.

Step 3: Configuring SAML in Microsoft Entra ID

1. Log in to the Azure portal as a Microsoft Entra ID administrator.
2. In the navigation pane, choose Microsoft Entra ID > Manage > Enterprise applications > All applications.
3. On the page of the created application, choose Manage > Single sign-on from the navigation pane.
4. Under Select a single sign-on method, click SAML.

   

5. In the upper left corner of the page, click Upload metadata file, select the metadata file downloaded in 6, and click Add.

   

Step 4: Assigning Users to Enterprise Applications in Microsoft Entra ID

A user has been created in Microsoft Entra ID, and the user created on the Entra ID platform must be the same as the Workspace user. Otherwise, the verification fails.

1. Log in to the Azure portal as a Microsoft Entra ID administrator.
2. In the navigation pane, choose Microsoft Entra ID > Manage > Users and groups.
3. Click Add user/group. The page for adding and assigning users/groups is displayed.
4. Select the required user and click Select.
5. Click Assign to assign the user to the application.

Step 5: Verifying the Login

1. Open the Huawei Cloud client, enter the server address and enterprise ID, and click Connect to the server.

   

2. Click Log In. You are directed to the Microsoft Entra ID authentication platform.

   

3. Enter the username and password. You are directed to the desktop list.
4. Click the desktop you want to log in to.