Boundary
OIDC authentication with Microsoft Azure
OpenID Connect (OIDC) is an internet-scale federated identity and authentication protocol built on top of the OAuth 2.0 authorization framework and the JSON Object Signing and Encryption (JOSE) cryptographic system. OIDC builds on top of the OAuth 2.0 authorization protocol to enable a user to authorize a third-party application to access the user’s identity and authentication information.
The OIDC authentication method allows Boundary users to delegate authentication to an OIDC provider. This feature allows Boundary to integrate with popular identity providers like Microsoft Entra ID, cloud-hosted active directory services with an OIDC frontend, and cloud identity management systems such as AWS IAM.
Boundary users can create, read, update, and delete new OIDC authentication methods using the Admin Console UI, Boundary CLI, or the Boundary Terraform provider to enable login. OIDC auth methods can also be utilized for logging into the Admin Console and Desktop applications.
This tutorial provides an example of setting up OIDC with the Microsoft Entra ID provider and managing OIDC authentication methods.
OIDC authentication methods overview
- Get setup
- Microsoft Entra ID configuration
- Auth method creation
- Authentication states
- OIDC authentication
Prerequisites
A Boundary binary greater than 0.8.0 in your
PATH
This tutorial assumes you can connect to an HCP Boundary cluster or launch Boundary in dev mode.
An Azure test account. The associated email address should not be tied to another SSO method, so use of a personal account is recommended.
Installing the Boundary Desktop App provides an optional workflow for this tutorial. The 1.2.0 version or above is required for OIDC support.
Installing Terraform 0.13.0 or greater provides an optional workflow for this tutorial. The binary must be available in your
PATH
.
Get setup
In this tutorial, you will test OIDC integrations using HCP Boundary or by deploying a Boundary controller locally using dev mode.
The HCP Quickstart tutorials provide an overview of getting started with an HCP Boundary cluster.
If you have an HCP Boundary cluster deployed, the Access HCP Boundary tutorial provides an overview of configuring your local machine to authenticate with your HCP cluster.
This tutorial provides both CLI and UI workflows for setting up OIDC authentication.
To proceed with the UI workflow:
Open the Admin Console UI by entering your HCP Boundary Cluster URL into a browser (such as
https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud
).Enter the admin username and password you created when you deployed the new instance and click Authenticate.
You are now logged into your HCP Boundary instance's Global scope using the web UI. This is the default scope for all new Boundary clusters. You can now proceed to the Providers section to proceed with the Admin Console UI workflow.
Providers
To enable an OIDC auth method an administrator must first configure their OIDC provider, and then Boundary. The administrator registers Boundary as a new client with their OIDC provider by providing some values unique to their Boundary deployment. The administrator then configures Boundary with unique client information provided by their OIDC provider during registration. These values must match up for OIDC to work.
The administrator will need to provide a list of Boundary callback URLs when configuring the OIDC provider. The callback URLs route to one of the controllers and must begin with 'https', unless Boundary is in dev mode, where the URLs will route to localhost.
Many OIDC providers can be integrated with Boundary. This tutorial demonstrates working with Microsoft Entra ID, a popular provider for OIDC.
Get setup on Microsoft Entra ID
An Azure account and sample application are required to setup Entra ID as an OIDC provider for Boundary. If you don't have an account, sign up for Azure. It is recommended to use a personal Microsoft account for testing, and to avoid integrating an account that might already be associated with Azure. A free account is suitable for testing OIDC integration with Boundary. Please note that you are responsible for any charges incurred by following the steps in this tutorial.
Create a user
First, create an Entra ID user that will be permitted to log into the application that authorizes Boundary.
Tip
You may also use your existing Azure user account to test OIDC with Boundary. Skip to the Create an application section to avoid creating a new user.
Once signed up, it may take some time for a new tenant to become available. Once available, sign in to the Azure Portal. Navigate to the Microsoft Entra ID view using the sidebar on the left side of the page.
You will need an Entra ID tenant that is permitted to log into the application that authorizes Boundary. If no tenants are listed in the Azure AD view, create a new tenant by following these instructions in the Azure docs. You can also use a pre-existing tenant if one is already set up. This tutorial uses the Boundary organization and the boundaryoidc domain name.
Next, create a new user. In the tenant sidebar menu, select Users from the Manage section. Click the + New User button.
Enter the User name, and under Password enable the Let me create the password option. Define a password, then click Create.
The new user should then be displayed under the Entra ID Users portal. This tutorial created a user named admin with the User Principle Name
admin@boundaryoidc.onmicrosoft.com
.If using Terraform to provision Boundary, select the newly created user to view its details. Copy the Object ID value under the Identity section. Save this value for defining the
oidc_user
subject
later on.
Create an application
An application is what authorizes Entra ID users added in the previous step to connect with Boundary. After creating an application, its configuration details are used to add the OIDC auth method to Boundary.
There are two methods for setting up Boundary as an OIDC provider with Microsoft Azure:
- Microsoft Entra enterprise application
- Generic Entra web application
Either method allows for authentication to Boundary using Microsoft Entra ID as an identity provider. Select an Microsoft Entra configuration method to proceed.
This content borrows heavily from the Microsoft Entra single sign-on (SSO) integration with HashiCorp Boundary documentation.
From the Microsoft Entra ID view, select Enterprise applications using the sidebar on the left side of the page.
From the Enterprise applications view, click the + New application button.
Type
hashicorp boundary
in the search bar, and click on the HashiCorp Boundary result.Confirm the name of your Boundary integration (this example uses
HashiCorp Boundary
) and click Create.From the HashiCorp Boundary | Overview page, click Single sign-on.
From the HashiCorp Boundary | OIDC-based Sign-on page, click Go to application.
Click Authentication under the Manage sidebar.
The callback URI is shown under the Redirect URIs section. This URI is created by appending
/v1/auth-methods/oidc:authenticate:callback
after your HCP Boundary Cluster URL. For example,https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud/v1/auth-methods/oidc:authenticate:callback
.Modify the Redirect URIs by pasting your Boundary address into the callback URI.
Paste the callback URI in the Web field.
https://BOUNDARY_ADDR/v1/auth-methods/oidc:authenticate:callback
For example:
https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud/v1/auth-methods/oidc:authenticate:callback/v1/auth-methods/oidc:authenticate:callback
Scroll down and locate the Front-channel logout URL. The logout URL ensures session logouts are handled correctly.
Construct the logout URL by appending
:3000
to the end of your HCP Boundary Cluster URl. For example,https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud:3000
https://BOUNDARY_ADDR:3000
Click Save.
Select Certificates & Secrets from the Manage sidebar on the left. Click New client secret and fill out the secret details. This tutorial describes the secret as Boundary OIDC test secret.
Click Add.
Copy the client Secret value and store it for use later. Ensure you grab the Value, not the Secret ID.
Lastly, navigate back to the App overview view using the menu on the left.
From this view, copy the Directory (Tenant) ID and the Application (client) ID.
You will also need to construct the application Issuer URL.
An Entra ID OIDC identity provider issuer is usually formatted like
https://login.windows-ppe.net/Tenant_ID/v2.0
, but it may vary depending on your account.This is constructed from the OpenID Connect metadata document value, which is located in the application Endpoints view on the Overview page.
Click on Endpoints. Copy the OpenID Connect metadata document value, up to the
/v2.0
. For example,https://login.windows-ppe.net/e29eae0c-29d7-4851-5e1fb68bfb3-5f8e3/v2.0
This value will be the Issuer used to configure the Boundary OIDC auth method.
Note
You may need to refer to Entra OIDC documentation for the latest OIDC endpoint schemas.
Three important values are needed to configure OIDC with Boundary.
- Issuer
- Client ID
- Client Secret
The following format is used for these values:
issuer
->https://login.windows-ppe.net/Tenant_ID/v2.0
(copied from OpenID Connect metadata document)client-id
-> Application (client) ID)client-secret
-> Client Secret value
For example, this tutorial uses the following values:
- Issuer:
https://login.windows-ppe.net/e29eae0c-29d7-4851-5e1fb68bfb3-5f8e3/v2.0
- Client ID:
a4d21a76-e08c-4d8d-8c47-e1c423ee4d11
- Client Secret:
X9u~u58--~rWLR4Q9i1-PtdZOi_s04~9O-
Keep these values in a safe place for use in the next steps.
Auth method creation
Authentication is the process of establishing a user's identity. The user initiates this process by selecting an auth method.
When the user selects an OIDC auth method, the user's client sends a request to the system and includes additional data about the client itself. The system then returns two URLs: an OIDC authentication request URL and a Boundary token request URL.
If the user's client is a web browser, the client stores the Boundary token request URL in local storage then redirects the page to the OIDC authentication request URL. If the user's client is not a web browser, the client opens a web browser to the OIDC authentication request URL and begins polling the Boundary token request URL.
The user interacts with the OIDC provider to prove their identity using the browser window opened by the user's client. Once the OIDC provider has authenticated the user's identity, it redirects the browser window back to Boundary. The user's client then retrieves a Boundary token from the request URL.
To get started, an authentication method must be created for the provider of choice.
Create auth method for the provider
To set up a new auth method for your provider you will need the following from your provider's application settings:
- issuer
- client-id
- client-secret
Auth methods can be created using the Admin Console UI, CLI, or using Terraform.
The Boundary Admin Console provides a UI for creating and managing OIDC resources, including auth methods.
Open the Admin Console UI by entering your HCP Boundary Cluster URL into a
browser (such as
https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud
).
Enter the admin username and password you created when you deployed the new instance and click Authenticate.
For Entra ID, these settings map to the following:
issuer
->https://login.windows-ppe.net/Tenant_ID/v2.0
client-id
-> Application (client) ID)client-secret
-> Client Secret value
With these values you gathered from setting up an Entra ID application, a new OIDC auth method can be created.
Start by navigating to the Auth Methods settings view using the menu on the left side of the Admin Console. Select New and click OIDC.
Fill out the form details using the settings gathered from the Entra ID application settings.
These include:
- Name (Example:
Azure
) - Description (Example:
Azure OIDC test auth method
) - Issuer (Example:
https://login.windows-ppe.net/e29eae0c-29d7-4851-5e1fb68bfb3-5f8e3/v2.0
) - Client ID (Example:
a4d21a76-e08c-4d8d-8c47-e1c423ee4d11
) - Client Secret (Example:
X9u~u58--~rWLR4Q9i1-PtdZOi_s04~91-
) - Signing Algorithm
- Set to RS256
- Click Add
Additionally, set the API URL Prefix. The API URL Prefix is set to the HCP
Boundary Cluster URL (for example,
https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud
)
- API URL Prefix:
https://BOUNDARY_ADDR
API URL Prefix
The API URL Prefix is used for actions like token retrieval and redirection.
Once the form is completed, click Save.
The new authentication method has now been created. Under the Attributes output, notice the state is set to inactive. Before it can be used the new auth method must be switched to an active state.
Next we will review the available authentication states and activate the new OIDC auth method.
Troubleshooting
Troubleshooting: If unable to save the auth method, ensure that the Issuer is prefixed by https://
and does NOT have a trailing /
at the end of the URL.
Authentication states
An OIDC auth method can be in one of several different states: Inactive, Active Private, and Active Public. The current state of an OIDC auth method affects how endpoints respond to requests and, in some cases, whether access to an endpoint requires authentication.
State change operations
- MakeInactive transitions an OIDC auth method from either the Active Private or the Active Public state into the Inactive state.
- MakePrivate transitions an OIDC auth method from either the Inactive or the Active Public state into the Active Private state. If transitioning from the Inactive state, the transition will only succeed if the configuration is valid.
- MakePublic transitions an OIDC auth method from either the Inactive or the Active Private state into the Active Public state. If transitioning from the Inactive state, the transition will only succeed if the configuration is valid.
Three different states exist for an authentication method:
inactive
users can not authenticate with inactive auth methods and the inactive auth methods are not listed for unauthenticated users.active-private
users can authenticate with active-private auth methods and active-private auth methods are not listed for unauthenticated users.active-public
users can authenticate active-public auth methods and active-public auth methods are listed for unauthenticated users.
Before changing the state of an auth-method, Boundary will retrieve the Provider’s discovery document for the auth method’s issuer and attempt to validate the auth-method’s configuration against this published information. If Boundary is unable to validate the configuration an error is returned and the state change is not made.
If a change is made from active-public or active-private to inactive, all in-flight authentications will succeed unless the auth method’s configuration is modified while the request is in-flight.
When changing an auth method's state using boundary auth-methods change-state
the -disable-discovered-config-validation
flag is used to disable validation
against the provider’s published discovery document. This allows for the very
rare occurrence when the Provider has published an invalid discovery document.
Activate the OIDC auth method
Now that a new OIDC method has been created, it can be activated and assigned as the default login type for the global scope.
Currently the login type is set as inactive, and won't allow authentication.
$ boundary authenticate oidc -auth-method-id amoidc_oHt4HQFCrN
Error from controller when performing authentication start
Error information:
Kind: Internal
Message: authmethod_service.(Service).authenticateOidcStart: Error generating parameters for starting the OIDC flow.: unknown: error #500
Status: 500
context: Error from controller when performing authentication start
Auth methods can be activated using the Admin Console UI, CLI, or using Terraform.
Before the new auth method will be allowed it must be set to an active state.
Under the settings for the new auth method, select Inactive from the menu in the upper-right side of the page and change its state by clicking Public.
The login type will now allow be allowed.
Set OIDC as primary login
Global and organization scopes may have auth methods in Boundary, and each scope has one primary auth-method ID. Boundary will automatically create a user upon first successful authentication using the scope’s primary auth method, which will be used by scopes with only one auth method available.
When migrating the database, Boundary will produce a log of any auth methods which resulted in no primary auth method being set for the scope.
Set the new OIDC auth method as the primary auth method for the global scope.
Under the settings for the new auth method, select Manage from the menu in the upper-right side of the page.
A confirmation window will be displayed to inform you that new users that sign in using OIDC will automatically be added to the new auth method. Select OK to continue.
Now try authenticating using the newly created OIDC auth method.
Select the admin user menu in the top-right corner of the page and select Deauthenticate.
Next, select the new auth method called Azure, and click Authenticate.
A browser tab should automatically open and prompt you to log in with your Azure user account credentials. Ensure you log in with the test user credentials created in the Entra ID application setup, not your primary Azure account.
Login Issues
If you experience any issues logging in, you may be logged into the wrong Azure account. Visit the Azure Portal, select your username in the upper-right corner of the window and click Sign Out. Then, revisit the previously opened Authenticate Boundary browser tab and click Retry to log back into Azure with the test user account credentials.
After successful authentication you are automatically redirected to the Admin Console. Notice the restricted permissions for this new user, which can be updated and assigned using Roles and Groups.
If you were to log back into the Admin Console as the admin user, you would notice the new OIDC user has automatically been added under the Users view.
Next you will review the various methods that can be used to authenticate to Boundary using the new OIDC auth method.
Authenticate using OIDC
With the OIDC provider configured, Boundary users can authenticate using the CLI, Admin Console or Boundary Desktop app. Boundary administrators will usually follow a CLI or Admin Console workflow, while clients and end-users can use the CLI or Desktop application.
The Boundary Desktop app is currently available for MacOS and Windows users.
Launch the Boundary Desktop app and enter the Boundary Cluster URL.
The Cluster URL was copied from the HCP portal, such as
https://e58fe114-7624-431c-994d-b6670e90b03J.boundary.hashicorp.cloud
. Click Submit.Select Azure and click Authenticate.
A browser window should launch and prompt for your provider's user credentials. You may see an "Authentication Pending" message, and can click the "Retry" button to force a new authentication tab to open.
Submit your OIDC provider user credentials.
You should receive a "Successful Authentication" message.
Once authenticated, open the Boundary Desktop app again and verify the authenticated user in the upper-right corner of the application window.
It is expected for this user to be unprivileged, and to be denied access to view targets and sessions. The OIDC user could be updated to include new privileges if an admin user assigns it to a role.
You have now completed OIDC integration with the Boundary Desktop app.
Cleanup and teardown
Warning
If you plan on completing the Manage IdP Groups tutorial, leave the current configuration running. Successful completion of this tutorial is a pre-requisite for the Manage IdP Groups tutorial.
If you are not continuing on to the next tutorial, tear down the environment:
1. Remove any unwanted test auth methods from your HCP Boundary Cluster. This can be done by deleting the auth method in the Admin Console UI, or by providing your auth method ID using the CLI:
$ boundary auth-methods delete -id amoidc_40fr5jkLpk
2. Delete any sample applications from your OIDC provider.
This tutorial provided steps for configuring an Entra ID sample applications as Boundary auth methods. Revisit the provider settings and delete any sample applications you no longer need.
3. Delete any test users from your OIDC provider.
This tutorial created sample users within Azure to authenticate using the CLI, Admin Console or Desktop app. Revisit the Entra ID settings and remove any test users created for this tutorial.
4. Delete any test client secrets from your OIDC provider.
This tutorial may have created client secrets within Azure. Revisit the provider settings and remove any client secrets created for this tutorial.
Next steps
This tutorial demonstrated the steps to add an OIDC authentication method and create a new user. You set up a provider application to authenticate with Boundary, and verified that you can authenticate using the newly created user.
Next, check out the Manage IdP Groups tutorial to learn about automatically managing group membership claims with OIDC auth methods.
To learn more about the basics of managing user accounts, check out the Manage Users and Groups and Manage Roles tutorials.