Configure SSO with Microsoft Entra ID

Set up Single Sign-On (SSO) in TrapEye by creating an application in Microsoft Entra ID and linking it to TrapEye through the OpenID Connect (OIDC) protocol.

1. In the Microsoft Entra portal, navigate to App registrations → New registration.

   

2. Enter a name for your application (e.g. TrapEye SSO).

3. Under Supported account types, select:

   Accounts in this organizational directory only

4. Under Redirect URI, choose Web and enter the following value:

   https://trapeye.anantis.io/api/auth/oidc/callback

   This URL is the callback endpoint Azure uses to redirect users after a successful authentication.

   

   Click Register to create the application.

1. From your newly created application, go to the API permissions menu.

   

2. Click Add a permission → Microsoft Graph → Delegated permissions.

3. In the OpenID permissions section, select the following permissions:

   • openid
   • profile
   • email

   

4. Click Add permissions to confirm.

1. Navigate to the Overview section of your application.

2. Copy the following identifiers, they will be required during TrapEye configuration:

   • Application (client) ID
   • Directory (tenant) ID

   

1. Go to Certificates & secrets → New client secret.

   

2. Enter a description (e.g. TrapEye SSO Secret) and set an expiration (recommended: 24 months).

3. Click Add.

4. Copy the generated Value (this is your client secret).

1. Once your Azure app is ready, log in to the TrapEye Portal

2. Navigate to Settings → Configuration and select the SSO Configuration menu.

3. Fill in the following fields:

   Field	Value
   Issuer URL	https://login.microsoftonline.com/<Directory (Tenant) ID>/v2.0
   Client ID	Application (client) ID
   Client Secret	The secret value you generated
   SSO Domain.	The domain that determines which OIDC issuer should be used during login.

4. Click Save, then Test Connection to validate your setup.

By default, all users in your Entra ID tenant can log in to TrapEye without any restriction.

To restrict access to specific groups only, it is possible to configure the Allowed Groups fields.

1. Navigate to Token Configuration → Add groups claim

   

   • Select Security Groups to include group information in the OpenID ID token.
   • In Customize token properties by type → ID, verify that Group ID is selected.
   • Click Add to save.

2. Go to Groups → All groups:

   

   • Select the group(s) whose members should be allowed to authenticate in TrapEye.
   • Ensure that the Group type is Security.
   • Copy the Object ID of the desired group(s).

3. Go back to the TrapEye Portal in Settings → Configuration → SSO.

   

   • Paste the Object ID of the desired group(s).
   • Save Configuration.

TrapEye is now integrated with Microsoft Entra ID for secure, seamless Single Sign-On.