Using Azure Active Directory with an external identities manager (CloudFlare Zero Trust)

Question

Using Azure Active Directory with an external identities manager (CloudFlare Zero Trust)

Dotan Simha 1

Hi all
I'm looking into integrating CloudFlare Zero Trust as IdP provider for Azure AD. I wish CloudFlare to manage all identities and provide me an SSO (SAML-based) for protecting the Azure.

I followed all instructions in the CloudFlare Zero Trust dashboard - created an Application and used the following configs:
Application: Microsoft Azure
Entity ID: https://login.microsoftonline.com/<AD_TENANT_ID>
Assertion Consumer Service URL: https://login.microsoftonline.com/login.srf

Based on that, I got the CF app configurations to set in Azure Portal. I used Active Directory -> External Identities -> All Identity Providers -> New SAML/WS-Fed IdP and matched the configurations as follow:
Identity Provider Protocol: SAML
Domain Name of Federating IdP: <CF_TEAM_NAME>.cloudflareaccess.com
Issuer URI: The Access Entity ID or Issuer I got from the CF App ( https://<CF_TEAM_NAME>.cloudflareaccess.com )
Passive authentication endpoint: The SSO endpoint I got from the CF App ( https://<CF_TEAM_NAME>.cloudflareaccess.com/cdn-cgi/access/sso/saml/<SOME_ID> )
Certificate: The Public Key I got from the CF App

After setting this up, I logged in to the Federated provider (CF Zero Trust) with my account, and then tried to launch the Azure app. I only get this error:

   AADSTS50107: The requested federation realm object 'https://<CF_TEAM_NAME>.cloudflareaccess.com' does not exist.

Any idea what's wrong with this setup?

Thanks

1 answer

Your answer

Answer 1

Marilee Turscak-MSFT 37,206 Microsoft Employee Moderator

Hi @Dotan Simha ,

If you have already tried the steps from the troubleshooting guide of making sure that Cloudflare has provided the correct issuerURI and modifying the IssuerURI of the federated domain to match the realm object listed in the error via Set-MsolDomainFederationSettings, you can also try the following troubleshooting steps:

This error can occur if there is no two way trust configured between ADFS domain and user account domain. If this is the case, the issue can be resolved by creating a two-way trust.

In addition, if you run Get-MsolDomainFederationSettings -DomainName <your domain> , can you verify if the IssuerURI reflects correctly?

Additional resources:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-multiple-domains#verify-the-new-top-level-domain

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/authentication-fails-with-error

https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/authentication/cant-sign-in-office-365-multiple-domain-federation

Dotan Simha 1 Reputation point

2022-10-26T02:45:56.583+00:00

Thank you for your reply.

I was looking into testing the parameters using the Set-MsolDomainFederationSettings / Get-MsolDomainFederationSettings but I was not able to use that in the Azure Cloud Shell - are there instructions on how can I use this module directly in Azure Cloud Shell?

Edit: Seems like this only works on super power PowerShell terminals? :/

Thank you!
Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-10-27T22:56:18.223+00:00

I believe it does need to be in Powershell and you need to install the MSOnline module first.
https://learn.microsoft.com/en-us/powershell/azure/active-directory/install-msonlinev1?view=azureadps-1.0
Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-10-28T20:08:54.067+00:00

To federate the Azure verified domain you need to use either:

MSOnline powershell (must be run on a Windows Device) and using
https://learn.microsoft.com/en-us/powershell/module/msonline/set-msoldomainfederationsettings?view=azureadps-1.0

The new Microsoft Graph Powershell:
https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/new-mgdomainfederationconfiguration?view=graph-powershell-1.0

Microsoft Graph API directly to create the FederationConfig:
https://learn.microsoft.com/en-us/graph/api/domain-post-federationconfiguration?view=graph-rest-1.0&tabs=http
Dotan Simha 1 Reputation point

2022-10-30T00:06:25.66+00:00
Thank you so much. I have the new PowerShell that is based on Graph API. I tried using both PowerShell and the API directly, but both returns the same error:

Get-MgDomainFederationConfiguration_List1: Unable to find target address

Any idea what's wrong with that?

Thanks

Share via

Using Azure Active Directory with an external identities manager (CloudFlare Zero Trust)

1 answer

Your answer