Edit

Tutorial: Azure Active Directory SSO integration with Kemp LoadMaster Azure AD integration

  • Article
  • 10 minutes to read

In this tutorial, you'll learn how to integrate Kemp LoadMaster Azure AD integration with Azure Active Directory (Azure AD). When you integrate Kemp LoadMaster Azure AD integration with Azure AD, you can:

  • Control in Azure AD who has access to Kemp LoadMaster Azure AD integration.
  • Enable your users to be automatically signed-in to Kemp LoadMaster Azure AD integration with their Azure AD accounts.
  • Manage your accounts in one central location - the Azure portal.

Prerequisites

To get started, you need the following items:

  • An Azure AD subscription. If you don't have a subscription, you can get a free account.
  • Kemp LoadMaster Azure AD integration single sign-on (SSO) enabled subscription.

Note

This integration is also available to use from Azure AD US Government Cloud environment. You can find this application in the Azure AD US Government Cloud Application Gallery and configure it in the same way as you do from public cloud.

Scenario description

In this tutorial, you configure and test Azure AD SSO in a test environment.

  • Kemp LoadMaster Azure AD integration supports IDP initiated SSO.

To configure the integration of Kemp LoadMaster Azure AD integration into Azure AD, you need to add Kemp LoadMaster Azure AD integration from the gallery to your list of managed SaaS apps.

  1. Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.
  2. On the left navigation pane, select the Azure Active Directory service.
  3. Navigate to Enterprise Applications and then select All Applications.
  4. To add new application, select New application.
  5. In the Add from the gallery section, type Kemp LoadMaster Azure AD integration in the search box.
  6. Select Kemp LoadMaster Azure AD integration from results panel and then add the app. Wait a few seconds while the app is added to your tenant.

Alternatively, you can also use the Enterprise App Configuration Wizard. In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, as well as walk through the SSO configuration as well. Learn more about Microsoft 365 wizards.

Configure and test Azure AD SSO for Kemp LoadMaster Azure AD integration

Configure and test Azure AD SSO with Kemp LoadMaster Azure AD integration using a test user called B.Simon. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in Kemp LoadMaster Azure AD integration.

To configure and test Azure AD SSO with Kemp LoadMaster Azure AD integration, perform the following steps:

  1. Configure Azure AD SSO - to enable your users to use this feature.

    1. Create an Azure AD test user - to test Azure AD single sign-on with B.Simon.
    2. Assign the Azure AD test user - to enable B.Simon to use Azure AD single sign-on.

  2. Configure Kemp LoadMaster Azure AD integration SSO - to configure the single sign-on settings on application side.

  3. Publishing Web Server

    1. Create a Virtual Service
    2. Certificates and Security
    3. Kemp LoadMaster Azure AD integration SAML Profile
    4. Verify the changes

  4. Configuring Kerberos Based Authentication

    1. Create a Kerberos Delegation Account for Kemp LoadMaster Azure AD integration
    2. Kemp LoadMaster Azure AD integration KCD (Kerberos Delegation Accounts)
    3. Kemp LoadMaster Azure AD integration ESP
    4. Create Kemp LoadMaster Azure AD integration test user - to have a counterpart of B.Simon in Kemp LoadMaster Azure AD integration that is linked to the Azure AD representation of user.

  5. Test SSO - to verify whether the configuration works.

Configure Azure AD SSO

Follow these steps to enable Azure AD SSO in the Azure portal.

  1. In the Azure portal, on the Kemp LoadMaster Azure AD integration application integration page, find the Manage section and select single sign-on.

  2. On the Select a single sign-on method page, select SAML.

  3. On the Set up single sign-on with SAML page, click the pencil icon for Basic SAML Configuration to edit the settings.

    Edit Basic SAML Configuration

  4. On the Basic SAML Configuration section, enter the values for the following fields:

    a. In the Identifier (Entity ID) text box, type a URL: https://<KEMP-CUSTOMER-DOMAIN>.com/

    b. In the Reply URL text box, type a URL: https://<KEMP-CUSTOMER-DOMAIN>.com/

    Note

    These values are not real. Update these values with the actual Identifier and Reply URL. Contact Kemp LoadMaster Azure AD integration Client support team to get these values. You can also refer to the patterns shown in the Basic SAML Configuration section in the Azure portal.

  5. On the Set up single sign-on with SAML page, in the SAML Signing Certificate section, find Certificate (Base64) and Federation Metadata XML, select Download to download the certificate and federation metadata XML files and save it on your computer.

    The Certificate download link

  6. On the Set up Kemp LoadMaster Azure AD integration section, copy the appropriate URL(s) based on your requirement.

    Copy configuration URLs

Create an Azure AD test user

In this section, you'll create a test user in the Azure portal called B.Simon.

  1. From the left pane in the Azure portal, select Azure Active Directory, select Users, and then select All users.
  2. Select New user at the top of the screen.
  3. In the User properties, follow these steps:
    1. In the Name field, enter B.Simon.
    2. In the User name field, enter the username@companydomain.extension. For example, B.Simon@contoso.com.
    3. Select the Show password check box, and then write down the value that's displayed in the Password box.
    4. Click Create.

Assign the Azure AD test user

In this section, you'll enable B.Simon to use Azure single sign-on by granting access to Kemp LoadMaster Azure AD integration.

  1. In the Azure portal, select Enterprise Applications, and then select All applications.
  2. In the applications list, select Kemp LoadMaster Azure AD integration.
  3. In the app's overview page, find the Manage section and select Users and groups.
  4. Select Add user, then select Users and groups in the Add Assignment dialog.
  5. In the Users and groups dialog, select B.Simon from the Users list, then click the Select button at the bottom of the screen.
  6. If you are expecting a role to be assigned to the users, you can select it from the Select a role dropdown. If no role has been set up for this app, you see "Default Access" role selected.
  7. In the Add Assignment dialog, click the Assign button.

Configure Kemp LoadMaster Azure AD integration SSO

Publishing Web Server

Create a Virtual Service

  1. Go to Kemp LoadMaster Azure AD integration LoadMaster Web UI > Virtual Services > Add New.

  2. Click Add New.

  3. Specify the Parameters for the Virtual Service.

    Screenshot that shows the "Please Specify the Parameters for the Virtual Service" page with example values in the boxes.

    a. Virtual Address

    b. Port

    c. Service Name (Optional)

    d. Protocol

  4. Navigate to Real Servers section.

  5. Click on Add New.

  6. Specify the Parameters for the Real Server.

    Screenshot that shows the "Please Specify the Parameters for the Real Server" page with example values in the boxes.

    a. Select Allow Remote Addresses

    b. Type in Real Server Address

    c. Port

    d. Forwarding method

    e. Weight

    f. Connection Limit

    g. Click on Add This Real Server

Certificates and Security

Import certificate on Kemp LoadMaster Azure AD integration

  1. Go to Kemp LoadMaster Azure AD integration Web Portal > Certificates & Security > SSL Certificates.

  2. Under Manage Certificates > Certificate Configuration.

  3. Click Import Certificate.

  4. Specify the name of the file that contains the certificate. The file can also hold the private key. If the file does not contain the private key, then the file containing the private key must also be specified. The certificate can be in either .PEM or .PFX (IIS) format.

  5. Click on Choose file on Certificate File.

  6. Click on Key File (optional).

  7. Click on Save.

SSL Acceleration

  1. Go to Kemp LoadMaster Web UI > Virtual Services > View/Modify Services.

  2. Click in Modify under Operation.

  3. Click on SSL Properties, (which operates at Layer 7).

    Screenshot that shows the "S S L Properties" section with "S S L Acceleration - Enabled" selected and an example certificate selected.

    a. Click on Enabled in SSL Acceleration.

    b. Under Available Certificates, select the imported certificate and click on > symbol.

    c. Once the desired SSL certificate appears in Assigned Certificates, click on Set Certificates.

    Note

    Make sure you click on the Set Certificates.

Kemp LoadMaster Azure AD integration SAML Profile

Import IdP certificate

Go to Kemp LoadMaster Azure AD integration Web Console.

  1. Click Intermediate Certificates under Certificates and Authority.

    Screenshot that shows the "Currently installed Intermediate Certificates" section with an example certificate selected.

    a. Click choose file in Add a new Intermediate Certificate.

    b. Navigate to certificate file previously downloaded from Azure AD Enterprise Application.

    c. Click on Open.

    d. Provide a Name in Certificate Name.

    e. Click on Add Certificate.

Create Authentication Policy

Go to Manage SSO under Virtual Services.

Screenshot that shows the "Manage S S O" page.

a. Click Add under Add new Client Side Configuration after giving it a name.

b. Select SAML under Authentication Protocol.

c. Select MetaData File under IdP Provisioning.

d. Click on Choose File.

e. Navigate to previously downloaded XML from Azure portal.

f. Click on Open and click on Import IdP MetaData file.

g. Select the intermediate certificate from IdP Certificate.

h. Set the SP Entity ID which should match the identity created in Azure portal.

i. Click on Set SP Entity ID.

Set Authentication

On Kemp LoadMaster Azure AD integration Web Console.

  1. Click on Virtual Services.

  2. Click on View/Modify Services.

  3. Click on Modify and navigate to ESP Options.

    Screenshot that shows the "View/Modify Services" page, with the "ESP Options" and "Real Servers" sections expanded.

    a. Click on Enable ESP.

    b. Select SAML in Client Authentication Mode.

    c. Select previously created Client Side Authentication in SSO Domain.

    d. Type in host name in Allowed Virtual Hosts and click on Set Allowed Virtual Hosts.

    e. Type /* in Allowed Virtual Directories (based on access requirements) and click on Set Allowed Directories.

Verify the changes

Browse to the application URL.

You should see your tenanted login page instead of unauthenticated access previously.

Screenshot that shows the tenanted "Sign in" page.

Configuring Kerberos Based Authentication

Create a Kerberos Delegation Account for Kemp LoadMaster Azure AD integration

  1. Create a user Account (in this example AppDelegation).

    Screenshot that shows the "kcd user Properties" window with the "Account" tab selected.

    a. Select the Attribute Editor tab.

    b. Navigate to servicePrincipalName.

    c. Select servicePrincipalName and click Edit.

    d. Type http/kcduser in the Value to add field and click Add.

    e. Click Apply and OK. The window must close before you open it again (to see the new Delegation tab).

  2. Open the user properties window again and the Delegation tab becomes available.

  3. Select the Delegation tab.

    Screenshot that shows the "kcd user Properties" window with the "Delegation" tab selected.

    a. Select Trust this user for delegation to specified services only.

    b. Select Use any authentication protocol.

    c. Add the Real Servers and add http as the service.

    d. Select the Expanded check box.

    e. You can see all servers with both the host name and the FQDN.

    f. Click on OK.

Note

Set the SPN on the Application / Website as applicable. To access application when the application pool identity has been set. To access the IIS application by using the FQDN name, go to Real Server command prompt and type SetSpn with required parameters. For e.g. Setspn –S HTTP/sescoindc.sunehes.co.in suneshes\kdcuser

Kemp LoadMaster Azure AD integration KCD (Kerberos Delegation Accounts)

Go to Kemp LoadMaster Azure AD integration Web Console > Virtual Services > Manage SSO.

Screenshot that shows the "Manage S S O - Manage Domain" page.

a. Navigate to Server Side Single Sign On Configurations.

b. Type Name in Add new Server-Side Configuration and click on Add.

c. Select Kerberos Constrained Delegation in Authentication Protocol.

d. Type Domain Name in Kerberos Realm.

e. Click on Set Kerberos realm.

f. Type Domain Controller IP Address in Kerberos Key Distribution Center.

g. Click on Set Kerberos KDC.

h. Type KCD user name in Kerberos Trusted User Name.

i. Click on Set KDC trusted user name.

j. Type password in Kerberos Trusted User Password.

k. Click on Set KCD trusted user password.

Kemp LoadMaster Azure AD integration ESP

Go to Virtual Services > View/Modify Services.

Kemp LoadMaster Azure AD integration webserver

a. Click on Modify on the Nick Name of the Virtual Service.

b. Click on ESP Options.

c. Under Server Authentication Mode, select KCD.

d. Under Server-Side configuration, select the previously created server-side profile.

Create Kemp LoadMaster Azure AD integration test user

In this section, you create a user called B.Simon in Kemp LoadMaster Azure AD integration. Work with Kemp LoadMaster Azure AD integration Client support team to add the users in the Kemp LoadMaster Azure AD integration platform. Users must be created and activated before you use single sign-on.

Test SSO

In this section, you test your Azure AD single sign-on configuration with following options.

  • Click on Test this application in Azure portal and you should be automatically signed in to the Kemp LoadMaster Azure AD integration for which you set up the SSO.

  • You can use Microsoft My Apps. When you click the Kemp LoadMaster Azure AD integration tile in the My Apps, you should be automatically signed in to the Kemp LoadMaster Azure AD integration for which you set up the SSO. For more information about the My Apps, see Introduction to the My Apps.

Next steps

Once you configure Kemp LoadMaster Azure AD integration you can enforce session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. Learn how to enforce session control with Microsoft Defender for Cloud Apps.