# Configure SSO with Microsoft Entra ID

Set up **Single Sign-On** (SSO) in TrapEye by creating an application in Microsoft Entra ID and linking it to TrapEye through the **OpenID Connect (OIDC)** protocol.

---

## Create an Application in Entra ID

<slot />

### Initial Setup

1. In the **Microsoft Entra** portal, navigate to **App registrations** → **New registration**.

   ![Create Application](~/assets/images/docs/users/entra-id/entra-app1.webp)

2. Enter a **name** for your application (e.g. `TrapEye SSO`).
3. Under **Supported account types**, select:
   > **Accounts in this organizational directory only**
4. Under **Redirect URI**, choose **Web** and enter the following value:

   ```text
        https://trapeye.anantis.io/api/auth/oidc/callback
        ```

        This URL is the callback endpoint Azure uses to redirect users after a successful authentication.

        ![Create Application 2](~/assets/images/docs/users/entra-id/entra-app2.webp)

        Click **Register** to create the application.

---

### Configure API Permissions

1. From your newly created application, go to the **API permissions** menu.

   ![Add API Permissions](~/assets/images/docs/users/entra-id/entra-app3.webp)

2. Click **Add a permission** → **Microsoft Graph** → **Delegated permissions**.
3. In the **OpenID permissions** section, select the following permissions:
   - `openid`
        - `profile`
        - `email`

        ![Add API Permissions 2](~/assets/images/docs/users/entra-id/entra-app5.webp)

4. Click **Add permissions** to confirm.

---

### Retrieve Tenant Identifiers

1. Navigate to the **Overview** section of your application.
2. Copy the following identifiers, they will be required during TrapEye configuration:
   - **Application (client) ID**
        - **Directory (tenant) ID**

        ![Application IDs](~/assets/images/docs/users/entra-id/entra-app6.webp)
---

### Generate a Client Secret

1. Go to **Certificates & secrets** → **New client secret**.

   ![Generate Secret](~/assets/images/docs/users/entra-id/entra-app7.webp)

2. Enter a description (e.g. `TrapEye SSO Secret`) and set an **expiration** (recommended: 24 months).
3. Click **Add**.
   ![Secret Value](~/assets/images/docs/users/entra-id/entra-app9.webp)

4. Copy the generated **Value** (this is your client secret).  

   :::caution
        Make sure to store this value securely, it will not be shown again once you leave the page.
        :::

## Configure SSO in TrapEye

1. Once your Azure app is ready, log in to the [TrapEye Portal](https://trapeye.anantis.io)

2. Navigate to **Settings → Configuration** and select the **SSO Configuration** menu.

3. Fill in the following fields:

   | Field | Value |
        |--------|--------|
        | **Issuer URL** | `https://login.microsoftonline.com/<Directory (Tenant) ID>/v2.0` |
        | **Client ID** |  Application (client) ID |
        | **Client Secret** | The secret value you generated |
        | **SSO Domain**.| The domain that determines which OIDC issuer should be used during login. |

4. Click **Save**, then **Test Connection** to validate your setup. 

By default, all users in your Entra ID tenant can log in to TrapEye **without any restriction**.

## Optional: Restrict access to specific group

To restrict access to specific groups only, it is possible to configure the `Allowed Groups` fields.

1. Navigate to **Token Configuration → Add groups claim**

   ![Group Claim](~/assets/images/docs/users/entra-id/group_claim.webp)
        - Select **Security Groups** to include group information in the OpenID ID token.
        - In **Customize token properties by type → ID**, verify that `Group ID` is selected.
        - Click **Add** to save.

2. Go to **Groups → All groups**:

   ![Group ID](~/assets/images/docs/users/entra-id/group_id.webp)

        - Select the group(s) whose members should be allowed to authenticate in TrapEye.
        - Ensure that the **Group type** is `Security`.
        - Copy the **Object ID** of the desired group(s). 

3. Go back to the [TrapEye Portal](https://trapeye.anantis.io) in **Settings → Configuration → SSO**.

   ![Group Config](~/assets/images/docs/users/entra-id/group_config.webp)

        - Paste the **Object ID** of the desired group(s). 
        - Save Configuration.

## Setup Complete

TrapEye is now integrated with Microsoft Entra ID for secure, seamless Single Sign-On.