OAuth Configuration in TSS

The below 4 keys/settings are mandatory in TSS in order to configure OAuth in the TSS. Follow below steps to add the configuration.

1.Login to TSS by any of the default IPT administrator accounts say "admin1". After successful OAuth configuration the default administrator accounts admin1, admin2 and admin3 should be disabled if not required anymore.

2.Go to System -> Settings -> TSS Settings -> OAuth. Go to Basic mode.

3.Set Enable OAuth Login to true. This will make "Azure AD Login" option available in login screen.

Location: TSS Settings
OAuth	Enable OAuth Login truefalse Key: tss.azure.authentication.enable Description: The setting tss.azure.authentication.enable should be set to true to enable the OAuth login option. Following three dependent settings must also be set to make OAuth work. tss.azure.authentication.clientId tss.azure.authentication.tenantId tss.azure.authentication.aadInstance Constraint: true|false Other OAuth settings are also required to make it work. Related settings: Application/client ID of the Azure Application (tss.azure.authentication.clientId) Microsoft Azure Directory/tenant ID (tss.azure.authentication.tenantId) Azure Active Directory Instance URI (tss.azure.authentication.aadInstance)

4.Set value for Application/client ID of the Azure application.

Location: TSS Settings
OAuth	Application/client ID of the Azure Application Key: tss.azure.authentication.clientId Description: An application must be registered in Microsoft Azure which is linked to TSS using this ID known as Application or Client ID. It can be found in the Overview page of the registered application, see steps below to reach to Overview page. 1. Login to https://portal.azure.com/ and search for Microsoft Entra ID. 2. Expand Manage in the left blade and click on "app registration". 3. Select the application from the list of registered applications which you wish to link to. 4. Application (client) ID can be found in the center panel. The setting is used only if Enable OAuth Login (tss.azure.authentication.enable) is true. Constraint: 32 character long alphanumeric key separated by hyphens in 5 groups of 8, 4, 4, 4 and 12 characters. Related settings: Enable OAuth Login (tss.azure.authentication.enable) Client Secret of the Azure Application (tss.azure.authentication.clientsecret)

5.Set value for Azure Directory/tenant ID.

Location: TSS Settings
OAuth	Microsoft Azure Directory/tenant ID Key: tss.azure.authentication.tenantId Description: This the the Directory also known as tenant ID of the Microsoft Azure directory under which application is registered. Members of the same directory will be allowed to login to the TSS if required role is assigned to the member. It can be found in the Overview page of the registered application, see steps below to reach to Overview page. 1. Login to https://portal.azure.com/ and search for Microsoft Entra ID. 2. Expand Manage in the left blade and click on "app registration". 3. Select the application from the list of registered applications which you wish to link to. 4. Directory (tenant) ID can be found in the center panel. The setting is used only if Enable OAuth Login (tss.azure.authentication.enable) is true. Constraint: 32 character long alphanumeric key separated by hyphens in 5 groups of 8, 4, 4, 4 and 12 characters. Related settings: Enable OAuth Login (tss.azure.authentication.enable)

6.Set value for Azure Active Directory Instance URI.

xxxxx

Location: TSS Settings
OAuth	Azure Active Directory Instance URI Key: tss.azure.authentication.aadInstance Description: This URI is used to search for the Microsoft Azure Directory/tenant ID provided as part of setting tss.azure.authentication.tenantId. This is usually a fixed URI for Microsoft Azure. Example: https://login.microsoftonline.com/ Constraint: URI Related settings: Enable OAuth Login (tss.azure.authentication.enable)

xxxxx

7.Client certificate

We need a certificate with private key(.pfx file) installed under Local Computer on web server, also give read permission to IIS_IUSRS for the private key as shown below. This can be done via opening certificate manager (Win + R → certmgr.msc → Enter).

 Configure the Thumbprint (whatever value in your certificate) in TSS settings. TSS will use this value to locate certificate to send to Azure. Key name will be tss.azure.authentication.certificate.thumbprint

8.The application must be reloaded for any TSS setting change, hence click on the link “Reload Application” at bottom of the TSS setting.

9.Logout from the current user to see OAuth login option.