Microsoft Entra ID (SAML2.0) - CWP

This guide details authentication between Genian NAC (Service Provider) and Microsoft Entra ID (Identity Provider).

This enables user authentication through Entra ID without managing users in Genian NAC.

SSO is achieved via SAML2.0 on the Genian NAC CWP (Captive Web Portal), using Entra ID as the IdP.

Supported Features

Microsoft Entra SAML integration supports:

  • SP-initiated SSO
  • IdP-initiated SSO
  • JIT (Just-In-Time) provisioning
  • Single Logout (SLO)
  • Signed Requests

Configuration Steps

The following steps outline how to configure Microsoft Entra ID (formerly Azure AD) with Genian NAC using SAML2.0.

Step 1: Register Application in Entra ID

  1. Sign in to the Microsoft Azure portal: https://portal.azure.com/
  2. Navigate to Azure Services > Microsoft Entra ID
  3. Select Enterprise Applications > New application
  4. Click Create your own application and choose Non-gallery application
  5. Enter the application name and click Create

Step 2: Configure SAML SSO

  1. After app creation, select Single sign-on > SAML

  2. In the Basic SAML Configuration panel:

    • Identifier (Entity ID): Enter the Genian NAC SP Entity ID.

      For example
https://<Server IP or Domain>/cwp2/faces/saml2/saml2Metadata.xhtml

    • Reply URL (Assertion Consumer Service URL): Enter the Genian NAC ACS (Assertion Consumer Service) URL.

      For example
https://<Server IP or Domain>/cwp2/faces/saml2/saml2Acs.xhtml

  3. Download the Certificate (Base64) and open with a text editor (Notepad).

  4. In Genian NAC:

    • Navigate to Web Console > Preferences > User Authentication > Authentication Integration > SAML2.:

    • Input the following:

      • IdP SSO URL – "Login URL" from Entra ID

        For example
https://login.microsoftonline.com/<Tenant ID>/saml2

      • IdP Entity ID – "Microsoft Entra Identifier"

        For example
https://sts.windows.net/<Tenant ID>/

      • x509 Certificate – Contents of the Base64 certificate file

  5. Click Update to apply changes

Step 3: Enable JIT Provisioning (Optional)

To create or update NAC user info using SAML attributes:

  1. In Genian NAC, set JIT Provisioning > ON
  2. Define attributes under Additional columns to map incoming SAML values

These attributes are sent by default from Microsoft Entra ID

Default Attributes & Claims from Entra ID
Attribute Value
givenname user.givenname
surname user.surname
emailaddress user.mail
name user.userprincipalname
Unique User Identifier user.userprincipalname

Note

These attributes are included by default in Microsoft Entra ID. You may edit them under Attributes & Claims in the Entra ID application settings if additional mappings are required.

Step 4: Configure Node Policy for SAML2

  1. In Genian NAC, go to Policy > Node Policy
  2. Create or edit a policy and set Authentication Method > SAML2

Authentication Integration Test

SP-initiated SSO via Web Console

  1. In NAC, navigate to:
    Preferences > User Authentication > Authentication Integration > Authentication Test
  2. Select SAML2 and click Test.
  3. Login with your Entra ID credentials in the pop-up window.