Azure
Azure connections to the CipherTrust Manager can be configured using the following:
Note
If you wish to use external certificate authentication for an Azure Cloud connection, you must first create a valid external certificate.
Managing Azure Connections using GUI
Client ID - this is an Application ID of the Azure application. It can be used either with Client Secret or Certificate to authenticate the application.
Tenant ID - this is the Office365 tenant ID. It is a globally unique identifier (GUID). For more details, refer to the Azure documentation.
Cloud Name - the name of the Azure cloud to connect to. Currently, only the following options are available:
Azure Cloud - For Azure Cloud configuration, refer to Creating an Azure Cloud Connection.
Azure China Cloud
Azure US Government
Azure Stack - For Azure Stack configuration, refer to Configure Azure Stack.
Authentication - you can use either Client Secret or Certificate for authentication purpose.
Client Secret – this authentication method uses the application password of the Client ID to enable communication between Azure and CipherTrust Manager.
Certificate - this authentication method is used to enable password-less communication between Azure and CipherTrust Manager.
Note
Azure Stack does not support Certificate authentication.
Select the Certificate radio button
Select Application or External as the Certificate Type.
The Application certificate type is generated by CipherTrust Manager and self-signed.
The External certificate type is a pre-existing certificate generated on CipherTrust Manager and then signed by a CA local or external to the CipherTrust Manager. To use this option, you first need to create a valid external certificate.
Click the Generate and Download button.
Upload the downloaded certificate on Salesforce for the provided Client ID.
Once the upload is done, verify the Thumbprint on the CipherTrust Manager and Azure. Both the thumbprints must match.
Specify Certificate Duration in Days, if desired. The default certificate duration is 730 days (2 years).
Ensure that you have fulfilled the prerequisites to create a valid external certificate.
Do one of the following:
Select File Upload and click the Upload Certificate to upload the external certificate as a file.
Select Text and paste the certificate contents in the text box.
Note
The CipherTrust Manager allows you to modify the external certificate in the existing connection. Any unused certificate will be automatically deleted after 24 hours.
- Click the Test Credentials button to verify if the certificate authentication is working.
Note
This configuration is applicable to Azure Stack only.
Configuring an Azure Stack connection requires various URLs, described below. To get these URLs, run the command
Get AzureRmEnvironmentin your Azure AD VM. Refer to Connect with Azure AD for details.
Azure Stack Connection Type - Azure stack supports two types backed by Active Directory as an identity provider:
AAD - Azure Active Directory
ADFS - Active Directory Federation Services
Active Directory Endpoint - this is a URL at which the identity providers can be reached. For example, https://login.microsoftonline.com/
Key Vault DNS Suffix - this is a DNS suffix for the key vault in the Azure Stack. For example, vault.local.azurestack.external.
Management URL - this is the URL with a unique identifier for Azure Resource Manager registered with your identity provider.
Resource Manager URL - this URL is the location of the Azure Resource Manager service. For example, https://management.azure.com or https://management.local.azurestack.external
Vault Resource URL - this is the URL to access vault resources. For example, https://vault.local.azurestack.external
Azure Server Certificate - this is the Server certificate used by HTTPS protocol for a secure connection.
Managing Azure Connections using ksctl
The following operations can be performed:
Create/Get/Update/Delete an Azure Stack connection
List all Azure Stack connections
Test an existing Azure Stack connection
Test parameters for a Azure Stack connection
Create an Azure Cloud Connection
Note
Examples in this section are for ADFS connection type. Similarly, you can manage connections for AAD by changing the connection-type to AAD.
Creating an Azure Stack Connection
To create an Azure Stack connection, run:
Syntax
Example Request
Example Response
Getting Details of an Azure Stack Connection
To get details of an Azure Stack connection, run:
Syntax
Example Request
Example Response
Updating an Azure Stack Connection
To update an Azure Stack connection, run:
Syntax
Example Request
Example Response
Deleting an Azure Stack Connection
To delete an Azure Stack connection, run:
Syntax
Example Request
There will be no response if Azure Stack connection is deleted successfully.
Getting List of Azure Stack Connections
To list all the Azure Stack connections, run:
Syntax
Example Request
Example Response
Testing an Existing Azure Stack Connection
To test an existing Azure Stack connection, run:
Syntax
Example Request
Example Response
Testing Parameters for an Azure Stack Connection
To test parameters for an Azure Stack connection, run:
Syntax
Example Request
Example Response
Creating an Azure Cloud Connection
The Azure Cloud connection can be created using:
Internal certificate
External certificate
Creating an Azure Cloud Connection using internal certificate
To create an Azure Cloud connection using internally generated self-signed certificate, run:
Example
Response
Creating an Azure Cloud Connection using external certificate
Note
The external certificate cannot be used with use_certificate and client_secret parameters.
To create an Azure cloud connection using an external certificate generated from the custom CSR signed by any internal/external CA:
Generate a new Certificate Signing Request (CSR). The Azure connections do not support RSA 1024-bit keys for creating CSRs. The supported RSA key strengths are 2048 and 4096 bits.
Syntax
Example
Response
This CSR can only be used for one connection in the native domain. Also, this CSR can't be reused in other domains.
Sign the CSR with any local or external CA. It will generate an external certificate.
Upload the generated certificate to the Azure portal.
Create the Azure cloud connection using the external certificate generated above.
Example
Response
JSON File
The CipherTrust Manager allows you to modify the external certificate in the existing connection. Any unused certificate will be automatically deleted after 24 hours.
