Versions Compared

Old Version 3

changes.mady.by.user Roman Harmata

Saved on

compared with

New Version 4

changes.mady.by.user Roman Harmata

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

However if organisations would like to make life easier for users by allowing them to be singned-in/authenticated seamlessly just by clicking "OrganisationX AzureAD" button instead of entering credentials, they can decide to integrate TDS platform into AzureAD or similar kind of identity provider.

TDS team recommends OIDC option as its setup and maintenance is generally easier and more flexible than SAML. For example SAML requires proper timing of certificates exchanges when multiple teams/parties must organise themselves in corporate environments - this makes even regular changes more complicated. OIDC requires regular exchanging of secrets, however thanks to possibility to have multiple secrets at the very same time, changes are easier and do not require strict timing like in SAML case when certificates are being exchanged. SAML setup is less straightforward than in OIDC case.

Azure AD integration with TDS Keycloak using OpenID Connect

This OpenID Connect (OIDC) is quite straightforward and modern solution for adding support for centralised authentication. We usually meet together with customer organisation representatives and their identity provider administrators and settle down procedure details and requirements. Then AzureAD adminstrators need to follow steps how to integrate TDS Keycloak using OIDC as defined in this chapter.

...

TDS team then takes over and finishes setup according to internal documentation OpenID Connect brokering setup.

Azure AD integration with TDS Keycloak using SAML

Details need to be discussed on meeting with customer representatives and AzureAD administrators.

ADFS integration with TDS Keycloak using SAML

This solution is not as popular as getting less and less popular in favour of AzureAD, but it is still possible to integrate this way using ADFS if there is no other way. It is less flexible than OIDC as it requires proper timing of certificates exchanges when multiple teams/parties must organise themselves in corporate environments. From this point of view OIDC integration is recommended as it is quite easy to setup and it is more flexible than ADFS with SAML. Although OIDC requires regular exchanging of secrets, thanks to possibility to have multiple secrets at the same time, changes are very easy and do not require strict timing like in SAML case when certificates are being exchanged.Also setup is less straightforward than in OIDC case. In case of need we provide consultancy.