Azure Active Directory OIDC SSO Configuration

This page explains how to set up SSO in HashiCorp Cloud Platform (HCP) with the Azure Active Directory identity provider. Refer to SSO Overview for details about managing organizations with SSO enabled.

Configure SSO

Organization owners and admins can set up SSO.

To begin configuring SSO:

1. Log in to HCP and go to your organization.
2. Click Settings and then click SSO. The Single Sign-On page appears.
3. Select OIDC SSO.
4. Click Configure selected SSO method. The Setup OIDC SSO page appears where you will enter the required information for Okta.
5. Assign a default organization role.

Verify Your Domain

You need a DNS record (secret value to set as TXT) to prove ownership of a domain. HCP uses the domain to match the email addresses for SSO. You must use different SSO domains for each HCP organization. If you try to reuse a domain name, the DNS connection request will fail.

To verify your domain:

1. Copy the verification TXT record from the HCP SSO configuration to the DNS records of any email domains your organization uses.
2. Return to the HCP Settings page and add your email address domains.
3. Click Verify domains.

If the verification is successful, you can continue configuring SSO. If the request fails, your changes to the DNS records may not have propagated yet. It can take up to 72 hours.

OIDC Integration in Azure Active Directory

You must add information from the Initiate OIDC Integration section in HCP to the OIDC configuration for an Enterprise application in Azure Active Directory.

To add the required integration information in Azure Active Directory:

1. Log in to your Microsoft Azure portal and go to Azure Active Directory.

2. Click Properties and save your Tenant ID for later.

3. Under Manage, select Enterprise applications.

4. Click New application.

5. At the top of the Azure AD Gallery page, click Create your own application and enter a name.

6. Select Integrate any other application you don't find in the gallery (Non-gallery) and then click Create. You’ll be taken to the application overview screen.

7. You’ll need to register your application. Select Home in the breadcrumbs to go back to the Home screen.

8. Select Azure Active Directory.

9. In the menu, select App Registration.

10. Click New Registration.

11. On the Register an application page, give the application a name.

12. Set Supported account types to Accounts in this organizational directory only (Default Directory only - Single tenant).

13. Click Register.

14. Copy the Application (client) ID and save for later.

    

15. Click Add a Redirect URI.

16. Under Platform configurations, click Add a platform.

17. Select Web.

18. The Redirect URI is https://flow.idp.hashicorp.com/sso/oidc/callback.

19. Under Implicit grant and hybrid flows, check:

    1. Access tokens (used for implicit flows)
    2. ID tokens (used for implicit and hybrid flows)

    

20. Click Configure.

21. Under Manage, select Certificates & secrets.

22. Click New client secret.

23. Give the secret a name and set the expiration date to your company's policy.

24. Create client credentials and Add Redirect URL. Select Add a secret.

25. Copy the Value.

26. Switch back to the HCP Portal OIDC page to enter the copied Client ID, Client Secret, Redirect URI and Issuer URL values.

27. Enter https://login.microsoftonline.com/<YOUR_TENANT_ID>/v2.0 as the Issuer URL, substituting your Tenant ID for <YOUR_TENANT_ID>, to finish the configuration.