topic Re: Dynatrace SAAS SSO with Microsoft Azure - using claims/groups.link in Cloud platforms

Dynatrace SAAS SSO with Microsoft Azure - using claims/groups.link

ashish_jamthe1 — Mon, 15 Jan 2024 14:40:28 GMT

Microsoft Azure returns the group claim in the SAML using an attribute

http://schemas.microsoft.com/claims/groups.link

This happens when the number of groups is very high.

Can Dynatrace handle this scenario.

Eg (with groups.link): - Unable to do SSO with Dyantrace SAAS

https://graph.windows.net/48d6943f-580e-40b1-a0e1-c07fa3707873/users/ba9b7081-e2a8-4427-9cdc-92afd7099833/getMemberObjects

</AttributeValue>

</Attribute>

I am able to successfully do SSO when the groups are returned as in identity/claims/groups, but not in the above scenario

Eg (with /claims/groups list) - This works for me

<AttributeName="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups ">
<AttributeValue>a8c55d9b-fdc6-4fe3-9d56-af0f87419f2c</AttributeValue>
<AttributeValue>4604c7b6-57ca-4aa8-9a0b-235f4c9a3651</AttributeValue>
<AttributeValue>aa312f9f-c0ab-4e65-9bbb-07503792bdd8</AttributeValue>

Re: Dynatrace SAAS SSO with Microsoft Azure - using claims/groups.link

skrystosik — Thu, 20 Feb 2020 08:51:24 GMT

According to this part of documentation:

this will not work. https://www.dynatrace.com/support/help/how-to-use-dynatrace/user-management-and-sso/manage-users-and-groups-with-saml/saml-azure/ You're limited to 150 groups.

Sebastian

Re: Dynatrace SAAS SSO with Microsoft Azure - using claims/groups.link

ashish_jamthe1 — Fri, 21 Feb 2020 00:33:09 GMT

Thanks @Sebastian K.

From talking to Dynatrace, I think we have following two solution options. I am yet to try either of them, will share progress with the community.

Configure Azure AD to send only security groups.

https://www.dynatrace.com/support/help/how-to-use-dynatrace/user-management-and-sso/manage-users-and-groups-with-saml/saml-azure/#expand-369example-add-group-attribute-to-saml

2. Use application roles rather than groups.

This limits the amount of information that needs to go into the token, is more secure, and separates user assignment from app configuration.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims#options-for-applications-to-consume-group-information

Change the Security group claim attribute. Something like this:

Before: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
After: http://schemas.microsoft.com/ws/2008/06/identity/claims/role