Integration Steps on Microsoft Entra ID

To enable OpenID Connect (OIDC) authentication between Microsoft Azure and Utimaco Enterprise Secure Key Manager (ESKM), an application registration must be created in Microsoft Entra ID. The application registration establishes the trust relationship between Microsoft Entra ID and ESKM and provides the identifiers and credentials required for OIDC authentication.

Creating an App Registration

1. Sign in to the Azure Portal.

2. Navigate to Microsoft Entra ID → Manage → App registrations.

3. Click New registration.

4. In the Register an application page, configure the following settings:

• Name: Enter a descriptive name for the application, for example, ESKM-OIDC.

• Supported account types: Select the appropriate supported account type based on your organization's requirements. In this example, Single tenant only - Default Directory is selected.

• Redirect URI: Leave this field blank during initial creation.

5. Click Register.

Register an application

After the application registration is created, Microsoft Entra ID redirects to the Overview page. Record the following values, as they will be required when configuring OpenID Connect authentication in ESKM:

• Application (client) ID

• Directory (tenant) ID

• Display Name

Creating a Client Secret

A client secret is required to allow Utimaco Enterprise Secure Key Manager (ESKM) to authenticate with Microsoft Entra ID during the OpenID Connect (OIDC) authentication process.

1. From the application registration Overview page, navigate to Manage → Certificates & secrets.

2. Under Client secrets, click New client secret.

Add a client secret

3. In the Add a client secret pane:

   1. Enter a meaningful description for the secret.

   2. Select the desired expiration period.

4. Click Add.

Once the client secret is created, copy and securely store the value displayed in the Value field.

Configuring Authentication Settings

Configure the application authentication settings and add the redirect URI that will be used by Utimaco Enterprise Secure Key Manager (ESKM).

1. From the application registration page, navigate to Manage → Authentication.

2. In the Redirect URI configuration section, click Add Redirect URI.

3. In the Select a platform to add redirect URI pane, select Web.

4. In the Redirect URI field, enter the callback URL generated by ESKM (For example: https://<ESKM_HOSTNAME>:8443/byok/login/oauth2/code/<Application_Client_ID>)

5. Click Configure.

Add redirect URI