Integrate Windows Azure Pack with Active Directory

Question

Is it possible to integrate Windows Azure Pack with Active Directory and have domain users authenticate Tenant Portal using Single-Sign On? Can anyone point to some good articles.

Note: I know WAP supports ADFS but I'm looking for plain AD support !!

Answer 1

The Windows Azure Pack Tenant Portal uses claims-based authentication. It delegates all authentication to a Security Token Service (STS) that must:

• Support WS-Federation
• Expose a Federation Metadata endpoint
• Be capable of generating JSON Web Tokens (JWT) with at least ‘UPN’ and optionally ‘Groups’ claims

To use Active Directory credentials (NTLM/Kerberos authentication) you would need a STS that meets these requirements and can use Active Directory as an Identity Provider (or will federate to one that can.)

Examples include AD FS 3.0 (as you point out) and the STS that ships with WAP for use by the Management Portal. In theory, you could use the Management Portal STS for the Tenant Portal as well, but the documentation explicitly cautions against this, warning that doing so 'will cause tenant scenarios to break'.

See this article for a full explanation of this and links to more resources: http://msdn.microsoft.com/en-us/library/dn479300.aspx