Configuring Lucanet OIDC Authentication with Microsoft Entra ID/Azure

Documentation

Getting Started

Global Functions

Lucanet Lume

Administration

User Management

Managing the CFO Solution Platform

Managing Lucanet Licenses

Configuring External Authentication

Configuring Lucanet OIDC Authentication with Microsoft Entra ID/Azure

Configuring Lucanet SAML Single Sign-On with Microsoft Entra ID/Azure

Generating and Downloading SEA Certificates

Configuring Customizations

Exchange Rate Management

Data Hub

Consolidation & Financial Planning

Lease Accounting

Extended Planning & Analysis (xP&A)

ESG Reporting

Disclosure Management

XBRL Tagger

Tax Compliance & Reporting

Banking & Cash Management

Data Collection

Glossary

If you use Microsoft Entra ID (formerly Azure Active Directory) as your identity provider and choose the OIDC method for external authentication of the Lucanet CFO Solution Platform, you must first register Lucanet as an app in Microsoft Entra ID.

After successful registration and configuration, you can copy the authentication parameters in Microsoft Entra ID and paste them into the Lucanet CFO Solution Platform to complete the configuration of the external authentication.

To create an app registration for Lucanet in the Microsoft Entra admin center:

Open the Microsoft Entra admin center at https://entra.microsoft.com or the Azure Portal.

Go to Applications | App registrations.

Shows the navigation menu of the Microsoft Entra admin center with the 'Identity' section expanded. Highlighted in red are the 'Applications' entry and the 'App registrations' entry below it. — 'App registrations' workspace in the Microsoft Entra admin center

Click New registration.

Shows the 'App registrations' page in Microsoft Entra ID with the 'New registration' and 'Endpoints' options. Highlighted in red is the 'New registration' option. — Button used to register a new app

The page Register an application is displayed.

Enter the display name of the app in the field under Name.

Shows the 'Name' field for the user-facing display name of the application in Microsoft Entra ID with an example display name entered. — Entering the display name of the app

Choose the option Accounts in this organizational directory only ( <Your enterprise> only - Single tenant) under Supported account types.

Shows the 'Supported account types' area in Microsoft Entra ID with the single-tenant option 'Accounts in this organizational directory only' selected. — Selecting the supported account type

Copy the URI under Sign-in redirect URL(s) in the External authentication workspace in the Lucanet CFO Solution Platform.

Shows the 'Sign-in redirect URL(s)' field with a redirect URL and the tooltip 'Copied' after copying in the CFO Solution Platform. — Copying the redirect URL from the Lucanet CFO Solution Platform

If necessary, choose the URI from the Web drop-down list in the Redirect URI (optional) area and enter it in the field behind Web in Microsoft Entra ID.

Shows the 'Redirect URI (optional)' area in Microsoft Entra ID with 'Web' selected in the drop-down list and a redirect URI entered in the field next to it. — Configuration of the redirect URI

Click Register.

Shows the 'Register' button below the note on the Microsoft Platform Policies in Microsoft Entra ID. — Completing the app registration

Go to the newly created app registration and perform the following steps to configure Lucanet as an app in Microsoft Entra ID:

To activate the ID tokens for the app registration in Microsoft Entra ID:

Navigate to Manage | Authentication.

Shows the navigation bar of the app registration in Microsoft Entra ID with the 'Authentication' entry selected under 'Manage'. — 'Authentication' workspace on the navigation bar

Activate the ID tokens (used for implicit and hybrid flows) check box in the Implicit grant and hybrid flows area.

Shows the 'Implicit grant and hybrid flows' area in Microsoft Entra ID with the 'ID tokens (used for implicit and hybrid flows)' check box activated and the 'Access tokens (used for implicit flows)' check box not activated. — Activating 'ID tokens'

To create a client secret for Lucanet in Microsoft Entra ID:

Navigate to Manage | Certificates & secrets.

Shows the navigation bar of the app registration in Microsoft Entra ID with the 'Certificates & secrets' entry selected under 'Manage'. — 'Certificates & secrets' workspace on the navigation bar

Click the button on the Client secrets tab:

Enter a name or description for the secret in the Description field in the Add a client secret area and, if necessary, choose a validity period for the secret from the Expires drop-down list:

Shows the 'Add a client secret' area in Microsoft Entra ID with an example description in the 'Description' field and 'Recommended: 180 days (6 months)' selected in the 'Expires' drop-down list. — Settings in the 'Add a client secret' area

Click Add. A client secret is generated, which is displayed in the Value column on the Client secrets tab:

Shows a client secret in Microsoft Entra ID with the 'Description', 'Expires', 'Value', and 'Secret ID' columns and the tooltip 'Copied' next to the value. Highlighted in red is the client secret in the 'Value' column. — Copying a client secret from Microsoft Entra ID

Paste the value in the Client secret field in the Lucanet CFO Solution Platform.

Shows the 'External authentication' workspace in the CFO Solution Platform with the 'OIDC' authentication procedure selected and the 'Client ID', 'Client secret', and 'Issuer URL' fields. Highlighted in red are the 'External authentication' entry under 'Platform management' and the 'Client secret' field. — 'Client secret' field in Lucanet

To configure optional claims for Lucanet as an app in Microsoft Entra ID:

Navigate to Manage | Token configuration.

Shows the navigation bar of the app registration in Microsoft Entra ID with the 'Token configuration' entry selected under 'Manage'. — 'Token configuration' workspace on the navigation bar

Click the button .

Choose the ID token type and activate the email check box in the Claim column.

Shows the 'Token type' and 'Claim' settings in Microsoft Entra ID with the 'ID' token type selected and the 'email' check box activated in the 'Claim' column. — Setting for the 'ID' token type

Choose the Access token type and activate the email check box in the Claim column.

Shows the 'Token type' and 'Claim' settings in Microsoft Entra ID with the 'Access' token type selected and the 'email' check box activated in the 'Claim' column. — Setting for the 'Access' token type

Click Save. The optional claims are added and displayed, for example, as follows:

Shows the optional claims in the token configuration in Microsoft Entra ID with the 'email' claim listed for the 'ID' and 'Access' token types. — Optional claims configured

To set up the API permissions for Lucanet in Microsoft Entra ID:

Navigate to Manage | API Permissions.

Shows the navigation bar of the app registration in Microsoft Entra ID with the 'API permissions' entry selected under 'Manage'. — 'API permissions' workspace on the navigation bar

Click the button in the Configured permissions area.

Click Microsoft Graph on the Microsoft APIs tab.

Shows the 'Select an API' area in Microsoft Entra ID with the 'Microsoft APIs' tab and the 'Microsoft Graph' tile under 'Commonly used Microsoft APIs'. — 'Microsoft Graph' on the 'Microsoft APIs' tab

Click Delegated permissions.

Shows the 'Delegated permissions' option in Microsoft Entra ID with the description 'Your application needs to access the API as the signed-in user.' — 'Delegated permissions' option

Activate the email and openid check boxes in the OpenId permissions area.

Shows the 'OpenId permissions (2)' area in Microsoft Entra ID with the 'email' and 'openid' check boxes activated and the 'offline_access' check box not activated. — Settings in the 'OpenId permissions' area

Click Add permissions.

Click Grant Admin consent for <your enterprise> in the Configured permissions area.

Shows the 'Add a permission' option and the 'Grant admin consent for' button followed by the company name in Microsoft Entra ID. — Button used to grant admin consent

Click Yes in the displayed dialog Grant admin consent confirmation.

The set-up permissions are displayed, for example, as follows:

Shows the 'Configured permissions' area in Microsoft Entra ID with the delegated 'Microsoft Graph' permissions 'email', 'openid', and 'User.Read', each with the status granted for the company. — API permissions in Microsoft Entra ID

You can find additional information on how to configure the app registration in Microsoft Entra ID in the documentation from Microsoft.

After creating and configuring the app registration in Microsoft Entra ID, you need to retrieve specific authentication parameters and add them to the Lucanet CFO Solution Platform to complete the external authentication setup.

To configure authentication parameters for the Lucanet CFO Solution Platform:

Get the Client ID from the Microsoft Entra admin center:

You can find the Client ID behind Application (client) ID in the Essentials area on the Overview page:

Shows the navigation bar of the app registration in Microsoft Entra ID with the 'Overview' entry selected. — 'Overview' section in the Microsoft Entra admin center

Shows the 'Essentials' area in Microsoft Entra ID with the 'Display name', 'Application (client) ID', 'Object ID', 'Directory (tenant) ID', and 'Supported account types' entries and the tooltip 'Copied' next to the application (client) ID. Highlighted in red is 'Application (client) ID'. — Copying the client ID from Microsoft Entra ID

Paste the Client ID in the Client ID field in the Lucanet CFO Solution Platform.

Paste the Client secret value in the Client secret field in the Lucanet CFO Solution Platform, if not already configured in previous steps (see Creating a Client Secret).

Get the Issuer URL from the Microsoft Entra admin center:

In the App registrations, select your application. On the Overview page, click Endpoints.

In the Endpoints panel, copy the tenant ID from the Authority URL (Accounts in this organizational directory only) field. Use the part highlighted in the red box in the screenshot example below. This part is the tenant ID that follows https://login.microsoftonline.com/.

The Issuer URL has the following notation:

https://sts.windows.net/< Your tenant ID in Microsoft Entra ID >

Example:

If your tenant ID is 123bfsd-as34-sd34-34fg-f35gh67h8, the issuer URL will be https://sts.windows.net/123bfsd-as34-sd34-34fg-f35gh67h8.

Shows the 'Endpoints' panel in Microsoft Entra ID with the 'Authority URL (Accounts in this organizational directory only)' field, which starts with 'https://login.microsoftonline.com'. Highlighted in red is the tenant ID after 'https://login.microsoftonline.com/'. — 'Endpoints' area on the 'Overview' page in Microsoft Entra ID

Add the Issuer URL in the Issuer URL field in the Lucanet CFO Solution Platform.

Attention: The e-mail address of a user on the Lucanet CFO Solution Platform must be identical to the e-mail address in Microsoft Entra ID. The upper and lower case of e-mail addresses must match exactly.

You can find additional information on how to use the parameters when configuring the external authentication for the Lucanet CFO Solution Platform with the OIDC method in the section Configuring OIDC in Configuring External Authentication.

If your User principal name and your e-mail address in Microsoft Entra ID are different, the OIDC configuration will not work as described on this page. Please choose SAML as the authentication method instead.