
=== Azure AD integration

PacketFence supports integrating with the Azure Active Directory for authenticating users on the captive portal, the admin interface and for 802.1X users using EAP-TTLS PAP. If your only goal is to authenticate users on the captive portal, using the OpenID implementation of Azure AD may be better suited. This section is aimed at providing username/password authentication through Azure AD.

==== Creating the PacketFence app

. Open the 'Azure Active Directory' in your Azure portal
. Go in 'Manage->App registrations->New registration'
. Settings for the app
  .. Name: PacketFence
  .. Supported account types: Accounts in this organizational directory only - (Single tenant)
  .. Redirect URI must be left blank
  .. Save the app
. Note down the 'Application (client) ID' and 'Directory (tenant) ID' for later usage
 .. In your application, go in 'Certificates & secrets' and select 'New client secret'
  ... Description: PacketFence
  ... Make sure you note down its expiry date so you can renew it before its expiration. Failure to do so will prevent authentication from working on PacketFence
  ... Save the secret
 .. Note down the 'Value' of your client secret for later usage
 .. Still in your application, go to 'API permissions'
  ... Click on 'Add a permission'
    .... Go to the 'Microsoft APIs' tab
    .... Select 'Microsoft Graph'
    .... Select 'Application permissions'
    .... Add the permission `Directory.Read.All`
    .... Click on 'Grant admin consent'  
  ... Make sure `User.Read` is already there as a delegated permission

==== Disabling MFA

Currently, PacketFence requires that multi-factor authentication be disabled for the PacketFence app. If you use Azure AD premium, you can create a rule to exclude this only for the PacketFence application. If you don't use Azure AD premium, this must be disabled for all your users.

===== Disabling MFA using Azure AD premium

. Open the "Azure Active Directory" in your Azure portal
. Go in 'Manage->Properties'
 .. Click 'Manage Security defaults'
 .. Disable the toggle 'Enable Security defaults' and save
. Next, go in 'Manage->Security->Conditional Access'
 .. Click 'New policy' and enter the following settings:
   ... Name: 2FA policy
   ... Under 'Users and groups', select 'All users'
   ... Under 'Cloud apps or actions', go in the 'Exclude' section and select the 'PacketFence' app you created earlier in the 'Select excluded cloud apps'
   ... Under 'Grant', select 'Grant access' and check 'Require multi-factor authentication' and any other settings your organization requires.
   ... At the bottom, make sure 'Enable policy' is set to 'On' and save your policy

===== Disabling MFA without Azure AD premium

WARNING: This will disable common recommended settings from Microsoft. Using Azure AD premium is the correct way to perform this. This option is only suggested for testing or when its impossible to have access to Azure AD premium.

. Open the "Azure Active Directory" in your Azure portal
. Under 'Manage', open 'Properties'
 .. Click 'Manage Security defaults'
 .. Disable the toggle 'Enable Security defaults' and save

==== Configuring PacketFence

. Under 'Configuration->Policies and Access Control->Authentication Sources', create a new 'Azure Active Directory' internal source
 .. Client ID: the 'Client ID' that was displayed while configuring the 'PacketFence' app inside Azure
 .. Client Secret: the secret you created inside the 'PacketFence' app in Azure AD
 .. Tenant ID: the 'Tenant ID' that was displayed while configuring the 'PacketFence' app inside Azure
 .. User Groups URL: the API Url where to verify the groupmembership
 .. Add any authentication or administration rules and then save the source

With this configuration, you can now use this source in your connection profiles to authenticate and authorize users on the captive portal and use it with EAP-TLS to authorize users (getting the role and access duration) as long as your EAP-TLS certificates use the distinguished name of the Azure AD users as their common name. Additionally, you can use this source for authenticating users in the admin interface and for VPN access.

===== Using Azure AD in 802.1X

You can perform 802.1X authentication of users using Azure AD but this will only work with supplicants configured to perform EAP-TTLS PAP which provides the RADIUS server with the plain-text password of the user. Support for this type of authentication is not as broad as EAP-PEAP MSCHAPv2 in the 802.1X supplicants but unfortunately Azure AD doesn't support MSCHAP authentication. Refer to the documentation of your operating system on how to configure EAP-TTLS PAP. This section will only focus on enabling EAP-TTLS PAP for your Azure AD users in PacketFence.

. Under 'Configuration->Policies and Access Control->Realms', create a new realm
 .. Realm: enter the realm of your Azure AD users. Example, if the usernames have the following format `bob@inverseinc.onmicrosoft.com`, then your realm is `inverseinc.onmicrosoft.com`
 .. Go in the 'Stripping' tab of the realm and select your Azure AD source under 'Azure AD Source for TTLS PAP'
 .. Still in the 'Stripping' tab, disable (uncheck), the following settings:
  ... Strip on the portal
  ... Strip on the admin
  ... Strip in RADIUS authorization
 .. Save the realm
. Restart radiusd using `/usr/local/pf/bin/pfcmd service radiusd restart`
. All the users matching this realm will now authenticate against Azure AD. Make sure you also have a connection profile with auto-registration enabled and the Azure AD source in it so that your users are correclty authorized when connecting.

===== Using Azure AD EAP-TLS machine authentication

You can perform a EAP-TLS authentication and verify the machine group membership in order to provide a access to the network.

To do that first you will have to provide to the end device a certificate that contains the Device ID, to do this go in the Intune management interface and configure the template like this:

image::Intune_SCEP_machine.png[scaledwidth="100%",alt="Intune SCEP machine configuration"]

As you can see the CN (Common Name) will contain the Device Identifier, so when the device will connects on the secure SSID, the username will be equal to the device ID (like 8df07f7e-d98e-4579-aa97-bfcfaaa7fe38)

Now it just a matter to retrieve the group membership associated with the device ID, in order to do that you will need to change the "User Groups URL" parameter in the "Azure Active Directory" authentication source.

The URL will be `https://graph.microsoft.com/v1.0/devices(deviceId='%USERNAME')/memberOf` (for more information https://learn.microsoft.com/en-us/graph/api/device-list-memberof?view=graph-rest-1.0&tabs=http)

In this example the API call will be `https://graph.microsoft.com/v1.0//devices(deviceId='8df07f7e-d98e-4579-aa97-bfcfaaa7fe38')/memberOf?$select=id,displayName and the reply will be:

`{
   "value""=>"[
      {
         "displayName""=>""ZaymLed-Devices",
         "id""=>""5c5f932c-08d4-46c3-bd93-11807f80ae35",
         "@odata.type""=>""#microsoft.graph.group"
      },
      {
         "id""=>""6ae04238-8e95-4f1b-8088-17c0d6cfbd98",
         "displayName""=>""3D printer Laptop manager",
         "@odata.type""=>""#microsoft.graph.group"
      },
      {
         "@odata.type""=>""#microsoft.graph.group",
         "id""=>""c2e304d6-f245-4ab2-8f60-58d78e57c526",
         "displayName""=>""Windows 11 Feature Updates"
      },
      {
         "@odata.type""=>""#microsoft.graph.group",
         "id""=>""1bced11e-0cae-4689-8afa-060ec0b3341f",
         "displayName""=>""ZaymLed - 3D software"
      },
   ],
   "@odata.context""=>""https://graph.microsoft.com/v1.0/$metadata#directoryObjects(id,displayName)"
}`

From the "Azure Active Directory" authentication source, create an authentication rule like this:"

image::Azure_Group_membership.png[scaledwidth="100%",alt="Azure AD Group Membership"]
