Appendix D: Use Access Token or Custom Claim for Azure Authentication - Appendix D: Use Access Token or Custom Claim for Azure Authentication - When using Titan as a Perceptive Content client, Bearer Token Login profiles are used to provide a connection between an identity system and Perceptive Content to authenticate users. When a user accesses the Titan client interface, they must authenticate with the identity system. The identity system provides a token to Perceptive Content containing valid user credentials to identify the respective user. When using Azure as an identity system, it provides multiple options for integrating within the identity services to authenticate users. One such method for integrating with Azure is to leverage an access token that is returned by Azure after a valid authentication. To enable this method of authentication, you must configure Azure to provide Perceptive Content with the required data for successful and secured authentication. Thus, you must create a new application in Azure as a Single Page Application. You can either create a new application in Azure as a Single Page Application or use an existing application. Ensure that few properties of the existing application are defined to match. - Perceptive Content - Titan - Perceptive-Content/Titan/Foundation-26.1/Titan-Installation-and-Setup-Guide/Appendix-D-Use-Access-Token-or-Custom-Claim-for-Azure-Authentication - Foundation 26.1 - Foundation 26.1

Registering an Application

To register an application in Azure, complete the following steps.

1. In the Name box, type a name of the application.
   Note: You can modify the name of the application later, if required.
2. In the Supported account types option, select the type of account to be accessed by the application.
3. In the Redirect URL (optional), select the application name and the URLs.
   Note: You must select the appropriate application name and the path that matches with your environment: <appname>/view/authentication-confirmation.

Adding a Scope

After registering the application, you must create a scope to allow Perceptive Content to validate the authentication token and enable Azure to trust token access. To add a scope, complete the following steps.

1. Select Expose an API from the menu of the newly created application in Azure. The Expose an API window opens.
2. Click Add a scope. The Add a scope window is displayed.
3. In the Application ID URl, enter the unique id in the format api://<UUID>.
4. In the Scope Name box, enter the name of the scope for the application. You can enter a descriptive name.
5. In the Who can Consent field, select Admins and Users.
6. In the Admin consent display name box, enter a name for admin consent.
7. In the Admin consent description box, enter the description associated with the admin consent.
8. Select Enabled for State.

Configure Titan and Perceptive Content to use offline token validation with Azure as an identity system

To update Perceptive Content, use the values from the Azure configuration. To configure Perceptive Content and Titan to use offline token validation with Azure as an identity system, complete the following steps.

1. Create a Bearer Token Login Profile to match with the Azure configuration in the inserver.ini on the Perceptive Content server.

   [Bearer Token Login Profiles]
   sso.bearer.profiles=titanazure
   sso.bearer.profile.titanazure.discovery.endpoint=https://login.microsoftonline.com/67c3f9bc-960c-4e4c-9d64-801286dxxx/v2.0/.well-known/openid-configuration
   sso.bearer.profile.titanazure.user.claim=preferred_username
   sso.bearer.profile.titanazure.debug.user.claims=TRUE
   sso.bearer.profile.titanazure.strip.domain.from.user.claim=TRUE
   sso.bearer.profile.titanazure.token.validation.method=offline
   sso.bearer.profile.titanazure.token.audience=c7d7d079-1260-4001-ab3b-28917897ed79
   

2. Use the following setting to leverage the use of the Access Token. This setting instructs the Perceptive Content server to validate claims using the Access Token instead of the UserInfo endpoint. sso.bearer.profile.titanazure.token.validation.method=offline

3. In this configuration use a value from the Azure system to provide an audience for the token. This value is the client ID for the application that is being used inside of Azure. The client ID can be found on the App Registration page within Azure.sso.bearer.profile.titanazure.token.audience=c7d7d079-1260-4001-ab3b-28917897ed79

   Note: Restart Perceptive Content server after saving the changes of the settings.
4. To configure Titan to include the scope created in Azure, edit the authConfig section in app.config.json file within Tomcat.

   "authConfig": {
       "issuer": "https://login.microsoftonline.com/67c3f9bc-960c-4e4c-9d64-801286da7f2a/v2.0",
       "clientId": "a8c39ac6-0dcf-4809-9550-ba4691a41f89",
       "scope": "openid profile email c7d7d079-1260-4001-ab3b-2S917S97ed79/TitanExampieScope",
       "redirectUri": "https://<hostname>:<port>/<app-name>/view/authentication-confirmation",
       "postLogoutRedirectUri": "https://<hostname>:<port>/<app-name>/home",
       "requireHttps": true,
       "strictDiscoveryDocumentValidation" : false
     }

5. Copy the value of scope from the Expose an API section in Azure and add the copied value to the scope section.
   Note: Use the value without including api://.

Refresh the browser after these settings are changed within Tomcat. The configuration is complete. Log in using authorized credentials.