External - Use an eID as primary login method (SAML)

Scenario

Note. In this scenario a European eID will be the primary login method. No authentication is done using Entra credentials.

Microsoft Entra External ID can use Fortified ID Access as an external SAML Identity Provider (IdP) to enable authentication with European eIDs or any other authentication method supported by Fortified ID Access.

With this setup, users can authenticate (sign in) or register (sign up) to Entra External ID using eIDs such as BankID, SITHS, EFOS, Freja eID, Norwegian ID-porten, Foreign eID (eIDAS), or Suomi.fi.

In this scenario, Entra External ID acts as the SAML Service Provider (SP) and Fortified ID Access acts as the SAML Identity Provider (IdP).

---

Sign-In and Sign-Up Scenarios

When integrating Entra External ID with an external IdP, two things need to be addressed:

1. Sign-in - authenticating an existing federated Entra user account.
2. Sign-up - creating a new Entra account based on external authentication.

This use case focuses only on the sign-in scenario.
&#xNAN;1. The account created in Entra needs to have an attribute that can be matched with the incoming SAML assertion. In this use case, the email address claim is used for that purpose.
&#xNAN;2. If the user does not exist, Entra can create a federated account. If you want to control the creation of new accounts, check out this use case, Verify if user exists
&#xNAN;3. If just-in-time sign-up is not used and users are pre-populated in Entra External ID, Microsoft recommends disabling sign-up in the user flow. See Disable sign-up in a sign-up and sign-in user flow.

---

Federated Accounts in Entra External ID

Users signing in to Entra External ID must have an existing federated account in Entra.
When using an external IdP for authentication, the Entra account must be of the federated type.

Accounts created through Entra's Sign-up feature while using an external IdP are automatically configured as federated.

Federated user accounts can also be created programmatically using the Microsoft Graph API.

Note: It is not possible to create federated users directly from the Entra UI.

If you already have existing native Entra External ID users (non-federated), you can migrate them to federated using the Graph API.

This process can also be automated using Fortified ID Automate.

Prerequisite

There are some prerequisites for this use case. You will need the following:

• Fortified ID Access - SAML Identity Provider

  • This use case assumes that you have Fortified ID Access configured to support authentication of users with an eID.

  • You need the Fortified ID Access IdP metadata. Download it from:

    https://<access_idp_domain>/saml/metadata/<idp_id>

  • This metadata file is imported when you add a new custom SAML identity provider in Entra External ID under Identity providers.

• Fortified ID Access - Entra External ID as SAML Service Provider

  • Entra External ID SP metadata cannot be generated automatically in this scenario. Instead, create a metadata file manually by using the template below and replace <tenant_id> with the current Entra External ID tenant ID.

  • The tenant ID can be found in Overview in the Entra admin portal.

    <?xml version="1.0" encoding="UTF-8"?>
    <EntityDescriptor
        xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
        entityID="https://login.microsoftonline.com/<tenant_id>/">
    
        <SPSSODescriptor
            AuthnRequestsSigned="false"
            WantAssertionsSigned="true"
            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    
            <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
    
            <AssertionConsumerService
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://<tenant_id>.ciamlogin.com/login.srf"
                index="0"
                isDefault="true" />
        </SPSSODescriptor>
    </EntityDescriptor>

  • Import this metadata file into Fortified ID Access when you add Entra External ID as a SAML SP / federation party.

  • After the SP is added in Fortified ID Access, add a custom SAML attribute on Attribute settings containing the current user's email address with the following key:

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

• Entra ID
  • Entra External ID tenant
  • Administrative tenant rights to manage identity providers and user flows
  • All users who will log in with an external IdP as the first method need to have account type federated
• Host (DNS) name of the Fortified ID Access service for external access

Configure Fortified ID Access for Entra External ID

Export the Fortified ID Access IdP metadata

1. Open the metadata endpoint below in a browser:

   https://<access_idp_domain>/saml/metadata/<idp_id>

2. Save the metadata file locally.

3. This file will be imported into Entra External ID in a later step.

Create Entra External ID SP metadata manually

1. Open a text editor.
2. Paste the XML template from the Prerequisite section.
3. Replace all occurrences of <tenant_id> with the current Entra External ID tenant ID.
4. Save the file locally, for example as entra-external-id-sp-metadata.xml.

Add Entra External ID as a SAML SP in Fortified ID Access

1. In Fortified ID Access, add a new federation / SAML SP for Entra External ID.
2. Import the metadata file you created manually for Entra External ID.
3. Save the configuration.

Add the email claim in Fortified ID Access

1. Open the Entra External ID SP configuration in Fortified ID Access.

2. Go to Attribute settings.

3. Add a custom SAML attribute.

4. Set the key to:

   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

5. Set the value so that it contains the current person's email address.

6. Save the configuration.

Configure your Entra External ID tenant

In summary, you create a connection to the external IdP, you create a user flow, and you register your application. The user flow is what links your application with the external IdP.

Login to your tenant

1. Browse to https://entra.microsoft.com/
2. Login to your Entra External ID tenant

Add Fortified ID Access as a custom SAML IdP

1. Click Microsoft Entra ID -> External Identities -> All identity providers

2. Select the Custom tab

3. Click Add new -> SAML/WS-Fed

4. Enter a suitable Display name

5. Select SAML as Identity provider protocol

6. If you do not want Entra to validate the user's email domain against a configured federation domain, enable Domainless

7. Under metadata, choose Parse metadata file

8. Upload the Fortified ID Access metadata file downloaded from:

   https://<access_idp_domain>/saml/metadata/<idp_id>

9. Review the populated values

10. Click Save

Register your app

Note. Before you continue, you need to register your application in Entra.
At the end of this document we show how to register and use one of the example apps available in Entra. See section, Extra. Register an Entra example application

Add a User Flow

1. Click Identity -> External identities -> User flows
2. Click New user flow
   1. Add a display name, for example User_flow_for_FortifiedID_eID_SAML
   2. Select your new SAML identity provider
   3. Add the user attributes you want to use
3. Click Create

Add your application to the user flow

1. Click Identity -> External identities -> User flows
2. Click the user flow you created earlier
   1. Click Applications
   2. Click + Add application
   3. Select and add your application

Extra. Register an Entra example application

Note. You can skip this step if you already have added your application.

For test we will use one of the example apps that is available in Entra and run it locally on your machine.

Create the app registration

1. In your Entra External ID tenant
2. Click Entra ID -> App registrations
   1. Add a Name, for example Test FortifiedID eID app (SPA/react)
   2. Leave Supported account types as default
   3. In Redirect URI (optional)
      1. Choose Single-page application (SPA)
      2. Add value http://localhost:3000/redirect
   4. Click Register

Open the Quickstart experience

1. On the application settings page
   1. Click Quickstart
   2. On the Customize your sign-in experience page, leave the defaults and click Continue
   3. On the Try out your sign-up experience page, leave the defaults and click Continue
   4. On Add your sign-in to a sample app, click Single page application (SPA)
   5. Then click React

Run the sample app

1. Download the sample app and unzip it

2. Install Node.js

3. Run in a terminal:

   cd SPA && npm install && npm start

4. A browser should open and show the sample app

5. Close the browser and stop the app when you are done testing

Verification

Start the sign-in flow

1. Start the sign-in flow from your application or test application

Select the SAML option

1. Select the Fortified ID Access SAML option in the Entra user flow

Authenticate with your eID

1. Authenticate with your eID in Fortified ID Access

Verify the sign-in

1. Verify that Entra External ID accepts the SAML response and signs the user in

Check the email claim

1. If the account mapping does not work, verify that the SAML assertion from Fortified ID Access includes the email claim:

   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress