SSO OAuth (Microsoft)

FMADIO Capture devices can authenticate the users using Active Directory via the OAUTH 2.0 protocol. This enables Single Sign-On with ADFS.

The example described below assumes the FMADIO can directly access the OAUTH server. In most cases, a proxy is required, which is described at the end of the document.

Step 1) OAuth Config

Next, create a file named

/opt/fmadio/etc/oauth_opts.lua

This file contains the ADFS OAuth endpoints as follows

local config =
{
    redirect_uri                = "https://fmadio100v2-ip-address:443/secure/",
    discovery                   = "https://login.microsoftonline.com/571b0fe2-75cb-48de-9144-0cb928e90751/v2.0/.well-known/openid-configuration",
    client_id                   = "d41c59e7-6906-4569-9cc0-c6762541d2cd",
    client_secret               = "fSY7Q~dkbG~mHlJYipKiC0XCMhnXQbOkOP5iE",
    ssl_verify                  = "no",
    scope                       = "openid email profile",
    redirect_uri_scheme         = "https",
    proxy_opts =
    {
        https_proxy             = nil,
    }
}
return config

These fields are from the ADFS Endpoint URI information, for example as follows. We created a fmadio sign-in entry, this has the following client_id entered above.

The "discovery" config above needs to be the OpenID Connect Metadata document, as seen below.

The "client_id" is shown below.

The "client_secret" in the above config needs to be the Value shown below, not the secretID

Finally, the "redirect_uri" needs to be registered as follows.

Once the config is complete, please confirm there are no syntax errors by running

fmadiolua /opt/fmadio/etc/oauth_opts.lua

Correct output is as follows. If there are any syntax errors please correct them.

Step 2) Update the system configuration for OAuth and nginx

Run the following to update the system configuration files to map nginx to the OAuth proxy/SSO module, instead of standard basic authentication (htpasswd)

config security auth oauth

To verify success, run “show security” inside the fmadiocli to confirm the authentication model is now set to OAuth.

Step 3) Restart nginx

Restart nginx to load the new configuration files by killing the process as below. It will respawn on a 1-minute cron job automatically

sudo killall nginx

It can take 60 to 120sec for nginx to restart again.

Step 4) Logging in

Next, open a browser to the FMADIO device, it should redirect you to the Active Directory login page as follows.

Step 5) Logout

Logout is the same, using the logout button shown below

Then choose an account to sign out of

Proxy Setting

This example above assumes the OAUTH server can be accessed directly from the FMADIO. In most cases, this is not possible, instead, there is a proxy through which external web access must be routed. FMADIO only supports HTTPS through an HTTP proxy on the local network. This Proxy can then reach out to the external authentication service (such as login.microsoftonline.com ). It’s likely this proxy will need some tweeks / access controls to allow the FMADIO system to communicate with the authentication service.

To configure this, update the oauth_opts.lua configuration file as follows

local config =
{
    redirect_uri                = "https://fmadio100v2-ip-address:443/secure/",
    discovery                   = "https://login.microsoftonline.com/571b0fe2-75cb-48de-9144-0cb928e90751/v2.0/.well-known/openid-configuration",
    client_id                   = "d41c59e7-6906-4569-9cc0-c6762541d2cd",
    client_secret               = "fSY7Q~dkbG~mHlJYipKiC0XCMhnXQbOkOP5iE",
    ssl_verify                  = "no",
    scope                       = "openid email profile",
    redirect_uri_scheme         = "https",
    proxy_opts =
    {
        https_proxy             = "http://local_http_proxy:portnumber",
    }
}
return config

Note: the URL endpoint must be http (not https) even tho the final endpoint is a TLS connection.