Integrating Microsoft Entra ID with Keycloak for MTG CLM Authentication
This guide walks you through configuring Microsoft Entra ID (formerly Azure AD) as an identity provider for Keycloak, enabling single sign-on for MTG CLM users.
Prerequisites: Microsoft Entra ID administrative privileges, Keycloak administrative access, and MTG CLM environment access.
Create the App Registration in Entra ID
To allow Keycloak and MTG CLM to authenticate users against your Microsoft environment, you must first register an application in your Entra ID tenant.
-
Log in to Azure Portal 🔗.
-
Click the hamburger button on the top left corner.
-
Select Microsoft Entra ID.
-
Click + Add and then App Registration.
-
Enter a descriptive Name for the application (e.g., MTG CLM - Keycloak).
-
Under Supported account types, select Single tenant only.
-
Leave the Redirect URI blank for now. You will configure this later when setting up Keycloak.
-
Click Register.
Once the application is created, you are taken to the Overview page.
Copy and securely store the following two values, as you will need them for the Keycloak configuration:
-
Application (client) ID
-
Directory (tenant) ID
Configure API Permissions and Admin Consent
To allow MTG CLM to read user and directory objects within your tenant, you must grant the App Registration specific Microsoft Graph API permissions.
-
In your App Registration menu, select API permissions from the left sidebar.
-
Click + Add a permission.
-
Select Microsoft Graph.
-
Select Application permissions (not Delegated permissions).
-
In the search bar, locate and check the following permission:
Directory.Read.All. Click Add permissions at the bottom of the screen.
-
Once the permissions are added, select them and click the Grant admin consent for [Your Tenant Name] button located above the permissions list.
-
Click Yes in the confirmation prompt. You should be seeing a similar screen to:
| If the Grant admin consent button is greyed out, your current account does not have the Global Administrator or Privileged Role Administrator rights required to authorize these permissions. |
Generate the Client Secret
Keycloak requires a client secret to authenticate against your Entra ID tenant securely.
-
In your App Registration menu, select Certificates & secrets from the left sidebar.
-
Click + New client secret.
-
Enter a descriptive Description (e.g., MTG CLM-Secret) and select an Expires duration according to your security policy.
-
Click Add.
| Copy the Value string immediately and store it in a secure location. This value will be permanently hidden once you leave this page, and you cannot retrieve it later. You will paste this value into Keycloak in the next section. |
Configure Keycloak Identity Provider
Access Identity Provider Configuration
-
Sign in to your Keycloak administration console.
-
Navigate to your target realm for MTG CLM integration.
-
Select Identity Providers from the left navigation menu.
-
Click OpenID Connect v1.0.
Configure Provider Settings
1. Basic Configuration
-
Alias: Enter "microsoft-entra-id" (or organizational standard).
-
Display Name: Enter "Microsoft Entra ID".
Make sure you store your Redirect URI now. You are going to need it later.
2. OpenID Connect Settings
-
Keep Use discovery endpoint on and retrieve it from portal.azure.com.
| The metadata fields related to endpoints will be automatically populated upon pasting. |
-
Client Authentication: Select "Client secret sent as post" from the dropdown list.
-
Client ID: Retrieve from portal.azure.com → Overview.
-
Client Secret: Retrieve from portal.azure.com → Certificates & secrets Select "Client secret sent as post" from the dropdown list.
| Make sure to timely renew the client secret before your selected expiration date. |
| Upon creation, you must copy the Client Secret Value and store it to a secure location. You will not be able to access it later! |
Paste the Client Secret Value to the appropriate field in Keycloak and keep Client assertion signature algorithm to "Algorithm not specified".
The completed page should now look like this:
Click "Add" to proceed.
Now copy your redirect URI and paste it in portal.azure.com
Click "Add a platform" and then select "Web".
Paste the Redirect URI in the appropriate field and then select "Configure" to finish.
In Keycloak go to Clients (within MTG ERS realm) and choose the account-console client.
In Access Settings make sure Web origins is set to "*".
3. Group/Role Mapping
Defining app roles in Entra ID
In your Azure app registration, under App roles, create entries such as clm-admin or clm-default.
These roles will be included in the roles claim of the ID token.
