MicroStrategy ONE

Integrate MicroStrategy with Microsoft Entra ID OIDC Single Sign-On

Starting in MicroStrategy ONE (December 2024), you can use the Denodo JDBC driver to implement OIDC Single Sign-On with Microsoft Entra ID.

Configure Your Application in Microsoft Entra ID

  1. Configure a Microsoft Entra ID application for Denodo OAuth to add the additional permission for Denodo.

    For more information, see Quickstart: Register an Application with the Microsoft Identity Platform.

  2. Go to your newly created app and in the left pane, click Authentication.

  3. In Allow public client flows, toggle Enable the following mobile and desktop flows to Yes.

  4. In the left pane, click Certificates & secrets under Manage.

  5. In Client secrets, click New client secret.

  6. Enter a Description and Expires value.

  7. Click Add and note the client secret value for later use.

  8. In the left pane, click Expose an API under Manage.

  9. Click Add a scope.

  10. Type a Scope name.

    The scope name should be the same name as the role in the database.

    For Denodo, scopes are the names of roles. Once Denodo has the scopes of the token, it obtains the roles with the same names and executes the request with the privileges granted to these roles.

  11. Type an Admin consent display name and Admin consent description.

  12. Click Save.

  13. In the left pane, click API permissions and click Add a permission.

  14. Click the My APIs tab and select your application.

  15. Select the check box next to the custom scope you created and click Add permissions.

  16. In the left pane, click Manifest and check if the requestedAccessTokenVersion is set to 2.

    If the value is not 2, update it to 2, and click Save.

Integrate Denodo with Microsoft Entra ID

For more information on enabling OAuth in Denodo, follow the instructions in the JWT section of Enabling OAuth Authentication.

  1. Open the Denodo Administration Tool and log in with an Administrator account.

  2. In the menu, click Administration and Server configuration.

  3. Click Server authentication and OAuth.

  4. Define the following values:

    • Select a validation mode: Select Use JWT.

    • Select the signing algorithm: Choose RS256.

    • Issuer: Use the value from your OpenID configuration. To find this value, use https://login.microsoftonline.com/<tenant_id>/v2.0/.well-known/openid-configuration.

    • JWKS URL: Use the value from your OpenID configuration. To find this value, use https://login.microsoftonline.com/<tenant_id>/v2.0/.well-known/openid-configuration.

    • Audience: Enter your Entra ID application client ID.

    • Scope field name: Type scp.

  5. Click OK.

  6. To create roles in Virtual DataPort and grant them the appropriate privileges, see Creating Roles.

    The role name is used in Expose an API in the Entra ID application.

MicroStrategy Configuration

Create a Data Source Using OIDC Single Sign-On Authentication Mode

  1. Open the Workstation window.

  2. Connect to an environment.

  3. Create an IAM object using Manage OAuth Enterprise Security with Identity and Access Management (IAM) Objects.

    Use the Client ID and Client Secret from your Microsoft Entra ID application.

    For Scope, use the following format: openid offline_access profile api://<client id>/<scope name>. api://<client id>/<scope name> can be found in your Entra ID application under Expose an API.

  4. In the Navigation pane, click ,next to Data Sources.

  5. Search and choose Denodo from the data source list.

  6. In the Default Database Connection drop-down list , click Add New Database Connection.

  7. Type a Name.

  8. In the Driver drop-down list, choose the Denodo JDBC driver.

  9. Type a Server Name, Port Number, and Database.

  10. In the Authentication Mode drop-down in the Basic tab, choose OIDC Single Sign-On.

  11. In the Authentication Service drop-down list, choose the authentication service you created above or click Add New Authentication Service.

    For more information on creating Identity and Access Management objects, see Manage OAuth Enterprise Security with Identity and Access Management (IAM) Objects.

  12. Click Save.

  13. In the Add Data Source dialog, enter a Name and Database Version, and optionally choose Projects for further data manipulation.

  14. Click Save.

Create and Map Users to Entra ID

  1. Open the Workstation window.

  2. Connect to an environment.

  3. In the Navigation pane, click Users and Groups.

  4. Click next to All Users.

  5. Type a Full Name, Email Address, Username, and other optional fields.

  6. In the left pane, click Privileges and select the checkbox next to the following privileges:

    • Access data from Databases, Google BigQuery, Big Data, OLAP, BI tools

    • Create and edit database instances and connections

    • Create and edit database logins

    • Create configuration objects

    • Create dataset in Workstation

    • Configure project data source

    • Monitor Database Connections

    • Use Workstation

  7. In the left pane, click Authentication.

  8. In Trusted Authentication Request User ID, type the Microsoft Entra ID user's email address.

  9. Click Save.

Configure OIDC

For more information, see Enable OIDC Authentication for MicroStrategy Library.

  1. Open Workstation and connect to your environment using standard authentication and administrator credentials.

  2. Right-click the connected environment and choose Configure OIDC under Configure Enterprise Security.

  3. In step 2, choose Azure from the drop-down list.

  4. Copy the MicroStrategy Library URI and Workstation URI into the mobile and desktop application's sign-in redirect URIs in the Microsoft Entra ID application you created.

  5. In the Microsoft Entra ID left pane, click Manifest under Manage.

  6. Click the AAD Graph App Manifest tab and click Download.

  7. In MicroStrategy Workstation, upload the manifest file in MicroStrategy Configuration.

  8. Click Save.

  9. Restart the web server.

Single Sign-On with OIDC

  1. Open the Workstation window.

  2. Connect to an environment.

  3. Right-click the environment and choose Environment under Edit.

  4. Select Default OIDC and click Continue.

  5. A browser displays. Log in using your Microsoft Entra ID credentials.

  6. Use a MicroStrategy Administrator account to assign privileges to the new user.

    You do not need to perform this step if you mapped a MicroStrategy user to an Entra ID account and granted privileges.

  7. In the Navigation pane, click ,next to Datasets.

  8. Choose a Project and select Data Import Cube.

  9. Click OK.

  10. Choose the data source you created.

    The namespaces and tables display.