ARTIFACTORY: How to associate your Azure AD SAML groups with Artifactory

How to sync your Azure AD SAML groups with JFrog

After integrating your JFrog platform with Azure Active Directory using SAML SSO, you will need to associate your Azure AD groups with internal groups in JFrog.

For instructions on how to configure Azure AD as a SAML SSO provider in the JFrog Platform, refer here.

Note: The groups in Azure AD will not be automatically imported into Artifactory, a correlating group will need to be created in Artifactory.
For automatic synchronization between Azure AD & JFrog, you may want to look into our SCIM documentation.

On Azure side:

1. In the Azure portal, navigate to your JFrog Artifactory application integration page, under “Enterprise applications”.

 2. Select “Assign users and groups”:



3. “Add User/group”



4. Assign the group to the application:


5. Navigate to the "Single Sign-On with SAML" page.

6. Click on the ‘Edit’ icon to open the Attributes & Claims dialog, in order to add a custom group claim:



Please note: If a group claim already exists, you won't be able to add a new group claim.  Delete the defaultly generated group claim, and then create a new one as shown in the steps that follow.

7. Click on “Add a group claim”
8. Select “Groups assigned to the application” 
9. Set the “Source attribute” to be “Group ID”:

On the JFrog platform:

Saml SSO

1. In the Administration module, go to Authentication Providers | SAML SSO.
2. Check the “Auto Associate Groups” box.
3. Enter the group attribute (created in step 7 on Azure):

User Management:

4. Create a new group in Artifactory and provide the group with a name.
5. Insert the Azure group “Object ID” to the “External ID” field:

Permissions:

Permissions can be set on two levels :

• Global permissions that are associated with a role.
• Permissions over specific resources -Permission target.

Global permissions 

Global permissions that are associated with a role can be set in the group itself:

Permissions over specific resources

For permissions over specific resources, leave the global permissions empty, and configure a “permission target” for that group.

1. Navigate to the “permissions” tab
2. Create a new permission target.
3. Select the Resources that you want the group to have permissions over.
4.  Add the group, and select the scope of permissions you want this group to have. As shown in the following screenshot:



Once all is completed, your group in Artifactory should look like this, varies according to the kind of permissions set: