OIDC Setup for NID FS on Nebula Control Center and Microsoft Entra ID

Options
Zyxel_Richard
Zyxel_Richard Posts: 260 image  Zyxel Employee
Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Security
edited June 16 in Org-wide settings

This article describes how to configure OpenID Connect (OIDC) on both Nebula Control Center (NCC) and Microsoft Entra ID. It enables administrators to integrate their existing user directory with the Nebula identity federation service (NID FS) via OIDC, allowing users to leverage the service for additional network services such as SSID and SSL VPN authentication.

Note: Please ensure that the user's email address is set to allow successful authentication via OIDC

This guide focuses on the application registration process in Microsoft Entra ID and the collection of required information to configure a valid Identity Provider (IdP) profile in NCC.

Step 1 : Copy the Redirect URL on NCC

  • In the “Add Identity Provider” dialog in NCC, copy the Redirect URL value for later use.
image-49790dc37f98b-a828.png

Step 2: Register an Application in Microsoft Entra ID

  • Sign in to the Microsoft Entra Admin Center.
  • Navigate to App registrations > New registration.
  • Click + New registration in the top menu.
image-9644117dee0618-c07d.png

  • On the Register an application page:
    • Enter a descriptive name for your application.
    • Under Supported account types, select the account types that should be allowed to access the Nebula identity federation service.
    • Under Redirect URI
      • Select Web as the platform.
      • Paste the Redirect URL copied from NCC.
image-d13972104171d-a67a.png

  • Click Register.
  • After registration, record the following values in the application detail page:
    • Application (client) ID
    • Directory (tenant) ID
image-603e1b42f55bb-4898.png

Step 3: Create an OIDC Client Secret in Microsoft Entra ID

  • In the application detail page, navigate to Manage > Certificates & secrets.
  • Click + New client secret.
image-49f675f00d6078-b4b0.png

  • In the configuration panel:
    • Enter a name (description) for the secret.
    • Select an appropriate expiration period.
image-996f7244f07e18-db72.png

  • After creation, copy and securely store the client secret value.
image-41ddf096bb9b98-08b5.png

Step 4: Configure the Identity Provider in NCC

  • Return to the “Add Identity Provider” dialog in NCC and enter the following details:
    • Issuer URL: https://login.microsoftonline.com/<tenant_id>/v2.0
    • Client ID: <Application (client) ID>
    • Client Secret: <Client Secret Value>
image-5885213f5770a-f6c0.png

  • Click Save to complete the Identity Provider configuration.

Related content：Claim settings and usage on Microsoft Entra ID and NCC.

Categories

EnglishTiếng ViệtРусскийไทย中文（台灣）