java active directory 单点登录_教程：Azure Active Directory 单一登录 (SSO) 与 Contentful 集成...

您现在访问的是微软AZURE全球版技术文档网站，若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站，请访问 https://docs.azure.cn.

教程：Azure Active Directory 单一登录 (SSO) 与 Contentful 集成Tutorial: Azure Active Directory single sign-on (SSO) integration with Contentful

04/20/2020

本文内容

本教程介绍如何将 Contentful 与 Azure Active Directory (Azure AD) 集成。In this tutorial, you'll learn how to integrate Contentful with Azure Active Directory (Azure AD). 将 Contentful 与 Azure AD 集成后，可以：When you integrate Contentful with Azure AD, you can:

在 Azure AD 中控制谁有权访问 Contentful。Control in Azure AD who has access to Contentful.

让用户使用其 Azure AD 帐户自动登录到 Contentful。Enable your users to be automatically signed-in to Contentful with their Azure AD accounts.

在一个中心位置(Azure 门户)管理帐户。Manage your accounts in one central location - the Azure portal.

先决条件Prerequisites

若要开始操作，需备齐以下项目：To get started, you need the following items:

一个 Azure AD 订阅。An Azure AD subscription. 如果没有订阅，可以获取一个免费帐户。If you don't have a subscription, you can get a free account.

启用了 Contentful 单一登录 (SSO) 的订阅。Contentful single sign-on (SSO) enabled subscription.

方案描述Scenario description

本教程在测试环境中配置并测试 Azure AD SSO。In this tutorial, you configure and test Azure AD SSO in a test environment.

Contentful 支持 SP 和 IDP 发起的 SSOContentful supports SP and IDP initiated SSO

Contentful 支持 恰时 用户预配Contentful supports Just In Time user provisioning

配置 Contentful 后，就可以强制实施会话控制，实时防止组织的敏感数据外泄和渗透。Once you configure Contentful you can enforce session control, which protect exfiltration and infiltration of your organization’s sensitive data in real-time. 会话控制从条件访问扩展而来。Session control extend from Conditional Access.

备注

此应用程序的标识符是一个固定字符串值。The identifier of this application is a fixed string value. 一个租户中只能配置一个实例。Only one instance can be configured in one tenant.

从库中添加 ContentfulAdding Contentful from the gallery

要配置 Contentful 与 Azure AD 的集成，需要从库中将 Contentful 添加到托管 SaaS 应用列表。To configure the integration of Contentful into Azure AD, you need to add Contentful from the gallery to your list of managed SaaS apps.

使用工作或学校帐户或个人 Microsoft 帐户登录到 Azure 门户。Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.

在左侧导航窗格中，选择“Azure Active Directory”服务 。In the left navigation pane, select the Azure Active Directory service.

导航到“企业应用程序”，选择“所有应用程序” 。Navigate to Enterprise Applications and then select All Applications .

若要添加新的应用程序，请选择“新建应用程序” 。To add a new application, select New application .

在“从库中添加”部分的搜索框中，键入“Contentful” 。In the Add from the gallery section, type Contentful in the search box.

在结果中选择“Contentful”，然后添加应用 。Select Contentful in the results, and then add the app. 在该应用添加到租户时等待几秒钟。Wait a few seconds while the app is added to your tenant.

为 Contentful 配置和测试 Azure AD 单一登录Configure and test Azure AD single sign-on for Contentful

使用名为 B.Simon 的测试用户配置和测试 Contentful 的 Azure AD SSO 。Configure and test Azure AD SSO with Contentful using a test user called B.Simon . 若要运行 SSO，需要在 Azure AD 用户与 Contentful 相关用户之间建立链接关系。For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in Contentful.

若要配置和测试 Contentful 的 Azure AD SSO，请完成以下构建基块：To configure and test Azure AD SSO with Contentful, complete the following building blocks:

配置 Azure AD SSOConfigure Azure AD SSO

按照下列步骤在 Azure 门户中启用 Azure AD SSO。Follow these steps to enable Azure AD SSO in the Azure portal.

在 Azure 门户的“Contentful”应用程序集成页上，找到“管理”部分，选择“单一登录” 。In the Azure portal, on the Contentful application integration page, find the Manage section and select single sign-on .

在“选择单一登录方法”页上选择“SAML” 。On the Select a single sign-on method page, select SAML .

在“使用 SAML 设置单一登录”页上，单击“基本 SAML 配置”的编辑/笔形图标以编辑设置 。On the Set up single sign-on with SAML page, click the edit/pen icon for Basic SAML Configuration to edit the settings.

若要在“IDP”发起模式下配置应用程序，请在“基本 SAML 配置”部分输入以下字段的值：In the Basic SAML Configuration section, if you want to configure the application in IDP initiated mode, enter the values for the following fields:

在“回复 URL”文本框中，从 Contentful 中的“SSO 设置”页复制 ACS(断言使用者服务)URL 。In the Reply URL text box, copy the ACS (Assertion Consumer Service) URL from the SSO setup page in Contentful. 它将如下所示：https://be.contentful.com/sso//consumeIt will look like this: https://be.contentful.com/sso//consume

若要在“SP”发起模式下配置应用程序，请单击“设置其他 URL”并执行以下步骤：Click Set additional URLs and perform the following step if you want to configure the application in SP initiated mode:

在“登录 URL”文本框中，复制相同的 ACS(断言使用者服务)URL 。In the Sign-on URL text box, copy the same ACS (Assertion Consumer Service) URL. 它将如下所示：https://be.contentful.com/sso//loginIt will look like this: https://be.contentful.com/sso//login

备注

这些不是实际值。These values are not real. 使用实际回复 URL 和登录 URL 更新这些值，方法是从 Contentful 的“SSO 设置”页复制 ACS(断言使用者服务)URL。Update these values with the actual Reply URL and Sign-On URL by copying the ACS (Assertion Consumer Service) URL from the SSO setup page in Contentful.

Contentful 应用程序需要特定格式的 SAML 断言，这要求将自定义属性映射添加到“SAML 令牌属性”配置。Contentful application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. 以下屏幕截图显示了默认属性的列表。The following screenshot shows the list of default attributes.

除了上述属性，Contentful 应用程序还要求在 SAML 响应中传递回更多的属性，如下所示。In addition to above, Contentful application expects few more attributes to be passed back in SAML response which are shown below. 这些属性也是预先填充的，但可以根据要求查看它们。These attributes are also pre populated but you can review them as per your requirements.

名称Name

源属性Source Attribute

电子邮件email

user.userprincipalnameuser.userprincipalname

在“使用 SAML 设置单一登录”页的“SAML 签名证书”部分中，找到“证书(Base64)”，选择“下载”以下载该证书并将其保存到计算机上 。On the Set up single sign-on with SAML page, in the SAML Signing Certificate section, find Certificate (Base64) and select Download to download the certificate and save it on your computer.

在“设置 Contentful”部分，复制登录 URL 以配置 Contentful SSO 。In the Set up Contentful section, copy the login URL to configure Contentful SSO.

创建 Azure AD 测试用户Create an Azure AD test user

在本部分，我们将在 Azure 门户中创建名为 B.Simon 的测试用户。In this section, you'll create a test user in the Azure portal called B.Simon.

在 Azure 门户的左窗格中，依次选择“Azure Active Directory”、“用户”、“所有用户”。In the left pane in the Azure portal, select Azure Active Directory , select Users , and then select All users .

选择屏幕顶部的“新建用户” 。Select New user at the top of the screen.

在“用户”属性中执行以下步骤 ：In the User properties, follow these steps:

在“名称” 字段中，输入 B.Simon。In the Name field, enter B.Simon.

在“用户名”字段中输入 username@companydomain.extension 。In the User name field, enter the username@companydomain.extension. 例如，B.Simon@contoso.com 。For example, B.Simon@contoso.com.

选中“显示密码”复选框，然后记下“密码”框中显示的值。Select the Show password check box, and then write down the value that's displayed in the Password box.

单击“创建”。Click Create .

分配 Azure AD 测试用户Assign the Azure AD test user

在本部分中，你将通过授予 B.Simon 访问 Contentful 的权限，允许其使用 Azure 单一登录。In this section, you'll enable B.Simon to use Azure single sign-on by granting access to Contentful.

在 Azure 门户中，依次选择“企业应用程序”、“所有应用程序”。In the Azure portal, select Enterprise Applications , and then select All applications .

在应用程序列表中，选择“Contentful” 。In the applications list, select Contentful .

在应用的概述页上找到“管理”部分，然后选择“用户和组” 。On the app's overview page, find the Manage section and select Users and groups .

选择“添加用户”，然后在“添加分配”对话框中选择“用户和组”。Select Add user , then select Users and groups in the Add Assignment dialog box.

在“用户和组”对话框中，从“用户”列表中选择“B.Simon”，然后单击页面底部的“选择”按钮 。In the Users and groups dialog box, select B.Simon from the Users list, then click the Select button at the bottom of the page.

如果在 SAML 断言中需要任何角色值，请在“选择角色”对话框的列表中为用户选择合适的角色，然后单击页面底部的“选择”按钮 。If you're expecting any role value in the SAML assertion, in the Select Role dialog box, select the appropriate role for the user from the list and then click the Select button at the bottom of the page.

在“添加分配”对话框中，单击“分配”按钮。In the Add Assignment dialog box, click the Assign button.

配置 Contentful SSOConfigure Contentful SSO

请按照以下步骤在“Contentful”端配置单一登录 。Follow these steps to configure single sign-on on the Contentful side.

在 Contentful 中，导航到“组织设置”中的 SSO 设置页 。In Contentful, navigate to the SSO setup page in Organization Settings .

单击“设置 SSO” 。Click on Set up SSO .

从 Azure AD 中的“设置 Contentful”部分复制并粘贴登录 URL 。Copy and paste the login URL from the Set up Contentful section in Azure AD.

从下载自 Azure AD 的 Base64 证书文件中复制并粘贴证书。Copy and paste the certificate from the Base64 certificate file you downloaded from Azure AD.

为 SP 启动登录设置 SSO 名称。Set up an SSO name for SP-initiated login.

单击“启用 SSO” 。Click on Enable SSO .

If that doesn't work, reach out to the Contentful support team.

创建 Contentful 测试用户Create Contentful test user

在本部分，我们将在 Contentful 中创建名为 B.Simon 的用户。In this section, a user called B.Simon is created in Contentful. Contentful 支持默认启用的恰时用户预配。Contentful supports just-in-time user provisioning, which is enabled by default. 此部分不存在任何操作项。There is no action item for you in this section. 如果 Contentful 中不存在用户，则会在身份验证后创建一个新用户。If a user doesn't already exist in Contentful, a new one is created after authentication.

测试 SSOTest SSO

在本部分中，使用访问面板测试 Azure AD 单一登录配置。In this section, you test your Azure AD single sign-on configuration using the Access Panel.

单击访问面板中的 Contentful 磁贴时，应会自动登录到为其设置了 SSO 的 Contentful。When you click the Contentful tile in the Access Panel, you should be automatically signed in to the Contentful for which you set up SSO. For more information about the Access Panel, see Introduction to the Access Panel.

其他资源Additional resources