Setting Up Azure AD as Identity Provider Using ZITADEL Helm Chart

[mohan-alpheya]

Dear All,

We have successfully deployed ZITADEL using the Helm chart (Helm Chart Link) and can log in using local authentication. Now, we need help setting up Azure AD as an external identity provider via the Helm chart configuration.

Current Setup:

Our ZITADEL deployment is running fine, and we can authenticate using local users. We now want to integrate Azure AD using OpenID Connect (OIDC) without having to manually configure it via the API.

Is there a way to configure Azure AD as an identity provider using the Helm chart?

Would really appreciate guidance from anyone who has successfully set this up!

[fforootd]

The best way currently is to either call our API or use an IAC tool like terraform, for which we have a provider.

[mohan-alpheya]

Just wanted to share that I have configured Azure AD authentication in Zitadel using the Helm chart with extraManifests as a post-hook.

I’m sharing this to help those who come across this post while looking for a way to set up Azure AD with Zitadel. This may not be the best way, but it works! 🚀

extraManifests:
  - apiVersion: batch/v1
    kind: Job
    metadata:
      name: post-install-configure-azuread
      namespace: zitadel
      annotations:
        "helm.sh/hook": post-install
        "helm.sh/hook-delete-policy": before-hook-creation
    spec:
      template:
        spec:
          restartPolicy: Never
          serviceAccountName: zitadel-sa
          containers:
            - name: configure-azuread
              image: ubuntu:latest # this image should have curl jq kubectl and i build own image with these tools.
              command: ["/bin/bash", "-c"]
              args:
                - |
                  # Machine account name
                  SVC_SECRET_NAME="zitadel-admin-cli"
                  NAMESPACE="zitadel"
                  IAT=$(date +%s)
                  EXP=$((IAT + 3600))
                  CUSTOM_DOMAIN="https://zitadel.example.com"
                  JSON_CONTENT=$(kubectl get secret $SVC_SECRET_NAME --token=$TOKEN -n $NAMESPACE -o json | jq -r '.data["zitadel-admin-cli.json"]' | base64 -d)                  
                  SERVICE_ACCOUNT_TYPE=$(echo $JSON_CONTENT | jq -r '.type')
                  KEY_ID=$(echo $JSON_CONTENT | jq -r '.keyId')
                  PRIVATE_KEY=$(echo $JSON_CONTENT | jq -r '.key')
                  USER_ID=$(echo $JSON_CONTENT | jq -r '.userId')

                  HEADER=$(jq -c -n --arg kid "$KEY_ID" '{"alg": "RS256", "kid": $kid}')
                  
                  PAYLOAD=$(jq -c -n --arg iss "$USER_ID" \
                     --arg sub "$USER_ID" \
                     --arg aud "$CUSTOM_DOMAIN" \
                     --arg iat "$IAT" \
                     --arg exp "$EXP" \
                     '{"iss": $iss, "sub": $sub, "aud": $aud, "iat": ($iat | tonumber), "exp": ($exp | tonumber)}')

                  BASE64_HEADER=$(echo -n "$HEADER" | base64 | tr '+/' '-_' | tr -d '=' | tr -d '\n')
                  
                  BASE64_PAYLOAD=$(echo -n "$PAYLOAD" | base64 | tr '+/' '-_' | tr -d '=' | tr -d '\n')
                  
                  unsigned_jwt="$BASE64_HEADER.$BASE64_PAYLOAD"
                  
                  SIGNATURE=$(echo -n "$unsigned_jwt" | openssl dgst -sha256 -sign <(echo "$PRIVATE_KEY") | base64 | tr '+/' '-_' | tr -d '=' | tr -d '\n')

                  JWT="${BASE64_HEADER}.${BASE64_PAYLOAD}.${SIGNATURE}"

                  RESPONSE=$(curl --request POST \
                    --url https://zitadel.example.com/oauth/v2/token \
                    --header 'Content-Type: application/x-www-form-urlencoded' \
                    --data grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer \
                    --data scope='openid profile urn:zitadel:iam:org:project:id:zitadel:aud' \
                    --data assertion=$JWT)

                  ACCESS_TOKEN=$(echo $RESPONSE | jq -r '.access_token')

                  echo "Configuring Azure AD as an identity provider..."
                  curl -X POST "https://zitadel.example.com/admin/v1/idps/azure" \
                    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
                    -d '{
                      "name": "Azure AD",
                      "clientId": "Replace with Client ID",
                      "clientSecret": "Replace with Client Secret",
                      "tenant": {
                        "tenantId": "Replace with Tenant ID"
                      },
                      "emailVerified": true,
                      "scopes": [
                        "openid",
                        "profile",
                        "email",
                        "User.Read"
                      ],
                      "providerOptions": {
                        "isLinkingAllowed": false,
                        "isCreationAllowed": false,
                        "isAutoCreation": true,
                        "isAutoUpdate": true,
                        "autoLinking": "AUTO_LINKING_ALLOW"
                      }
                    }'
                    
                  echo "End of Azure AD IDP configuration!"