Entra ID SSO in Pangolin Community Edition
When self-hosting the Community Edition of Pangolin, you have to live with a few limitations. One of these is that the Google and Microsoft 365 identity providers (Microsoft Entra ID, formerly Azure AD) are not available. At first glance, it appears that only generic OAuth2/OIDC identity providers such as Authentik, Keycloak, or Okta can be added. However, since Entra ID is also an OAuth2/OIDC identity provider, it can be integrated with the Pangolin Community Edition with a little know-how. The following guide explains how to set it up.
1. Create an IdP in Pangolin
In the Pangolin Server Admin interface at https://<Pangolin-Server-FQDN>/admin/idp and create a new Identity Provider.
Give the newly created IdP a meaningful name.
2. Create an App in Entra ID and Gather the Required Information
Open the Microsoft Entra admin center at https://entra.microsoft.com and navigate to App registrations. Click New registration to register a new application.
Give the application a meaningful name. Leave the Redirect URI field empty for now. Pangolin will only provide the required URI after the IdP has been created.
Make a note of the application’s Application (client) ID. You will need to enter this in Pangolin later.
Create a Client Secret and make a note of its value. You will also need to enter this in Pangolin later. Important: The secret value can only be copied immediately after it has been created.
You should also keep track of the secret’s expiration date. Once the secret expires, authentication will stop working until a new secret is created and configured in Pangolin.
Now return to Overview and click Endpoints. Make a note of the following two URLs: “OAuth 2.0 authorization endpoint (v2)” and “OAuth 2.0 token endpoint (v2)” You will need both URLs when configuring Pangolin. In general, these URLs have the following format:
# OAuth 2.0 authorization endpoint (v2):
https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/authorize
# OAuth 2.0 token endpoint (v2):
https://login.microsoftonline.com/<Directory (tenant) ID>/oauth2/v2.0/token
3. Configure the OAuth2 Settings in Pangolin
Enter the Client ID and Client Secret obtained in step 2. For Authentication URL, use the OAuth 2.0 authorization endpoint (v2) from step 2. For Token URL, enter the OAuth 2.0 token endpoint (v2).
Create the IdP by clicking Create Identity Provider.
Once the IdP has been created, Pangolin displays the Redirect URL in the General section at the top.
The URL follows this format:
https://<Pangolin-Server-FQDN>/auth/idp/<Pangolin-IdP-ID>/oidc/callback
4. Add the Redirect URL to the Entra ID App
Return to the Overview page of the App Registration in Microsoft Entra ID. On the right-hand side, next to Redirect URIs, click Add a Redirect URI.
On the page that opens, click Add a platform and select Web.
Enter the Redirect URL obtained from Pangolin in step 3 as the Redirect URI, then save the configuration.
5. Configure Auto Provision Users
If Auto Provision Users is enabled in the Pangolin IdP settings, policies can be created under the Auto Provision Settings tab. These policies can automatically assign users to organizations and roles. The configuration of this feature is relatively self-explanatory.
6. Test the Configuration
Open Pangolin in an incognito/private browser window. A new OAuth SSO button should now appear below the regular login form.
During the first login, the user will be asked to accept the application. Administrator privileges or consent on behalf of the entire organization are not required.
