Creating OAuth 2.0 JWT Certificate Credentials

Note
SailPoint recommends JWT certificate credentials for OAuth 2.0 authentication.

Use the following steps to create JWT certificate credentials for OAuth 2.0 authentication. For more information, refer to OAuth 2.0 Authentication.

Registering an Application and Assigning API Permissions

  1. Register an application in Azure portal. For more information, refer to register an application in the Microsoft documentation.

    Note
    The linked document is not maintained by SailPoint and is subject to change without notice.

  2. After you register the app, copy the Application (client) ID, and then generate a client secret.

  3. Assign API permissions to the application. For the permissions this connector requires, refer to Required Permissions. For more information about assigning permissions, refer to API permissions in the Microsoft documentation.

    Note
    The linked document is not maintained by SailPoint and is subject to change without notice.

If you have already registered the application and assigned API permissions, continue with Creating and Using the Certificate.

Creating and Using the Certificate

  1. Run PowerShell as an administrator on a Windows computer, and then generate a self-signed certificate with the following command:

    New-SelfSignedCertificate -DnsName "EntraID" -CertStoreLocation "cert:\LocalMachine\My"

  2. Go to certlm.msc > Personal > Certificates, right-click the certificate, and select Export. Complete the Certificate Export Wizard and export the certificate in PFX format.

  3. Select Include all certificates in the certification path if possible and Enable certificate privacy.

  4. Enter a password to protect the private key, and use AES-256-SHA256 encryption. You need this password when you use the PFX file.

  5. Save the PFX file to a directory of your choice. Download OpenSSL, or use Git Bash.

    Note
    The linked document is not maintained by SailPoint and is subject to change without notice.

    Copy the PFX file into the directory where the command prompt or terminal is open as an administrator. Run the following commands one at a time, and press Enter after each command. The file names are examples. You can use other file names if you use the same names in each command.

    1. openssl pkcs12 -in test1.pfx -nocerts -out sp.key

    2. openssl pkcs12 -in test1.pfx -clcerts -nokeys -out sp.crt

    3. openssl rsa -in sp.key -out rsasp.key

  6. Upload the sp.crt file to the Microsoft Entra app registration:

    1. Sign in to the Azure portal.

    2. In App registrations, select the client application.

    3. Select Certificates & secrets.

    4. Select Upload certificate, select the certificate file, and then select Add.

  7. On the Connection Settings page, enter the text of rsasp.key in Private Key and the text of sp.crt in Certificate. For more information, refer to Connection Settings.

    Private Key Password is the passphrase you entered when you created sp.key.