I’ll try to explain what I’m attempting to do, as I’m not sure if it’s possible, and if it is, how it should be done or what the best approach would be.
Since all users are in the same Entra tenant, I’m trying to configure authentication for both the PAM server and the RAG Portal using Entra SAML. However, I’m facing the following issue:
If I enable “Use Remote Access Gateway” for authentication, I can no longer authenticate via SAML from pam.domain.com at all.
As I understand it, I cannot have two separate authentications within the same Entra tenant because Netwrix PAM provides a fixed “Identifier (Entity ID)” as sbpamsaml.stealthbits.com, and Entra does not support two applications with the same identifier.
Additionally, it seems that Netwrix PAM does not provide an option to configure the “Reply URL (Assertion Consumer Service URL)”, which may also be causing issues.
Any help would be appreciated, the documentation is very limited. Maybe I’m just trying to do this the wrong way.
Thanks for reaching out. There is a current limitation with SAML and using the RAG Portal. You do need to set up two separate Authentication connectors, one for internal use and another for external use. We wanted to make sure that there was a clear separation.
Since you are using an Azure application, you could use OIDC instead of SAML to provide the authentication. This will allow you to use the same application in Azure, the callback URL sent by the client will redirect to the Portal instead of the main application.
Using OIDC should help you get past the SAML limitation.
Please also be aware that NPS will allow you to select a single ‘Authenticator connecter’ per user on the ‘authentication connector’ tab on the user details. So please ensure that your regular users have the appropriate authentication connector assigned to them (i.e. Entra ID OIDC - Portal) vs your administrator users (i.e. Entra ID OIDC - PAM). Otherwise, a user will seemingly authenticate but will be logged out of the system because of an authenticator mismatch.
Im stuck on configuring OpenID, I had an MS Teams meeting with Netwrix support, but they couldn’t help either. Maybe you can point me in the right direction.
Steps I take:
Microsoft Azure → App registrations → New Registration
Accounts in this organizational directory only (DOMAIN only - Single tenant)
Manage → Authentication → Select the tokens you would like to be issued by the authorization endpoint: → Access tokens (used for implicit flows) and ID tokens (used for implicit and hybrid flows) → Save
Certificates & secrets → Client secrets → New Client secret
API permissions → Adding Microsoft Graph (delegated): email, offline_access, openid, profile, User.Read
Steps on the Netwrix PAM server:
Configuration → Authentication → name “TEST OPENID”
Connector Type → OpenID Connect (NOT “Use Remote Access Gateway”)
Test Connection → Back on browser → Next in the configuration window
Test Login tab in the configuration window: only the Login button is enabled → Log in to Microsoft
Now strange things are happening in the browser’s network:
The https://pam.domain.com/callback request response: “You need to enable JavaScript to run this app.”
The Netwrix OpenID Connect Configuration window displays the following message: Login was unsuccessful. Confirm that the user is allowed to access the application and try again or click ‘Back’ to modify the configuration. Error: No access token found
Azure Audit Log Details:
Target → Registred application ID and Name
Activity: Status → success
It feels like the application registered in Azure is not returning the token back to Netwrix PAM.
I would like to note that the Netwrix documentation also does not specify what permissions are required for the application registered in Azure.
Many thanks to everyone, especially @kevin.horvatin, for helping with the authentication configuration.
I probably have just one remaining question that I’m thinking of solving this way:
External users connect via RAG Portal OpenID authentication – this part is clear.
But what should I do with users who are also administrators?
My idea is to have two separate users in AD, for example, Mikas and Mikas-Adm, and link both to the same Entra ID user. One would be used for external authentication via the RAG Portal, and the other for internal authentication via the PAM Server.
