Setting up Clarity Connect to use Azure AD for Authentication (CT Admin Steps)

3.1. How to disable Windows Authentication

On all Connect Application servers, perform the following:

1. Open the Internet Information Services (IIS) Manager and on the left-hand side click on the Server name and double-click on Authentication:

2. Ensure that Anonymous Authentication is Enabled and that all other Authentication types are disabled. Example screenshot:

3. On the left-hand side, expand the Server name, click on Sites and select the Connect Website:

4. Repeat steps 3 and 4 for the site selection on every Connect application server.

NOTE: Do not skip this step.

3.2. Modification of the Connect Admin Website configuration file

On all Connect Application servers, perform the following:

1. Navigate to: {ConnectInstallPath}\inetpub\ClarityConnect

2. Open the Web Config file using a text editor.

3. Under the <system.web> section, ensure that the only valid and uncommented <authentication> element is the following:
    <authentication mode="None" />
4. Under the <appSettings> section, update or add the WS_WindowsAuth key value and ensure it is set to false:
    <add key="WS_WindowsAuth" value="false" />

5. Save the changes. Example screenshot:

3.3. Modification of the Connect Web Agent Console javascript file

1. Navigate to {ConnectInstallPath}\inetpub\ClarityConnect\Dashboard

2. Open the preBootstrap.js file in a text editor.
3. Search for the isAzureAdAuthEnabled flag and set it to true: var isAzureAdAuthEnabled = true;

4. Fill in the correct values for the Azure AD configuration object with the Connect Configuration settings shown below:
      var azureAdConfig = {
                      clientId: 'AAD_DashboardApplicationId',
                      tenant: 'AAD_TenantName',
                      webApiResourceUri: 'AAD_WebApiAppIdUri',
                      navigateToLoginRequestUrl: false
                  };

Example:

var azureAdConfig = {
                clientId: '01192687-18ab-4bd2-8dc2-0c071c72b695',
                tenant: 'genericodev.onmicrosoft.com',
                webApiResourceUri: 'https://genericodev.onmicrosoft.com/connectWebApi',
                navigateToLoginRequestUrl: false
            };

5. Save the changes to the file.

4.1. Connect Runtime requirement

During the AAD sign-in process, the Agents will have to log into the Connect Admin Console using their respective UPNs (username@domain.com). It is mandatory that Agents' Login Name is in a UPN format.

Note: Without the UPN formatted Login Name, Agents will not be able to use the AAD Authentication.