Documentation

Boundary

Set up OIDC authentication for HashiCorp Boundary using Microsoft Entra ID as the identity provider.

Before you start

RequirementDetail
Entra ID accessAdministrator on portal.azure.com
Boundary accessAccess to the Boundary Admin Console with rights to create auth methods
Boundary addressYour Boundary controller address, referred to below as %BOUNDARY_ADDR%

Three values are produced in Part 1 and consumed in Part 2: the client secret value, the application (client) ID, and the issuer URL.

Part 1: Entra ID configuration

1.1 Create the application

  1. Log in to https://portal.azure.com as an administrator.
  2. Select Enterprise applications from the sidebar, or search for it.
  3. Click + New application.
  4. Type hashicorp boundary in the search bar and select the HashiCorp Boundary result.
  5. Confirm the name of your Boundary integration and click Create.
  6. Click Single sign-on in the left menu, then Go to application.

1.2 Configure authentication

  1. Click Authentication under the Manage sidebar.
  2. In the Web section, set the Redirect URI to your Boundary address followed by the callback path: https://%BOUNDARY_ADDR%/v1/auth-methods/oidc:authenticate:callback
  3. In the Front-channel logout URL, append :3000 to your Boundary URL: https://%BOUNDARY_ADDR%:3000
  4. Click Save.

1.3 Create the client secret

  1. Select Certificates & Secrets from the Manage sidebar.
  2. Click New client secret, fill out the description and expiry, and click Add.
  3. Copy the client Secret value and store it somewhere accessible.

1.4 Collect the application ID

  1. Return to the Overview view using the left menu.
  2. Copy the Application (client) ID.

1.5 Collect the issuer URL

  1. On the Overview page, click Endpoints.
  2. Copy the OpenID Connect metadata document value, up to and including /v2.0. Discard the .well-known/openid-configuration suffix.

The result follows the pattern https://login.microsoftonline.com/%TENANT_ID%/v2.0

Part 2: Boundary controller configuration

2.1 Create the auth method

  1. Log in to the Boundary Admin Console and navigate to Auth Methods.
  2. Select New and click OIDC.
  3. Fill out the fields:
FieldValue
NameFor example, Azure
DescriptionOptional, for example Azure OIDC auth method
IssuerThe issuer URL from 1.5
Client IDThe Application (client) ID from 1.4
Client SecretThe secret value from 1.3
Signing AlgorithmSet to RS256, then click Add
API URL PrefixYour Boundary URL, for example https://%BOUNDARY_ADDR%
  1. Click Save.

2.2 Activate the auth method

  1. Under the settings for the new auth method, open the state menu in the upper right of the page. It will read Inactive.
  2. Change the state to Public.

Troubleshooting

SymptomCheck
Authentication redirects but fails at callbackThe redirect URI in Entra ID does not exactly match the callback path
Client secret rejectedSecret ID copied instead of Secret value (1.3)
Issuer rejectedThe metadata URL was copied in full. Trim it at /v2.0.
Auth method not offered at sign-inThe auth method is still Inactive or Private. Set it to Public (2.2).
Logout does not clear the sessionFront-channel logout URL missing the :3000 suffix

For anything not covered here, contact the SURF support team.