Relock with EntraID

It is a companion to the Relock Integration Guide, which describes the architecture, the relay, and the NGINX/Lua deployment that are the same for every provider. Read that guide first — or alongside this one — and return here for the Entra specifics.

Replace app.example.com throughout with the domain your application is served from (the domain the Relock relay sits in front of).

What Relock needs from Entra. The relay derives its session anchor from the unique_name and sid claims in the access token the ALB injects. Entra exposes both by default, so no custom action or claim mapping is required — the two steps below are the whole configuration.

---

Step 1 — Redirect URI

In the Entra admin center: App registrations → your application → Authentication → Redirect URI configuration (platform: Web).

Step 2 — Front-channel logout URL

In App registrations → your application → Authentication → Settings:

The front-channel logout URL is what lets termination cascade through Entra to the SSO session (see Q2 in the main guide). Without it, a terminated session can silently respawn on the next request.

Step 3 — AWS Application Load Balancer

On the HTTPS (443) listener → Rules → Default rule, add an authenticate-oidc action ahead of the forward action (the mechanics are described in §5.2 of the main guide). Populate it with Entra's OIDC endpoints and the client credentials from your app registration.

Pull the exact endpoint values from Entra's discovery document — https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration. The typical pattern:

Do not add an audience extra parameter. Entra returns a decodable JWT access token by default, which is what the relay reads to derive the anchor. Ensure the access token reaching the ALB carries the unique_name and sid claims the relay matches on. (The audience parameter is the one field that differs from the Auth0 setup, where it is required.)

The ALB now sets its session cookie and injects x-amzn-oidc-accesstoken (plus x-amzn-oidc-data and x-amzn-oidc-identity) into requests reaching the NGINX target.

---

With Entra and the ALB configured, deploy the relay as described in the Relock Integration Guide → §5.2 The relay. No application code changes are required.