How to setup LaunchDarkly custom roles from Azure AD Security Groups

Affected: Azure SSO

Overview

If you have SSO enabled, you can assign custom roles from within the LaunchDarkly dashboard or from Azure Active Directory (AD) Security Groups.

Solution

Configure Azure AD Groups for LaunchDarkly. Before you begin, complete the following:

• Enable Azure AD integration with LaunchDarkly: Configure Azure AD SSO
• Create the custom roles that the LaunchDarkly Enterprise Application will use: Custom roles

1. Create LaunchDarkly AD Groups and assign members in Azure.

1. Create a new AD Group by going to Azure Active Directory > Groups > New group.

2. Assign members to the Group by clicking the No members selected link to open the "Add members" dialog.

   1. Select the user(s) you want to include in the group and click Select when done.

   2. Click Create to create the group.

2. Create roles for LaunchDarkly Enterprise Application in Azure AD.

1. Open the LaunchDarkly Enterprise Application and go to Azure Active Directory > Enterprise Application > All applications > LaunchDarkly.

2. To add the LaunchDarkly AD Group, go to Users and groups > Add user/group.

   1. Assign the LaunchDarkly Group to the application.

   2. Assign a role. 

3. Click Single sign-on.

4. Update LaunchDarkly Enterprise Application “SSO User Attributes & Claims” to start sending custom roles.

1. Click User Attributes & claims.

2. Enter or select the following values in the “Manage claim” form.

   1. Name: customRole

   2. Namespace: [leave blank]

   3. Source: Attribute

   4. Source attribute: user.assignedroles

3. Click Save.

   1. To test, you can click on the Test button.

   2. If your test is successful, you will be logged in as the user.

      Example:

Resources

• Configure Azure AD SSO