Setting up Entra ID authentication in Factry Historian
Requirements
Before starting, make sure you have completed the App registration process. You can find the full instructions here: Registering an App in Entra ID.
You will need:
- Tenant ID – The unique identifier for your Entra ID tenant.
- Client ID – The application’s identifier created during app registration.
- Client Secret – The secret generated for the application in Entra ID.
Configure authentication provider
- In Factry Historian, go to: Configuration > Server Settings > Authentication providers.
- Click Create provider.
- Fill in:
- Name – A friendly name for the authentication provider. This must be the exact name used as <My-AUTH-PROVIDER> as part of the callback URL when registering the app in Entra ID.
- Tenant ID – Your Entra ID tenant’s unique ID.
- Client ID – The app’s unique ID from Azure.
- Client Secret – The secret corresponding to the client ID.
- Don't enable group mapping in this section (allows Azure groups to map to Factry Historian user groups). To configure this, see Configure group mapping.
- Decide whether security groups or app roles are used to determine the Entra ID groups which the user is added to by setting the Group mapping type:
- For security groups: select Security groups
- For app roles: select App roles
- Click Save & test to verify the configuration.
Configure group mapping
Enable group mapping to automatically map user groups defined in Azure to user groups defined in Factry Historian, granting the according privileges to the users present in the Azure groups.
When group mapping is enabled on the authentication provider, a user in Factry Historian can not be manually configured into a user group, since on each login the user will be linked to the user groups matching the authentication provider. To manually assign users to groups in Factry Historian, skip this section.
- In Factry Historian, go to Configuration > Server Settings > Authentication providers and select the configured Entra ID authentication provider to enable group mapping for it.
- In Entra ID, find the Object IDs of the security groups or app roles you want to use. These can be found in the group overview.
Copy the Object ID (and not the Name of the group) to paste in the Factry Historian user group mapping.
- In Factry Historian, go to Configuration > Groups and click the edit icon of the user group that you want to map to an Entra ID group.
- In the Manage user group screen, Click + Create user group mapping. Enter the Entra ID group Object ID (not the name) from Step 1 in the Name field in Factry Historian. Select the Entra ID Authentication provider e.g. Microsoft from the dropdown menu.
- Click Submit.
On saving a user group mapping, all the users in the Entra ID group matching the given Object ID will be granted the permissions of the mapped Factry Historian user group. This will automatically assign users to the correct groups when they log in into Factry Historian.
We recommend to continue by configuring a user group mapping for each user group in Factry Historian: Administrators, Managers and Readers.
Test authentication and group mapping
To test Entra ID authentication and group mapping in Factry Historian:
- Log out of Factry Historian.
- Select the Entra ID authentication provider in the login screen and log in using your Entra ID account.
- Verify:
- If login succeeds without errors.
- If the correct user groups and permissions are applied (if group mapping was enabled).
When successfully logging in with an Entra ID user in Factry Historian, the user will be automatically created in Factry Historian (if it does not exist yet).
Trouble logging in? See Entra ID authentication provider troubleshooting and/or Entra ID app registration troubleshooting and look for your error.