How to add Aure AD to Sophos Firewall

Hi Viet Ton,

Thank you for reaching out to Sophos Community.

Kindly check the following for reference, which might assist you.

• Sophos Firewall: Integrate Sophos Firewall with Azure AD
• Sophos Firewall v19.5: Single Sign On (SSO) in Azure AD
• Add a Microsoft Entra ID (Azure AD) server

Hi Viet Ton,

Thank you for reaching out to Sophos Community.

Kindly check the following for reference, which might assist you.

• Sophos Firewall: Integrate Sophos Firewall with Azure AD
• Sophos Firewall v19.5: Single Sign On (SSO) in Azure AD
• Add a Microsoft Entra ID (Azure AD) server

Hi Erick,

Thanks for your replied,

I tried to do with Integrate Sophos Firewall with Azure AD, but I don't how to do at step below

• To create the Certificate Authority Private Key and Certificate, you first need to create a private key for the CA with the name azureADca.key.
  
  $ openssl genrsa -out azureADca.key 4096
  Generating RSA private key, 4096 bit long modulus
  ..........................................................................................................................................................++
  ................++
  e is 65537 (0x10001)
  
  
• Create the CA certificate to be used to validate signed certificates, called azureADca.pem.
  
  $ openssl req -x509 -new -nodes -key azureADca.key -days 3650 -out azureADca.pem
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) []:CA
  State or Province Name (full name) []:ON
  Locality Name (eg, city) []:Burlington
  Organization Name (eg, company) []:<Your org>
  Organizational Unit Name (eg, section) []:Salesengineering
  Common Name (eg, fully qualified host name) []:<Commaon name>
  Email Address []:email@email.com
  
  
• Create a text file and copy/paste the below text. Save the file as “azureAD-eku.conf” or any name you choose.
  
  [client_server_ssl]
  extendedKeyUsage = serverAuth
  
  
• Now that this file exists, you must generate a private key for the LDAP cert with the name “ldapssl_private.key”.
  
  $ openssl genrsa -out ldapssl_private.key 4096
  Generating RSA private key, 4096 bit long modulus
  ...................................++
  ..........++
  e is 65537 (0x10001)
  
  
• Next, create a certificate signing request to sign with the CA you previously created with the name “azureADldapssl.csr” and fill in the following values in yellow.
  

  $ openssl req -new -key ldapssl_private.key -out azureADldapssl.csr
  You are about to be asked to enter information that will be incorporated
  into your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank
  For some fields there will be a default value,
  If you enter '.', the field will be left blank.
  -----
  Country Name (2 letter code) []:CA
  State or Province Name (full name) []:ON
  Locality Name (eg, city) []:Burlington
  Organization Name (eg, company) []:firewallinabox
  Organizational Unit Name (eg, section) []:Sales Engineering
  Common Name (eg, fully qualified host name) []:<yourdomainname>
  Email Address []:<email@email.com>

  Please enter the following 'extra' attributes
  to be sent with your certificate request
  A challenge password []:<Password>
  
  

• You now need to sign the request, while including the signing extensions created earlier. The following command will create the signed cert named “azureADcert.crt”.
  
  $ openssl x509 -req -extensions client_server_ssl -extfile azureAD-eku.conf -in azureADldapssl.csr -CA azureADca.pem -CAkey azureADca.key -CAcreateserial -out azureADcert.crt -days 365
  Signature ok
  subject=/C=CA/ST=ON/L=Burlington/O=firewallinabox/OU=Sales Engineering/CN=firewallinabox.tk/emailAddress=email@email.com
  Getting CA Private Key
  $
  
  

• Convert the certificate into PFX format, as Azure accepts the certs in the PFX format.
  
  $ openssl pkcs12 -export -out SophosazureADcert.pfx -inkey ldapssl_private.key -in azureADcert.crt -certfile azureADca.crt
  Enter Export Password:
  Verifying - Enter Export Password:

  Could you please shown me more.Thanks youViet Ton