PROJECT SEMESTER REPORT

Framework For Defining Organization Partnership

Using Azure Active Directory

by

Raghav Chadha
Roll No. 101853034

Under the Guidance of

Mr. Kamal Bana, SDE-2, Amadeus

Dr Sangita Roy, Assistant Professor

Thapar Institute of Engineering and Technology, Patiala

Submitted to the

Computer Science & Engineering Department

Thapar Institute of Engineering & Technology, Patiala

In Partial Fulfilment of the Requirements for the Degree of

Bachelor of Engineering in Computer Engineering
at
Thapar Institute of Engineering & Technology, Patiala
June 2022

The author hereby grants to Thapar Institute of Engineering & Technology, permission to reproduce
and to distribute publicly paper and electronic copies of this report document in whole and in part in
any medium now known or here after created.
Framework for Defining Organization Partnership Using Azure Active Directory

by Raghav Chadha

Place of work: Amadeus Labs, Bangalore

Submitted to the Computer Science & Engineering Department, Thapar Institute of Engineering &
Technology

June 2022

In Partial Fulfilment of the Requirements for the Degree of Bachelor of Engineering in Computer
Engineering.

Abstract:
In this project we have to develop a proof of concept using Azure Active Directory APIs to
define Organization security model, partnerships between organizations, delegating roles
inside and across Organizations so they can share resources between Organizations.
Microsoft Azure Active directory is a cloud identity and access management solution that
combines users and app access management. It also provides authorization services for
application so that only restricted users have access to resource. Familiarization with Azure
Active Directory tool and how cloud security [Link] is Microsoft Azure Cloud and how
we can use different tools to integrate it with our organization in order to implement the
security. How to define an organization in Azure Active directory, how to create different
users and how to invite users. Learning about how to create different groups on Azure Active
directory and how to add members in the groups. Learning about how to define an
organization in Azure Active directory and how to create an organization structure using the
API .Creating different groups and adding users into the groups and learning about how to
create nested groups in an organization on Azure Active Directory. Learning about what are
roles in Azure Active Directory and how to assign roles to members in an
[Link] about how to create custom roles in an organization according to our
needs and how to add members directly to the groups without adding them manually using
the concept of dynamic [Link] about how partnerships works in Azure Active
directory and how to create a partnership between two organization and how defining the
organization structures on the Azure Active [Link] of an application using react
which shows proper working of authorization of a user and secured sign in using Azure.
Developing the react application further by adding different app roles. Learning about how to
add app roles in the react application so that people with different app roles have limited
access to only that part of the application which they are assigned access to using Azure
Active directory. Registering our application on Azure Active directory is also [Link]
app roles and adding more app roles in our application. Defining app roles and coding the app
roles part in react and also creation of app roles on the Azure Active Directory. Assigning
different members of the organization to the different app roles using the Azure Active
[Link] enhancing our application to multi-tenant application so that now users
from different organizations has also access to the application and all identity and access
management part is defined in Azure Active directory by giving access to the application to
different users from organizations whose partnership is defined on Azure Active directory.
Now our application is also accessible to users from partner organizations which are using
our [Link] adding more features to our react application so that users from other
organization cannot see data of user from other tenants so that their is no leak of information
and it will enhance the security of our project. Now users data is only visible to admins of
their tenant which are assigned this app role. This will increase security of our application.

Author : Raghav Chadha .

Certified by: Mr Kamal Bana( SDE-2 Amadeus)

Certified by: DR Sangita Roy ( Faculty Mentor)

CERTIFICATE (PROJECT SEMESTER TRAINING) FROM THE COMPANY OR

THE ORGANIZATION
TABLE OF CONTENT

Contents

[Link] Profile…………………………………………………………………………………………………………………………1

2 Introduction……………………………………………………………………………………………………………………………….2

3 Background………………………………………………………………………………………………………………………………..5

4. Objective…………………………………………………………………………………………………………………………………..7

5 Methodology……………………………………………………………………………………………………………………………..8

6 Observations and findings…………………………………………………………………………………………………………10

6.1 Introduction to Azure Active Directory and cloud platforms………………………………………………10

6.2 Learning Azure Active Directory basics i.e creating users,groups and defining roles…………..11

6.3 Defining Partnership between different Organization Structures……………………………………….12

6.4 Creating App roles for different users………………………………………………………………………………..12

6.5 Creating Application which shows Authentication and authorization in Azure…………………..13

7. Limitations………………………………………………………………………………………………………………………………18

8. Conclusions and Future Work………………………………………………………………………………………………….19

9. Refrences…………………………………………………………………………………………………………………………………20
 1. Company Profile

The company is structured around two areas: its global distribution system and its
Information Technology business. Amadeus provides search, pricing, booking, ticketing and
other processing services in real-time to travel providers and travel agencies through its
Amadeus CRS distribution business area. It also offers computer software that automates
processes such as reservations, inventory management software and departure control
systems. It services customers including airlines, hotels, tour operators, insurers, car rental
and railway companies, ferry and cruise lines, travel agencies and individual travellers
directly. Amadeus processed 945 million billable travel transactions in [Link] parent
company of Amadeus IT Group, holding over 99.7% of the firm, is Amadeus IT Holding
S.A. It was listed on the Spanish stock exchanges on 29 April 2010.
Amadeus has central sites in Madrid, Spain (corporate headquarters and marketing), Sophia
Antipolis, France (product development), London, UK (product development), Breda,
Netherlands (development), Erding, Germany (Data center) and Bangalore, India (product
development) as well as regional offices in Boston, Bangkok, Buenos Aires, Dubai, Miami,
Istanbul, Singapore, and Sydney.[5][6] At market level, Amadeus maintains customer
operations through 173 local Amadeus Commercial Organisations (ACOs) covering 195
countries. The Amadeus group employs 14,200 employees worldwide, and listed in Forbes'
list of "The World's Largest Public Companies" as No. 985.

Amadeus Software Labs India was established by the Amadeus IT Group in 2008 in
Bangalore under Ness Technologies. In July 2012, the company dissociated itself from Ness
and established its own development centre which is located here in Prestige Technology
Park. Working on cutting edge technologies for travel partners worldwide, it is the second
largest development centre for Amadeus worldwide.

1
 2. Introduction

In this project we have to develop a proof of concept using Azure Active Directory APIs to
define Organization security model, partnerships between organizations, delegating roles
inside and across Organizations so they can share resources between Organizations.
Microsoft Azure Active directory is a cloud identity and access management solution that
combines users and app access management. It also provides authorization services for
application so that only restricted users have access to resource.

I am currently working in the QSD team as SDE intern. We are working on developing a
framework using Azure Active Directory APIs to define Organization security model,
partnership between organizations, delegating roles inside and across Organizations. Today
Security Administration Framework only support LSS Security Model. This security
administrative framework will provide security completely based on Azure Services. This
framework will be used to define partnership between organizations using Azure Security
Services.

The problem will be solved using Azure Security Services. I will be working on Azure Active
Directory APIs for creating different organizations, further defining the Organization
structure for the 2-partnership Organization using Azure Active Directory. I will be working
on creating different custom roles in an Organization in order to access the restricted
resources which are needed thus enhancing security by giving limited access to only
resources which are required by user, further delegating the roles of one Organization to
group under second Organization thus developing a framework around Azure Active
Directory services for defining cross-organization partnership so that they can share resources
and applications by giving limited access to only users which require the resource in both
Organizations.
The main objective is to develop a framework using Azure Security Services and identifying
Azure Active Directory APIs for creating organizations. Defining 2 organizations with
different levels of Organization tree i.e. users, applications, groups. Creating roles and
permissions in both Organizations to access resources of both organizations by creating
partnership between Organizations and giving access to only restricted users thus enhancing
security.

2
Microsoft Azure

Microsoft Azure Microsoft Azure, formerly known as Windows Azure, is Microsoft's public
cloud computing platform. It provides a range of cloud services, including compute,
analytics, storage and networking. Users can pick and choose from these services to develop
and scale new applications, or run existing applications in the public cloud. Once customers
subscribe to Azure, they have access to all the services included in the Azure portal.
Subscribers can use these services to create cloud-based resources, such as virtual machines
(VM) and databases.

Azure Active Directory

Azure Active Directory Microsoft Azure Active directory is a cloud identity and access
management solution that combines users and app access management. It also provides
authorization services for application so that only restricted users have access to resource.
Azure Active Directory also helps them access internal resources like apps on your corporate
intranet network, along with any cloud apps developed for your own organization.

Cloud Computing

Cloud Computing Cloud computing is a technology that uses the internet for storing and
managing data on remote servers and then access data via the internet. This type of system
allows users to work on the remote. Cloud computing customers do not own the physical
infrastructure; they rent the usage from a third-party provider. They are a cost-effective
solution for enterprises.

3
Partnership Between Organizations in Azure

Fig 2.1 Partnership between external Organizations

Azure Active Directory (Azure AD) B2B collaboration is a feature within External Identities
that lets you invite guest users to collaborate with your organization. With B2B collaboration,
you can securely share your company's applications and services with external users, while
maintaining control over your own corporate data. Work safely and securely with external
partners, large or small, even if they don't have Azure AD or an IT department.
A simple invitation and redemption process lets partners use their own credentials to access
your company's resources. You can also enable self-service sign-up user flows to let external
users sign up for apps or resources themselves. Once the external user has redeemed their
invitation or completed sign-up, they're represented in your directory as a user object. B2B
collaboration user objects are typically given a user type of "guest" and can be identified by
the #EXT# extension in their user’s principal name.

4
 3. Background

High level functional description

Today Security Administration Framework support only LSS Security Model. POC is to
explore the possibility on providing security administrative framework completely based on
Azure Services .To explore and come up with an organization tree definition closer to LSS
Security Model in Azure.

Fig 3.1 Initiating Partnership between two partner organizations.

5
A Framework to define Partnership between Organizations using Azure Security Services.
Once the framework using Azure is defined, we can extend if we can provide cross
framework services to define security models for Organizations based on their choice and do
business with each other.

Fig 3.2 Organizational Structure Tree

Benefits
 Developing a wrapper around Azure Active Directory services for defining cross-
organization partnership.
 Extending the portfolio of Security Identity Services of Amadeus.

6
 4. Objectives

Key Milestones

 Identifying Azure Active Directory APIs for creating Organizations.

 Defining 2 Organizations with different levels of Organization tree i.e. users, groups
and applications.
 Learning Azure Active Directory basics i.e. creating users, assigning roles.
 Creating Roles and permissions in both Organizations.
 Delegating Roles of one Organization to group under second organization.
 Validating Access delegation between Organizations which are having a partnership.
 Building an application which shows organization partnership and access
management using cloud platforms.
 Providing cross framework services to define security models for Organizations based
on their choice and do business with each other.

This proof-of-concept aids in extending the portfolio of Security Identity Services of

Amadeus.
This helps in generating revenue of Amadeus by doing partnership with Organizations that
use cloud platforms for identity and access management.

7
 5. Methodology

The main objective is to develop a framework using Azure Security Services and identifying
Azure Active Directory APIs for creating organizations. Defining 2 organizations with
different levels of Organization tree i.e. users, applications, groups. Creating roles and
permissions in both Organizations to access resources of both organizations by creating
partnership between Organizations and giving access to only restricted users thus enhancing
security. Creating an application which shows all the identity and access management using
the cloud services of Azure and how partnership works and security is maintained between
access of resources of different users of partner organization.

Steps followed in project planning and design process are as follow:-

Step 1: Pre-Planning
Firstly, the need for the project is evaluated. Our organization needs research in the part of
security on the basis of cloud platform. There is no security model defined which include
partnership on the basis of cloud platform. So there is a need to develop the project based on
building partnership with organizations which support identity and access management based
on cloud platforms like Microsoft Azure.

Step 2: Discovery
After the brainstorming sessions and discussions on how to implement we discovered cloud
service provided by Microsoft Azure i.e Azure Active Directory. It is a cloud tool which
helps in identity and access management for our SaaS application so that we can register
users on this platform and give access to the users to our application and all the authentication
and access management is done using Azure Active Directory. We also discovered about api
we use to create organization structure and how to provide different hierarchal roles to
different users in an organization.

8
Step 3: Develop and Design
After the selection of platform and all the design of organization structure is completed we
planned on how to develop a structure and how to implement this part by building an
application using the front end technologies and we also created the design of organization
structure which should be created in Azure Active Directory. The common tasks including
coding and testing and all security checks were done during this process.

Fig 5.1 Organization Structure build in Azure Active Directory

9
 6. Observations and Findings

The different findings and observations done in our project are as follows: -
 Introduction to Azure Active Directory and Cloud platforms in security and overview
of Azure basics.
 Learning Azure Active Directory basics i.e. creating users, groups and defining roles.
 Defining Partnership between different Organization structures.
 Creating App Roles for different users.
 Creating Application which shows authentication and authorization in Azure.

6.1 Introduction to Azure Active Directory and Cloud platforms in

security and overview of Azure basics.

Azure Active Directory is an identity and access management tool which provides
authentication services for the application and also provide access management for
different users. It also allows us to create different users and groups which will make to
define an organization structure on the Azure Active Directory.
In this picture we can see different users which are registered on the Azure Active
Directory portal. Users which are created are shown here and which are invited can be
seen here.

fig 6.1 Users defined in Azure Active Directory

10
6.2 Learning Azure Active Directory basics i.e. creating users, groups and
defining roles.

As here we can see different groups are created and organization is defined using the concept
of groups. Different groups are nested and a structure of an organization is defined [Link]
group has users in it as there are different departments in an organization. So each department
is treated as a group and all the members of that department are treated as users.

fig 6.2 Groups created in Azure Active Directory showing Organization Structure.

11
6.3 Defining Partnership between different Organization structures.

Defining partnership between different organizations in Azure Active directory. Different

users are invited in our tenant from other partner organizations by invitation. Now we can
give them access to our application and we can now assign them different roles.

Fig 6.3 Users from partner organizations are added in our tenant

6.4 Creating App Roles for different users

Now here we can see that we have created different app roles for our application and we can
assign them these app roles to users from partner organization. Here we can see two app roles
i.e task user and task admin. Users assign task admin has an admin role and can see the
dashboard in application and users assigned task user role can see only se the to do list. They
don’t have access to the dashboard and cannot see what other users have written in their to do
list.

12
 Fig 6.4 App roles are created on Azure Active Directory.

6.5 Creating Application which shows authentication and authorization in

Azure.

We have created an application using the react library. The msal-react library is used for
integrating app roles in our application. The app roles are created in react application and
they are integrated with app roles defined on the azure active directory. The users are
assigned app roles on the Azure Active Directory and the data of users are conveyed to the
application using Microsoft Graph API. Then the authentication part is implemented using
Azure Active Directory using the OpenID connect protocol.

13
 Fig 6.5 Login Page of the application.

After opening the application we can see this portal. Here we can see sign-in button. After
clicking on sign-in button we are redirected to the authentication page of Azure Active
Directory. Now it will authenticate user using OpenID connect. Now application will call
Microsoft Graph API to gather information of user, whether they are part of the directory or
not, which app role they are assigned. Then it will authenticate them based on their user id
and give access to the application.

14
 Fig 6.6 User with AppUser role sign in

Here now user with App User role tried to sign in now it will get redirected to Microsoft
authentication. Now it will send code to them and the user is authenticated if it is a part of the
directory. Now the user is authenticated. It will have access to Todolist. User can update or
delete or insert the tasks in Todolist.

15
 Fig 6.7 User with AppUser role sees the todolist tab.

Now this user has App user role as it is not an admin so he doesn’t have access to Dashboard
which can only be seen by users which are assigned this app role on Azure Active Directory.

Fig 6.8 User with AppUser role cannot see the dashboard.
16
Now the user with AppAdmin role tried to login to the application. Now it will send code to
them and the user is authenticated if it is a part of the directory. Now the user is
authenticated. It will have access to Todolist. User can update or delete or insert the tasks in
Todolist. Now the user with AppAdmin role has access to the dashboard.

Fig 6.9 User with AppAdmin role tries to login

Now admin has access to the dashboard. He can see what other users from his tenant has
updated in the TodoList. The admin user has access to the dashboard because it has
AppAdmin role and this shows the implementation of App roles in Azure Active Directory
and further increasing the security and showing the implementation of partnerships between
different organizations.

17
Fig 6.10 User with AppAdmin role can see the dashboard and other users updates in
todolist.

7. Limitations

 The resources for development in Azure Cloud is limited. There is need of vast
research in this field regarding Identity and Access management based on Cloud.
 Azure Active Directory requires premium subscription and so it increase the overall
cost of implementing the project.
 Without Azure P2 Premium subscription we cannot add users from partner
organization directly into groups. So it is a blocker for implementation when there are
users in bulk.
 Experiments in delegating roles between Organizations in Azure Active Directory.
 Delegating roles and ensuring the security threats in Azure Active Directory while
implementing partnerships between different Organizations.
 Security aspects of the application needs to be further enhanced as users from other
tenant can see what data is entered by users from other organization which is a
blocker and it will hinder privacy of other users.
18
 8. Conclusions and Future Work

The main aim of the project was to develop and create a proof of concept so that we can
enhance the security model to the cloud. Currently LSS security model is being followed but
now every organization is moving to cloud so there is a need to implement the identity and
access management on cloud platforms. The main reason for shifting the identity and access
management to cloud is to increase the business of our organizations so that they can
maintain partnerships with the Organizations that uses cloud platforms for identity and access
management. So, it increases the business for our Organizations and now our organization
has more clients and they can now collaborate with more Organizations and increase their
business by providing access of our SaaS application to different Organizations and handling
all the identity and access management on the cloud by using Azure Active Directory.
The future scope of this project is to develop the whole application and deploying in to cloud
by adding more app roles for different kind of users in a partner organization. We can further
extend it to more cloud platforms as of now we have implemented in only on Microsoft
Azure. We can extend it to different cloud platforms like AWS and GCP cloud so that we can
provide services of our SaaS applications on all cloud platforms.

19
 9. References

[1][Link]

[2] [Link]

[3] [Link]

[4] [Link]

[5] [Link]

[6][Link]
tenant-apps

[7][Link]
azure-ad-apps

[8] [Link]

[9] [Link]

[10][Link]
whatis

[11] [Link]

20