[{"data":1,"prerenderedAt":1351},["ShallowReactive",2],{"docs-navigation":3,"doc-\u002Fteam\u002Fsso-entra":434},[4,22,104,157,194,211,224,265,302,335,364,380,397,414],{"title":5,"path":6,"stem":7,"children":8,"page":21},"Erste Schritte","\u002Fgetting-started","01.getting-started",[9,13,17],{"title":10,"path":11,"stem":12},"Was ist LIVCK Cloud?","\u002Fgetting-started\u002Fwhat-is-livck","01.getting-started\u002F01.what-is-livck",{"title":14,"path":15,"stem":16},"Schnellstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart",{"title":18,"path":19,"stem":20},"Das Dashboard","\u002Fgetting-started\u002Fdashboard","01.getting-started\u002F03.dashboard",false,{"title":23,"path":24,"stem":25,"children":26,"page":21},"Monitoring","\u002Fmonitoring","02.monitoring",[27,31,64,68,72,76,80,84,88,92,96,100],{"title":28,"path":29,"stem":30},"Services verwalten","\u002Fmonitoring\u002Fservices","02.monitoring\u002F01.services",{"title":32,"path":33,"stem":34,"children":35,"page":21},"Check-Typen","\u002Fmonitoring\u002Fchecks","02.monitoring\u002F02.checks",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"HTTP\u002FHTTPS-Checks","\u002Fmonitoring\u002Fchecks\u002Fhttp","02.monitoring\u002F02.checks\u002F01.http",{"title":41,"path":42,"stem":43},"TCP-Port-Checks","\u002Fmonitoring\u002Fchecks\u002Ftcp","02.monitoring\u002F02.checks\u002F02.tcp",{"title":45,"path":46,"stem":47},"DNS-Checks","\u002Fmonitoring\u002Fchecks\u002Fdns","02.monitoring\u002F02.checks\u002F03.dns",{"title":49,"path":50,"stem":51},"Ping-Checks (ICMP)","\u002Fmonitoring\u002Fchecks\u002Ficmp","02.monitoring\u002F02.checks\u002F04.icmp",{"title":53,"path":54,"stem":55},"SSL-Zertifikat-Checks","\u002Fmonitoring\u002Fchecks\u002Fssl","02.monitoring\u002F02.checks\u002F05.ssl",{"title":57,"path":58,"stem":59},"Heartbeat-Checks (Push-Monitoring)","\u002Fmonitoring\u002Fchecks\u002Fheartbeat","02.monitoring\u002F02.checks\u002F06.heartbeat",{"title":61,"path":62,"stem":63},"Manuelle Services","\u002Fmonitoring\u002Fchecks\u002Fmanual","02.monitoring\u002F02.checks\u002F07.manual",{"title":65,"path":66,"stem":67},"Check-Einstellungen","\u002Fmonitoring\u002Fcheck-settings","02.monitoring\u002F03.check-settings",{"title":69,"path":70,"stem":71},"Bedingungen","\u002Fmonitoring\u002Fconditions","02.monitoring\u002F04.conditions",{"title":73,"path":74,"stem":75},"Monitoring-Standorte","\u002Fmonitoring\u002Flocations","02.monitoring\u002F05.locations",{"title":77,"path":78,"stem":79},"Service-Detailseite","\u002Fmonitoring\u002Fservice-detail","02.monitoring\u002F06.service-detail",{"title":81,"path":82,"stem":83},"Artifacts","\u002Fmonitoring\u002Fartifacts","02.monitoring\u002F07.artifacts",{"title":85,"path":86,"stem":87},"Status überschreiben","\u002Fmonitoring\u002Fstatus-override","02.monitoring\u002F08.status-override",{"title":89,"path":90,"stem":91},"Eigene Zertifikate (mTLS & private CAs)","\u002Fmonitoring\u002Fcertificates","02.monitoring\u002F09.certificates",{"title":93,"path":94,"stem":95},"Tags","\u002Fmonitoring\u002Ftags","02.monitoring\u002F10.tags",{"title":97,"path":98,"stem":99},"Sync-Quellen","\u002Fmonitoring\u002Fsync-sources","02.monitoring\u002F11.sync-sources",{"title":101,"path":102,"stem":103},"CDN & WAF-Integration","\u002Fmonitoring\u002Fcdn-waf-integration","02.monitoring\u002F12.cdn-waf-integration",{"title":105,"path":106,"stem":107,"children":108,"page":21},"Server-Monitoring","\u002Fserver-monitoring","03.server-monitoring",[109,113,117,121,125,129,133,137,141,145,149,153],{"title":110,"path":111,"stem":112},"Überblick","\u002Fserver-monitoring\u002Foverview","03.server-monitoring\u002F01.overview",{"title":114,"path":115,"stem":116},"Agent installieren","\u002Fserver-monitoring\u002Finstallation","03.server-monitoring\u002F02.installation",{"title":118,"path":119,"stem":120},"Sicherheit & Transparenz","\u002Fserver-monitoring\u002Fsecurity","03.server-monitoring\u002F03.security",{"title":122,"path":123,"stem":124},"Was gemessen wird","\u002Fserver-monitoring\u002Fmetrics","03.server-monitoring\u002F04.metrics",{"title":126,"path":127,"stem":128},"Serverliste & Detailansicht","\u002Fserver-monitoring\u002Fservers","03.server-monitoring\u002F05.servers",{"title":130,"path":131,"stem":132},"Alarm-Regeln","\u002Fserver-monitoring\u002Falert-rules","03.server-monitoring\u002F06.alert-rules",{"title":134,"path":135,"stem":136},"Ereignisse & Benachrichtigungen","\u002Fserver-monitoring\u002Fevents","03.server-monitoring\u002F07.events",{"title":138,"path":139,"stem":140},"Erreichbarkeits-Prüfungen","\u002Fserver-monitoring\u002Freachability","03.server-monitoring\u002F08.reachability",{"title":142,"path":143,"stem":144},"Agent-Updates","\u002Fserver-monitoring\u002Fupdates","03.server-monitoring\u002F09.updates",{"title":146,"path":147,"stem":148},"Auf der Statuspage zeigen","\u002Fserver-monitoring\u002Fstatuspage","03.server-monitoring\u002F10.statuspage",{"title":150,"path":151,"stem":152},"Grenzen & Pläne","\u002Fserver-monitoring\u002Flimits","03.server-monitoring\u002F11.limits",{"title":154,"path":155,"stem":156},"Fehlerbehebung","\u002Fserver-monitoring\u002Ftroubleshooting","03.server-monitoring\u002F12.troubleshooting",{"title":158,"path":159,"stem":160,"children":161,"page":21},"Incidents","\u002Fincidents","04.incidents",[162,166,170,174,178,182,186,190],{"title":163,"path":164,"stem":165},"Incidents verstehen","\u002Fincidents\u002Foverview","04.incidents\u002F01.overview",{"title":167,"path":168,"stem":169},"Incident erstellen","\u002Fincidents\u002Fcreate-incident","04.incidents\u002F02.create-incident",{"title":171,"path":172,"stem":173},"Incident verwalten","\u002Fincidents\u002Fmanage-incident","04.incidents\u002F03.manage-incident",{"title":175,"path":176,"stem":177},"Automatische Erkennung","\u002Fincidents\u002Fauto-detection","04.incidents\u002F04.auto-detection",{"title":179,"path":180,"stem":181},"Interne Kommentare","\u002Fincidents\u002Fincident-comments","04.incidents\u002F05.incident-comments",{"title":183,"path":184,"stem":185},"Postmortems","\u002Fincidents\u002Fpostmortems","04.incidents\u002F06.postmortems",{"title":187,"path":188,"stem":189},"Incident-Richtlinien","\u002Fincidents\u002Fincident-policies","04.incidents\u002F07.incident-policies",{"title":191,"path":192,"stem":193},"Incident-Vorlagen","\u002Fincidents\u002Fincident-templates","04.incidents\u002F08.incident-templates",{"title":195,"path":196,"stem":197,"children":198,"page":21},"Eskalation","\u002Fescalation","05.escalation",[199,203,207],{"title":200,"path":201,"stem":202},"Eskalationsrichtlinien","\u002Fescalation\u002Fpolicies","05.escalation\u002F01.policies",{"title":204,"path":205,"stem":206},"Eskalation während eines Incidents","\u002Fescalation\u002Fduring-incident","05.escalation\u002F02.during-incident",{"title":208,"path":209,"stem":210},"Betriebszeiten (On-Call)","\u002Fescalation\u002Foperating-schedules","05.escalation\u002F03.operating-schedules",{"title":212,"path":213,"stem":214,"children":215,"page":21},"Wartungen","\u002Fmaintenance","06.maintenance",[216,220],{"title":217,"path":218,"stem":219},"Wartungen planen","\u002Fmaintenance\u002Foverview","06.maintenance\u002F01.overview",{"title":221,"path":222,"stem":223},"Wartungs-Benachrichtigungen","\u002Fmaintenance\u002Fnotifications","06.maintenance\u002F02.notifications",{"title":225,"path":226,"stem":227,"children":228,"page":21},"Statuspages","\u002Fstatuspages","07.statuspages",[229,233,237,241,245,249,253,257,261],{"title":230,"path":231,"stem":232},"Statuspages verstehen","\u002Fstatuspages\u002Foverview","07.statuspages\u002F01.overview",{"title":234,"path":235,"stem":236},"Statuspage erstellen","\u002Fstatuspages\u002Fcreate-statuspage","07.statuspages\u002F02.create-statuspage",{"title":238,"path":239,"stem":240},"Zugriffskontrolle","\u002Fstatuspages\u002Faccess-control","07.statuspages\u002F03.access-control",{"title":242,"path":243,"stem":244},"Komponenten verwalten","\u002Fstatuspages\u002Fcomponents","07.statuspages\u002F04.components",{"title":246,"path":247,"stem":248},"Abonnenten (Subscriber)","\u002Fstatuspages\u002Fsubscribers","07.statuspages\u002F05.subscribers",{"title":250,"path":251,"stem":252},"Custom Domains","\u002Fstatuspages\u002Fcustom-domains","07.statuspages\u002F06.custom-domains",{"title":254,"path":255,"stem":256},"Öffentliche Ansicht","\u002Fstatuspages\u002Fpublic-view","07.statuspages\u002F07.public-view",{"title":258,"path":259,"stem":260},"Layout-Builder","\u002Fstatuspages\u002Flayout-builder","07.statuspages\u002F08.layout-builder",{"title":262,"path":263,"stem":264},"Metriken","\u002Fstatuspages\u002Fmetrics","07.statuspages\u002F09.metrics",{"title":266,"path":267,"stem":268,"children":269,"page":21},"Team & Organisation","\u002Fteam","08.team",[270,274,278,282,286,290,294,298],{"title":271,"path":272,"stem":273},"Organisationen","\u002Fteam\u002Forganizations","08.team\u002F01.organizations",{"title":275,"path":276,"stem":277},"Mitglieder verwalten","\u002Fteam\u002Fmembers","08.team\u002F02.members",{"title":279,"path":280,"stem":281},"Rollen & Berechtigungen","\u002Fteam\u002Froles","08.team\u002F03.roles",{"title":283,"path":284,"stem":285},"Teams","\u002Fteam\u002Fteams","08.team\u002F04.teams",{"title":287,"path":288,"stem":289},"Einladungen","\u002Fteam\u002Finvitations","08.team\u002F05.invitations",{"title":291,"path":292,"stem":293},"Enterprise SSO (Single Sign-On)","\u002Fteam\u002Fsso","08.team\u002F06.sso",{"title":295,"path":296,"stem":297},"Entra ID (Azure AD) einrichten","\u002Fteam\u002Fsso-entra","08.team\u002F07.sso-entra",{"title":299,"path":300,"stem":301},"Keycloak einrichten","\u002Fteam\u002Fsso-keycloak","08.team\u002F08.sso-keycloak",{"title":303,"path":304,"stem":305,"children":306,"page":21},"Abrechnung","\u002Fbilling","09.billing",[307,311,315,319,323,327,331],{"title":308,"path":309,"stem":310},"Pläne & Preise","\u002Fbilling\u002Fplans","09.billing\u002F01.plans",{"title":312,"path":313,"stem":314},"Plan wechseln","\u002Fbilling\u002Fupgrade-downgrade","09.billing\u002F02.upgrade-downgrade",{"title":316,"path":317,"stem":318},"Zahlungsmethoden","\u002Fbilling\u002Fpayment","09.billing\u002F03.payment",{"title":320,"path":321,"stem":322},"Rechnungen","\u002Fbilling\u002Finvoices","09.billing\u002F04.invoices",{"title":324,"path":325,"stem":326},"SMS- & Voice-Guthaben","\u002Fbilling\u002Fsms-credits","09.billing\u002F05.sms-credits",{"title":328,"path":329,"stem":330},"Plan-Limits","\u002Fbilling\u002Flimits","09.billing\u002F06.limits",{"title":332,"path":333,"stem":334},"Add-Ons","\u002Fbilling\u002Fadd-ons","09.billing\u002F07.add-ons",{"title":336,"path":337,"stem":338,"children":339,"page":21},"Account & Sicherheit","\u002Faccount","10.account",[340,344,348,352,356,360],{"title":341,"path":342,"stem":343},"Profil bearbeiten","\u002Faccount\u002Fprofile","10.account\u002F01.profile",{"title":345,"path":346,"stem":347},"Passwort ändern","\u002Faccount\u002Fpassword","10.account\u002F02.password",{"title":349,"path":350,"stem":351},"Anmelden mit Google, GitHub & Discord","\u002Faccount\u002Fsocial-login","10.account\u002F03.social-login",{"title":353,"path":354,"stem":355},"Zwei-Faktor-Authentifizierung","\u002Faccount\u002Ftwo-factor","10.account\u002F04.two-factor",{"title":357,"path":358,"stem":359},"Account löschen","\u002Faccount\u002Fdelete-account","10.account\u002F05.delete-account",{"title":361,"path":362,"stem":363},"Erscheinungsbild","\u002Faccount\u002Fappearance","10.account\u002F06.appearance",{"title":365,"path":366,"stem":367,"children":368,"page":21},"Benachrichtigungen","\u002Fnotifications","11.notifications",[369,372,376],{"title":365,"path":370,"stem":371},"\u002Fnotifications\u002Foverview","11.notifications\u002F01.overview",{"title":373,"path":374,"stem":375},"Benachrichtigungskanäle","\u002Fnotifications\u002Fchannels","11.notifications\u002F02.channels",{"title":377,"path":378,"stem":379},"Persönliche Benachrichtigungs-Einstellungen","\u002Fnotifications\u002Fpreferences","11.notifications\u002F03.preferences",{"title":381,"path":382,"stem":383,"children":384,"page":21},"API","\u002Fapi","12.api",[385,389,393],{"title":386,"path":387,"stem":388},"API-Übersicht","\u002Fapi\u002Foverview","12.api\u002F01.overview",{"title":390,"path":391,"stem":392},"API-Tokens","\u002Fapi\u002Ftokens","12.api\u002F02.tokens",{"title":394,"path":395,"stem":396},"API-Endpunkte","\u002Fapi\u002Fendpoints","12.api\u002F03.endpoints",{"title":398,"path":399,"stem":400,"children":401,"page":21},"SLA","\u002Fsla","13.sla",[402,406,410],{"title":403,"path":404,"stem":405},"SLA-Monitoring","\u002Fsla\u002Foverview","13.sla\u002F01.overview",{"title":407,"path":408,"stem":409},"SLA-Ziele","\u002Fsla\u002Fobjectives","13.sla\u002F02.objectives",{"title":411,"path":412,"stem":413},"SLA-Reports","\u002Fsla\u002Freports","13.sla\u002F03.reports",{"title":415,"path":416,"stem":417,"children":418,"page":21},"FAQ","\u002Ffaq","14.faq",[419,423,427,431],{"title":420,"path":421,"stem":422},"Allgemeine Fragen","\u002Ffaq\u002Fgeneral","14.faq\u002F01.general",{"title":424,"path":425,"stem":426},"Häufige Fragen zum Monitoring","\u002Ffaq\u002Fmonitoring-faq","14.faq\u002F02.monitoring-faq",{"title":428,"path":429,"stem":430},"Häufige Fragen zur Abrechnung","\u002Ffaq\u002Fbilling-faq","14.faq\u002F03.billing-faq",{"title":154,"path":432,"stem":433},"\u002Ffaq\u002Ftroubleshooting","14.faq\u002F04.troubleshooting",{"id":435,"title":295,"body":436,"description":1345,"extension":1346,"meta":1347,"navigation":1348,"path":296,"seo":1349,"stem":297,"__hash__":1350},"docs\u002F08.team\u002F07.sso-entra.md",{"type":437,"value":438,"toc":1316},"minimark",[439,444,448,469,474,481,550,556,559,563,568,603,607,612,615,668,671,723,737,741,755,776,779,783,814,818,823,895,900,904,912,916,921,924,943,948,952,959,982,984,988,991,995,998,1002,1007,1028,1034,1038,1073,1077,1084,1099,1103,1117,1120,1122,1126,1130,1190,1194,1200,1208,1212,1215,1226,1230,1236,1239,1249,1252,1258,1287,1289,1293],[440,441,443],"h1",{"id":442},"microsoft-entra-id-azure-ad-einrichten","Microsoft Entra ID (Azure AD) einrichten",[445,446,447],"p",{},"Microsoft Entra ID (früher Azure AD) ist als OIDC-Identity-Provider vollständig unterstützt. Diese Anleitung führt dich durch die Einrichtung — vom Anlegen der App-Registration bis zum Gruppen-Mapping in LIVCK.",[449,450,453],"callout",{"title":451,"type":452},"Voraussetzung","info",[445,454,455,459,460,464,465,468],{},[456,457,458],"a",{"href":292},"Enterprise SSO"," ist für deine Organisation freigeschaltet und du hast die Berechtigung ",[461,462,463],"strong",{},"SSO verwalten",". Lege zuerst eine SSO-Verbindung in LIVCK an (Einstellungen → Organisation → SSO → Neue Verbindung) und kopiere die dort angezeigte ",[461,466,467],{},"Redirect-URI"," — du brauchst sie im nächsten Schritt.",[470,471,473],"h2",{"id":472},"übersicht","Übersicht",[445,475,476,477,480],{},"Entra ID liefert Gruppenzugehörigkeiten auf ",[461,478,479],{},"zwei Wegen",":",[482,483,484,503],"table",{},[485,486,487],"thead",{},[488,489,490,494,497,500],"tr",{},[491,492,493],"th",{},"Weg",[491,495,496],{},"Claim-Name",[491,498,499],{},"Inhalt",[491,501,502],{},"Empfohlen?",[504,505,506,526],"tbody",{},[488,507,508,514,520,523],{},[509,510,511],"td",{},[461,512,513],{},"Sicherheitsgruppen",[509,515,516],{},[517,518,519],"code",{},"groups",[509,521,522],{},"Array von GUIDs (Object IDs)",[509,524,525],{},"Nur bei wenigen Gruppen (\u003C 200)",[488,527,528,533,538,545],{},[509,529,530],{},[461,531,532],{},"App-Rollen",[509,534,535],{},[517,536,537],{},"roles",[509,539,540,541,544],{},"Array von Rollen-Werten (z.B. ",[517,542,543],{},"livck.admin",")",[509,546,547],{},[461,548,549],{},"Ja — für die meisten Fälle",[445,551,552,553,555],{},"Wir empfehlen ",[461,554,532],{},", weil sie Menschen-lesbar sind, kein Overage-Problem haben und sich sauber mappen lassen. Sicherheitsgruppen liefern GUIDs, die du einzeln nachschlagen und als Mapping eintragen musst.",[557,558],"hr",{},[470,560,562],{"id":561},"weg-a-app-rollen-empfohlen","Weg A: App-Rollen (empfohlen)",[564,565,567],"h3",{"id":566},"_1-app-im-entra-registrieren","1. App im Entra registrieren",[569,570,571,577,583,590,597],"ol",{},[572,573,574],"li",{},[461,575,576],{},"Entra admin center → App registrations → New registration",[572,578,579,580],{},"Name: z.B. ",[517,581,582],{},"LIVCK",[572,584,585,586,589],{},"Supported account types: ",[461,587,588],{},"Accounts in this organizational directory only"," (Single Tenant)",[572,591,592,593,596],{},"Redirect URI: ",[461,594,595],{},"Web"," → die Redirect-URI aus LIVCK eintragen",[572,598,599,600],{},"→ ",[461,601,602],{},"Register",[564,604,606],{"id":605},"_2-app-rollen-definieren","2. App-Rollen definieren",[445,608,609],{},[461,610,611],{},"App registrations → LIVCK → App roles → Create app role",[445,613,614],{},"Lege pro LIVCK-Rolle eine App-Rolle an:",[482,616,617,627],{},[485,618,619],{},[488,620,621,624],{},[491,622,623],{},"Feld",[491,625,626],{},"Wert",[504,628,629,640,650,660],{},[488,630,631,634],{},[509,632,633],{},"Display name",[509,635,636,637],{},"z.B. ",[517,638,639],{},"LIVCK Admin",[488,641,642,645],{},[509,643,644],{},"Allowed member types",[509,646,647],{},[461,648,649],{},"Users\u002FGroups",[488,651,652,655],{},[509,653,654],{},"Value",[509,656,636,657,659],{},[517,658,543],{}," (klein geschrieben, einprägsam)",[488,661,662,665],{},[509,663,664],{},"Enabled",[509,666,667],{},"☑",[445,669,670],{},"Beispiel-Rollen:",[482,672,673,684],{},[485,674,675],{},[488,676,677,679,681],{},[491,678,633],{},[491,680,654],{},[491,682,683],{},"LIVCK-Rolle",[504,685,686,697,710],{},[488,687,688,690,694],{},[509,689,639],{},[509,691,692],{},[517,693,543],{},[509,695,696],{},"Admin",[488,698,699,702,707],{},[509,700,701],{},"LIVCK Member",[509,703,704],{},[517,705,706],{},"livck.member",[509,708,709],{},"Member",[488,711,712,715,720],{},[509,713,714],{},"LIVCK Viewer",[509,716,717],{},[517,718,719],{},"livck.viewer",[509,721,722],{},"Viewer",[449,724,727],{"title":725,"type":726},"Value exakt merken","warning",[445,728,729,730,732,733,736],{},"Der ",[461,731,654],{}," landet später im Token und muss im LIVCK-Mapping ",[461,734,735],{},"exakt so"," eingetragen werden. Groß-\u002FKleinschreibung bleibt erhalten.",[564,738,740],{"id":739},"_3-benutzer-oder-gruppen-den-rollen-zuweisen","3. Benutzer oder Gruppen den Rollen zuweisen",[449,742,745],{"title":743,"type":744},"Häufigster Fehler","danger",[445,746,747,748,751,752,754],{},"Ohne diese Zuweisung sendet Entra ",[461,749,750],{},"keinen"," ",[517,753,537],{},"-Claim. Das ist der Schritt, der am häufigsten vergessen wird — und der Grund, warum \"keine Gruppen\" im Test-Login auftaucht.",[569,756,757,762,765,771],{},[572,758,759],{},[461,760,761],{},"Enterprise applications → LIVCK → Users and groups → Add user\u002Fgroup",[572,763,764],{},"Entra-Benutzer oder Entra-Gruppe auswählen",[572,766,767,768,770],{},"Rolle ",[517,769,639],{}," auswählen",[572,772,599,773],{},[461,774,775],{},"Assign",[445,777,778],{},"Wiederholen für jede Rolle \u002F jeden Benutzer.",[564,780,782],{"id":781},"_4-zugangsdaten-sammeln","4. Zugangsdaten sammeln",[784,785,786,792,801],"ul",{},[572,787,788,791],{},[461,789,790],{},"Application (client) ID",": App registrations → LIVCK → Overview → Application (client) ID",[572,793,794,797,798,800],{},[461,795,796],{},"Client Secret",": Certificates & secrets → New client secret → ",[461,799,654],{}," sofort kopieren (nur einmal sichtbar)",[572,802,803,806,807,810,811],{},[461,804,805],{},"Issuer-URL",": Overview → Endpoints → bei \"OpenID Connect metadata document\" das ",[517,808,809],{},"\u002F.well-known\u002Fopenid-configuration"," am Ende abschneiden → übrig bleibt ",[517,812,813],{},"https:\u002F\u002Flogin.microsoftonline.com\u002F{tenant-id}\u002Fv2.0",[564,815,817],{"id":816},"_5-in-livck-eintragen","5. In LIVCK eintragen",[445,819,820,480],{},[461,821,822],{},"Einstellungen → Organisation → SSO → Verbindung bearbeiten → Konfiguration",[482,824,825,833],{},[485,826,827],{},[488,828,829,831],{},[491,830,623],{},[491,832,626],{},[504,834,835,843,851,858,874,887],{},[488,836,837,839],{},[509,838,805],{},[509,840,841],{},[517,842,813],{},[488,844,845,848],{},[509,846,847],{},"Client-ID",[509,849,850],{},"aus Schritt 4",[488,852,853,856],{},[509,854,855],{},"Client-Secret",[509,857,850],{},[488,859,860,865],{},[509,861,862],{},[461,863,864],{},"Groups-Claim",[509,866,867,871,872],{},[461,868,869],{},[517,870,537],{}," ← wichtig, nicht ",[517,873,519],{},[488,875,876,881],{},[509,877,878],{},[461,879,880],{},"Quelle des Groups-Claims",[509,882,883,886],{},[461,884,885],{},"ID-Token"," ← nicht UserInfo",[488,888,889,892],{},[509,890,891],{},"Wenn keine Gruppe passt",[509,893,894],{},"nach Bedarf (Standard-Rolle \u002F Keine Rollen \u002F Login ablehnen)",[445,896,599,897],{},[461,898,899],{},"Konfiguration speichern",[564,901,903],{"id":902},"_6-domain-verifizieren","6. Domain verifizieren",[445,905,906,907,911],{},"Siehe ",[456,908,910],{"href":909},"\u002Fteam\u002Fsso#2-domain-verifizieren","SSO einrichten → Domain verifizieren",".",[564,913,915],{"id":914},"_7-mapping-anlegen","7. Mapping anlegen",[445,917,918,480],{},[461,919,920],{},"Einstellungen → Organisation → SSO → Verbindung → Mappings",[445,922,923],{},"Pro App-Rolle einen Eintrag:",[784,925,926,937],{},[572,927,928,931,932,934,935,544],{},[461,929,930],{},"IdP-Gruppe",": exakt der ",[461,933,654],{}," aus Schritt 2 (z.B. ",[517,936,543],{},[572,938,939,942],{},[461,940,941],{},"Rolle",": die entsprechende LIVCK-Rolle",[445,944,599,945],{},[461,946,947],{},"Hinzufügen",[564,949,951],{"id":950},"_8-testen","8. Testen",[445,953,954,955,958],{},"Klicke auf ",[461,956,957],{},"Login testen",". Im Dry-Run-Report sollte stehen:",[784,960,961,970,976],{},[572,962,963,966,967],{},[461,964,965],{},"Gruppen",": ",[517,968,969],{},"[\"livck.admin\"]",[572,971,972,975],{},[461,973,974],{},"Ermittelte Rollen",": Admin",[572,977,978,981],{},[461,979,980],{},"Würde sich anmelden",": ja",[557,983],{},[470,985,987],{"id":986},"weg-b-sicherheitsgruppen-alternativ","Weg B: Sicherheitsgruppen (alternativ)",[445,989,990],{},"Verwende diesen Weg nur, wenn du bereits Security Groups im Entra pflegst und keine App-Rollen anlegen möchtest.",[564,992,994],{"id":993},"_1-app-registrieren","1. App registrieren",[445,996,997],{},"Wie Weg A, Schritt 1.",[564,999,1001],{"id":1000},"_2-groups-claim-im-token-aktivieren","2. Groups-Claim im Token aktivieren",[445,1003,1004],{},[461,1005,1006],{},"App registrations → LIVCK → Token configuration → Add groups claim",[784,1008,1009,1016,1023],{},[572,1010,1011,1012,1015],{},"Groups to emit: ",[461,1013,1014],{},"Security groups \u002F Directory roles"," (NICHT \"All groups\" — sonst Overage-Gefahr)",[572,1017,1018,1019,1022],{},"Emit in: ☑ ",[461,1020,1021],{},"ID token"," ← dieses Häkchen ist Pflicht",[572,1024,599,1025],{},[461,1026,1027],{},"Save",[449,1029,1031],{"title":1030,"type":726},"Nicht im Access-Token",[445,1032,1033],{},"Stelle sicher, dass \"ID token\" ausgewählt ist. Nur dann liefert Entra die Gruppen im ID-Token, das LIVCK ausliest.",[564,1035,1037],{"id":1036},"_3-in-livck-eintragen","3. In LIVCK eintragen",[482,1039,1040,1048],{},[485,1041,1042],{},[488,1043,1044,1046],{},[491,1045,623],{},[491,1047,626],{},[504,1049,1050,1063],{},[488,1051,1052,1056],{},[509,1053,1054],{},[461,1055,864],{},[509,1057,1058,1062],{},[461,1059,1060],{},[517,1061,519],{}," (Default)",[488,1064,1065,1069],{},[509,1066,1067],{},[461,1068,880],{},[509,1070,1071],{},[461,1072,885],{},[564,1074,1076],{"id":1075},"_4-mapping-anlegen","4. Mapping anlegen",[445,1078,1079,1080,1083],{},"Die Object-ID einer Entra-Gruppe findest du unter ",[461,1081,1082],{},"Groups → deine Gruppe → Overview → Object ID"," (eine GUID).",[784,1085,1086,1094],{},[572,1087,1088,1090,1091,544],{},[461,1089,930],{},": die Object-ID (z.B. ",[517,1092,1093],{},"5b2c1d4a-1234-...",[572,1095,1096,1098],{},[461,1097,941],{},": die LIVCK-Rolle",[564,1100,1102],{"id":1101},"_5-nachteil-overage","5. Nachteil: Overage",[445,1104,1105,1106,1108,1109,1112,1113,1116],{},"Entra sendet den ",[517,1107,519],{},"-Claim nur, solange der Benutzer ",[461,1110,1111],{},"weniger als ca. 200 Gruppen"," angehört. Darüber hinaus wechselt Entra auf eine Graph-basierte Referenz (",[517,1114,1115],{},"_claim_sources","), die LIVCK nicht auflösen kann — der Login schlägt mit \"kein groups-Claim empfangen\" fehl.",[445,1118,1119],{},"Lösung: Verwende Weg A (App-Rollen) stattdessen.",[557,1121],{},[470,1123,1125],{"id":1124},"troubleshooting","Troubleshooting",[564,1127,1129],{"id":1128},"im-test-login-steht-kein-groups-claim-empfangen","Im Test-Login steht \"kein groups-Claim empfangen\"",[482,1131,1132,1142],{},[485,1133,1134],{},[488,1135,1136,1139],{},[491,1137,1138],{},"Ursache",[491,1140,1141],{},"Lösung",[504,1143,1144,1152,1166,1174,1182],{},[488,1145,1146,1149],{},[509,1147,1148],{},"Benutzer ist der App-Rolle nicht zugewiesen",[509,1150,1151],{},"Enterprise applications → LIVCK → Users and groups → Rolle zuweisen",[488,1153,1154,1160],{},[509,1155,1156,1157,1159],{},"Groups-Claim-Feld steht auf ",[517,1158,519],{},", du nutzt aber App-Rollen",[509,1161,1162,1163,1165],{},"auf ",[517,1164,537],{}," umstellen",[488,1167,1168,1171],{},[509,1169,1170],{},"Quelle steht auf UserInfo-Endpoint",[509,1172,1173],{},"auf ID-Token umstellen",[488,1175,1176,1179],{},[509,1177,1178],{},"Über 200 Gruppen zugewiesen (Overage)",[509,1180,1181],{},"App-Rollen verwenden statt Sicherheitsgruppen",[488,1183,1184,1187],{},[509,1185,1186],{},"App-Role ist nicht \"Enabled\"",[509,1188,1189],{},"App registrations → App roles → Rolle aktivieren",[564,1191,1193],{"id":1192},"im-test-login-stehen-guids-statt-rollen-namen","Im Test-Login stehen GUIDs statt Rollen-Namen",[445,1195,1196,1197,1199],{},"Du nutzt Sicherheitsgruppen (",[517,1198,519],{},"-Claim), nicht App-Rollen. Entweder:",[784,1201,1202,1205],{},[572,1203,1204],{},"Die GUIDs bewusst als Mapping eintragen (Weg B), oder",[572,1206,1207],{},"Auf App-Rollen wechseln (Weg A)",[564,1209,1211],{"id":1210},"im-test-login-steht-die-richtige-rolle-aber-login-schlägt-fehl","Im Test-Login steht die richtige Rolle, aber Login schlägt fehl",[445,1213,1214],{},"Prüfe:",[784,1216,1217,1220,1223],{},[572,1218,1219],{},"Ist die E-Mail-Domain verifiziert? (SSO → Domains)",[572,1221,1222],{},"Ist die Verbindung aktiviert?",[572,1224,1225],{},"Hat der Benutzer eine verifizierte E-Mail im Entra?",[564,1227,1229],{"id":1228},"issuer-url-validieren","Issuer-URL validieren",[445,1231,1232,1233,1235],{},"Die Issuer-URL muss exakt sein — ohne Trailing-Slash und ohne ",[517,1234,809],{}," am Ende. LIVCK hängt das Discovery-Suffix automatisch an.",[445,1237,1238],{},"Richtig:",[1240,1241,1246],"pre",{"className":1242,"code":1244,"language":1245},[1243],"language-text","https:\u002F\u002Flogin.microsoftonline.com\u002F{tenant-id}\u002Fv2.0\n","text",[517,1247,1244],{"__ignoreMap":1248},"",[445,1250,1251],{},"Falsch:",[1240,1253,1256],{"className":1254,"code":1255,"language":1245},[1243],"https:\u002F\u002Flogin.microsoftonline.com\u002F{tenant-id}\u002Fv2.0\u002F.well-known\u002Fopenid-configuration\nhttps:\u002F\u002Flogin.microsoftonline.com\u002F{tenant-id}\u002Fv2.0\u002F\nhttps:\u002F\u002Flogin.microsoftonline.com\u002Fcommon\u002Fv2.0\n",[517,1257,1255],{"__ignoreMap":1248},[449,1259,1261],{"title":1260,"type":726},"Common-Issuer vermeiden",[445,1262,1263,1264,1267,1268,1271,1272,1275,1276,1279,1280,1282,1283,1286],{},"Verwende immer den ",[461,1265,1266],{},"tenant-spezifischen"," Issuer (",[517,1269,1270],{},"\u002F{tenant-id}\u002Fv2.0","), nicht ",[517,1273,1274],{},"common"," oder ",[517,1277,1278],{},"organizations",". Mit ",[517,1281,1274],{}," ist der ",[517,1284,1285],{},"iss","-Claim im Token je Tenant anders und LIVCKs Issuer-Validierung schlägt fehl.",[557,1288],{},[470,1290,1292],{"id":1291},"weiterführende-themen","Weiterführende Themen",[784,1294,1295,1300,1305,1311],{},[572,1296,1297],{},[456,1298,1299],{"href":292},"Enterprise SSO – Übersicht",[572,1301,1302,1304],{},[456,1303,279],{"href":280}," – Ziel der Gruppen-Zuordnung",[572,1306,1307,1310],{},[456,1308,1309],{"href":276},"Mitglieder"," – Wer gehört zur Organisation",[572,1312,1313,1315],{},[456,1314,299],{"href":300}," – konkrete Anleitung für Keycloak",{"title":1248,"searchDepth":1317,"depth":1317,"links":1318},3,[1319,1321,1331,1338,1344],{"id":472,"depth":1320,"text":473},2,{"id":561,"depth":1320,"text":562,"children":1322},[1323,1324,1325,1326,1327,1328,1329,1330],{"id":566,"depth":1317,"text":567},{"id":605,"depth":1317,"text":606},{"id":739,"depth":1317,"text":740},{"id":781,"depth":1317,"text":782},{"id":816,"depth":1317,"text":817},{"id":902,"depth":1317,"text":903},{"id":914,"depth":1317,"text":915},{"id":950,"depth":1317,"text":951},{"id":986,"depth":1320,"text":987,"children":1332},[1333,1334,1335,1336,1337],{"id":993,"depth":1317,"text":994},{"id":1000,"depth":1317,"text":1001},{"id":1036,"depth":1317,"text":1037},{"id":1075,"depth":1317,"text":1076},{"id":1101,"depth":1317,"text":1102},{"id":1124,"depth":1320,"text":1125,"children":1339},[1340,1341,1342,1343],{"id":1128,"depth":1317,"text":1129},{"id":1192,"depth":1317,"text":1193},{"id":1210,"depth":1317,"text":1211},{"id":1228,"depth":1317,"text":1229},{"id":1291,"depth":1320,"text":1292},"Schritt-für-Schritt-Anleitung für Microsoft Entra ID als SSO-Identity-Provider – inklusive App-Rollen, Gruppen-Mapping und Troubleshooting.","md",{},null,{"title":295,"description":1345},"4w9SccDCDoK9rM7F0uutp8nCCnXwTW-hhgENLlmPZZU",1784953294235]