Hello,
Does anyone know when the issue with MCP Flow authentication with Entra will be fixed?
The apparent reason is that FME does not expose the scopes that Entra expects. FME says the fix is to use an alternate SAML provider such as Auth0. There is a work around, ish, sharing it here in case it can be helpful to others.
Since switching SAML providers is not an option in my case I was about to give up and just wait for SAFE to fix this. However, I wondered about simply connecting Auth0 to Entra and passing things along (federated). ChatGPT seemed enthusiastic about that option so I decided to give it a go with it’s assistance.
My requirement is that users must be authenticated via Entra, adding AuthO as an IdP in FME Flow was not an option, no exceptions.
Sparing the details, here’s the basic setup. (I already had an Entra SAML setup working for Flow user login):
- Auth0 > Entra Enterprise connection for federation (free tier allows for 1).
- Follow this tutorial for the Auth0 application setup.
- Register the application in Entra, create a secret and copy to Auth0 app.
- On the Entra Enterprise App side for SAML SSO login claim add “flowaccountid” = waad|<auth0-connection>|<entra-object-id> . This must be done via a transformation using a regexreplace (credit to ChatGPT for figuring that out).
- Regex: ^(?<oid>.*)$
- Replacement: waad|<auth0-connection>|{oid}
- Result: waad|<auth0-connection>|<entra-object-id>
- Except for the “flowaccountid”, the setup is similar to any other SAML setup.
- SAFE states the user needs to log in at least once to have the “flowaccountid” attribute populated.
- Global admin or Application Admin must do the setup on the MS side.
- I used the client ID when setting the MCP up in Claude (didn’t test the other options).
Cheers to more MCP in Flow!