title: WebSphere SAML SSO with Azure AD
body: <p>I'm working on configuring SSO on websphere server to signin users to Maximo application running on that server, based on this docs: <a href="https://www.ibm.com/docs/en/was/9.0.5?topic=users-saml-web-single-sign" rel="nofollow noreferrer">https://www.ibm.com/docs/en/was/9.0.5?topic=users-saml-web-single-sign</a></p>
  <p>I have few issues that i'm not able to resolve or i'm missing some crucial information:</p>
  <ol>
  <li>On the step to add trusted realms <code>AdminTask.addTrustedRealms()</code> i need to pass realm name that will be trusted, yet it's not Azure Term, so i don't really know what i'm supposed to pass here, i've tried adding all domain names that my company is using and it didn't work nor any other thing that could be treated as &quot;realm&quot;</li>
  <li>There's no information about how to sync user registry, nor which registry type should i use? Should it be federated repositories or standalone custom registry? Without that, i'm not able to map user roles to any users from AAD</li>
  <li>After configuring rest of SAML SSO configuration and trying IDP-initiated SSO it's able to reach out to maximo application, then it gets into infinite loop between maximo app and microsoftlogin page, while trowing 401 error. In maximo logs there's message &quot;Authorization failed for /UNAUTHENTICATED while invoking (...)accesstokenprovider is not granted any of the required roles &quot;maximouser&quot; - i'm pretty sure that's because i cannot add user roles mappings to any of the users from AAD as stated in bullet point 2.</li>
  </ol>