Processing module. Azure Pack

Integration with Microsoft Windows Azure Pack allows a provider to offer Virtual data centers.

When a customer orders a service, he/she can choose how much resources are needed. e.g.: 

• CPU number;
• RAM; 
• disk space. 

BILLmanager sends an API request to Azure Pack to create a virtual data center after the service had been ordered and paid. Once the service is activated, the client will receive the email with login credentials to access the user portal.

Minimum permissions for proper operation

To integrate correctly with Microsoft Azure Pack, a user needs the following minimum permissions:

• Active Directory (AD) — read and write permissions within the Organizational Unit (OU) that Azure Pack works with. This is necessary to manage accounts and resources;
• Azure Pack — access to the Administrator API with rights to perform administrative operations on resources, including:
  • creating;
  • managing;
  • deleting;
• WAP Admin API — access to fulfill requests from the BILLmanager side.

Integration

Integration is configured in the process of creating a service processing module in BILLmanager.

To create a service processing module, enter Integration → Processing modules → click Add. The processing module adding wizard consists of the following steps:

1. Product type — select "Virtual data-center".
2. Processing module — select "Azure Pack".
3. Integration settings. Specify the data for integration:
   
   1. URL ISPsystem API — URL to access the proxy server of ISPsystem Service (created from <API Host>:<API Port>).
   2. Username — username to access Administrator API.
   3. User password — user password to access Administrator API.
   4. Windows domain name — the name of Windows domain where the above-mentioned user is located.
   5. User management portal — link to Windows Azure Pack user portal.
   6. Operation that will be performed after suspension of VDC — an operation performed for all virtual machines when a VDC is stopped.
   7. Enable virtual servers — activate virtual machines after service reactivation.
4. Processing module parameters. Configure internal (within BILLmanager) parameters of the service processing module.

Configuring windowsAuthEndpoint

To verify user credentials, use windowsAuthEndpoint as the authentication address. If authentication is done through ADFS (Active Directory Federation Services), the windowsAuthEndpoint must point to the ADFS server. 

The standard authentication scheme uses AdminSite as the ADFS server.

Using ADFS instead of AuthenticationSite

If you already have ADFS configured for authentication, you do not need to install the additional AuthenticationSite role. To configure authentication:

1. Check if ADFS can handle requests from Windows Azure Pack (WAP).
2. Make sure that the correct ADFS URL is specified in windowsAuthEndpoint.
3. Configure the proxy server to correctly pass authentication requests to ADFS.

If ADFS handles authentication correctly, the changes in BILLmanager should only affect the windowsAuthEndpoint configuration.