Differences
This shows you the differences between two versions of the page.
organisationcloud/saml [2020_01_03 15:32] – Azure SAML added eric | organisationcloud:saml [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== SAML 2.0 and the SME Enterprise File Fabric ====== | ||
- | last updated Sept. 25 2018 | ||
- | |||
- | The Enterprise File Fabric supports users logging-in via the SAML 2.0 protocol. The SAML 2.0 protocol is increasing in popularity, and there are a number of different flavours and variations provided by different identity providers (IDPs), like Active Directory Federation Services (ADFS) and Google Suite (GSuite). | ||
- | |||
- | This guide covers how a SAML 2.0 configuration can be configured from the File fabric interface, and the specifics relating to each platform. | ||
- | |||
- | ===== Setting up SAML 2.0 with the Enterprise File Fabric ===== | ||
- | |||
- | To begin configuring the SAML 2.0 connection, you will need to ensure that SAML is enabled in your Package. To do this login as the ApplAdmin user, visit the **User Packages** screen, find the package that your Organization uses, and ensure that **SAML 2 Login System** is highlighted in the "Extra options" | ||
- | |||
- | {{ :: | ||
- | |||
- | Next, login as the Organization Administrator account, and visit the **Auth Systems** screen from the **Organization** menu. | ||
- | |||
- | Under **Add Auth System**, select **SAML 2** from the dropdown beside **Auth System**. | ||
- | |||
- | On this screen, you are now required to enter the specific details about your particular SAML 2 Identity Provider. The following list describes the meaning of each field. | ||
- | |||
- | * __Auth System Name__ - Each authentication system has a name which is provided for your reference. Enter a name you can use to identify this later on. | ||
- | |||
- | * __Login button label__ - Instead of users supplying the File Fabric with usernames and passwords, the users will be shown a button for them to click to perform the login. The text you supply here will be used on the button, for example you may wish to enter "Login with AcmeCorp AD" | ||
- | |||
- | * __The Service provider entity ID__ - Your Identity Provider will either ask you to supply an Entity ID or will generate one for you. You should enter what your Identity Provider supplies you with here. | ||
- | |||
- | * __SSO entry point__ - Your Identity Provider will provide you with a URL that begins the login flow for your users with the File Fabric service. This can commonly be referred to as the SSO URL or SSO Login Endpoint. | ||
- | |||
- | * __The logout service endpoint__ - Your Identity Provider will provide you with the Logout URL, where SME will send users to when they wish to logout of the Enterprise File Fabric. | ||
- | |||
- | * __Certificate data__ - Your Identity Provider will provide you with a certificate when configuring your SAML Service Provider. You should download that certificate and paste its entire contents into this field. | ||
- | |||
- | * __Fetch user Role/ | ||
- | |||
- | * __Auto create user on login__ - Manual user import is not possible with SAML, so this option should be checked. | ||
- | |||
- | * __Update user roles/ | ||
- | |||
- | * __Update user info on login__ - The File Fabric can refresh a users personal information, | ||
- | |||
- | * __User Import Fields__ - The File Fabric requires certain pieces of information when linking a user to the platform. Since there are no field name standards with the File Fabric, you will need to supply the mappings. | ||
- | |||
- | For specific details on configuring different platforms, follow our guides below. | ||
- | |||
- | Once you have completed the configuration you can use the Test Settings button, and complete this by clicking **Add Auth System**. | ||
- | |||
- | |||
- | ===== Configuring with ADFS - Local AD ===== | ||
- | |||
- | From the **AD FS** management screen, click **Add Relying Party Trust...** from the sidebar. | ||
- | |||
- | This will open a wizard like below. | ||
- | |||
- | {{ :: | ||
- | |||
- | Click **Start** | ||
- | |||
- | Click the radio button **Enter data about the relying party manually** and click **Next** | ||
- | |||
- | {{ :: | ||
- | |||
- | Enter an appropriate **Display name** so that you can recognise it in the future and click **Next** | ||
- | |||
- | {{ :: | ||
- | |||
- | Select the **AD FS profile** radio button and click **Next**. | ||
- | |||
- | {{ :: | ||
- | |||
- | Under the **Configure Certificate**, | ||
- | |||
- | {{ :: | ||
- | |||
- | On the **Configure URL** screen, tick the ** Enable support for the SAML 2.0 WebSSO protocol** checkbox. | ||
- | |||
- | In the **Relying party SAML 2.0 SSO service URL** field, you will need to enter your appliances base URL, with "/ | ||
- | |||
- | {{ :: | ||
- | |||
- | Click **Next**. | ||
- | |||
- | On the **Configure Identifiers** screen, you will need to enter the base URL for your appliance in the **Relying party trust identifier** field. For example we could enter " | ||
- | |||
- | {{ :: | ||
- | |||
- | You will then be asked if you wish to **Configure Multi-factor Authentication** for this relying party trust. You may do so, but it is out of scope for this guide. | ||
- | |||
- | Click **Next** | ||
- | |||
- | On the **Choose Issuance Authorization Rules** screen, select the **Permit all users to access this relying party** radio button. | ||
- | |||
- | {{ :: | ||
- | |||
- | Click **Next** | ||
- | |||
- | On the **Ready to Add Trust** screen, review the settings you have entered. | ||
- | |||
- | Click **Next** | ||
- | |||
- | On the final screen, ensure that the **Open the Edit Claim Rules dialog for this relying part trust when the wizard closes** is ticked, and click **Close** | ||
- | |||
- | From the **Issuance Transform Rules** screen, click **Add Rule...** | ||
- | |||
- | {{ :: | ||
- | |||
- | From the **Claim rule template** drop down, select **Send LDAP Attributes as Claims** and click **Next**. | ||
- | |||
- | Enter a friendly name under **Claim rule name**. | ||
- | |||
- | Select **Active Directory** from the **Attribute store** | ||
- | |||
- | Configure the **Mapping of LDAP attributes** as per the image below. | ||
- | |||
- | {{ :: | ||
- | |||
- | |||
- | Next, add another Claim Rule. | ||
- | |||
- | From the **CLaim rule template** select **Send Group Membsership as a Claim**. Provide a **Claim rule name**. | ||
- | |||
- | Select the **User' | ||
- | |||
- | Select the **Outgoing claim type** as **Group** | ||
- | |||
- | Input the **Outgoing claim value** as " | ||
- | |||
- | {{ :: | ||
- | |||
- | Close the Claim Rules dialog. | ||
- | |||
- | Next, visit the **Certificates** folder under **Service** | ||
- | |||
- | {{ :: | ||
- | |||
- | Double click on your certificate under the **Token-signing** section. | ||
- | |||
- | Click on the **Details** tab and click **Copy to File** | ||
- | |||
- | {{ :: | ||
- | |||
- | Click **Next** when the dialog opens. | ||
- | |||
- | Select **Base-64 encoded X.509 (.CER)** as the export format. | ||
- | |||
- | Click **Next** | ||
- | |||
- | Select the location on disk to store the certificate and follow the prompts to complete the export. | ||
- | |||
- | Finally, click on the **AD FS** folder on the left hand side. From the **Action** menu, select **Edit Federation Service Properties**. | ||
- | |||
- | Copy the value from the **Federation Service identifier** field and save this. | ||
- | |||
- | Now we will configure the Auth System inside SME. Given the guide at the top of this document, the relevant fields from AD FS are as follows: | ||
- | |||
- | **Service provider entity ID** - This is the value from the **Federation Service identifier** field | ||
- | |||
- | **SSO entry point** - For AD FS this is typically the base URL of the service appended with "/ | ||
- | |||
- | **Logout service endpoint** - For AD FS this is typically the SSO endpoint with the additional query string of "? | ||
- | |||
- | **Certificate data** - Open the exported certificate you obtained from the AD FS system into Notepad, and copy the whole contents into this field. | ||
- | |||
- | Ensure the field mappings are as follows: | ||
- | |||
- | * Unique user attribute => username | ||
- | * User Login Field => username | ||
- | * User Name Field => fullname | ||
- | * User Email Field => email | ||
- | * Role\Group Name Field => role | ||
- | * User Phone Field => phone | ||
- | |||
- | ===== Configuring with ADFS - Azure AD ===== | ||
- | |||
- | === Setup Azure SAML App === | ||
- | |||
- | As an administrative user, log into the Azure portal: https:// | ||
- | |||
- | Search and enter the page for " | ||
- | {{ :: | ||
- | |||
- | {{ :: | ||
- | |||
- | On the next screen we will name the application something like // | ||
- | |||
- | Now that the application is created, we will enable SAML for single sign-on. | ||
- | |||
- | {{ :: | ||
- | |||
- | In "Basic SAML Configuration" | ||
- | |||
- | Identifier (Entity ID): File Fabric URL - ex: https:// | ||
- | |||
- | Reply URL (Assertion Consumer Service URL): ex: https:// | ||
- | |||
- | Next we will setup Group Claims. | ||
- | |||
- | Select "All Groups" | ||
- | " | ||
- | |||
- | Once this is set, we will copy and save the URLs | ||
- | {{ :: | ||
- | |||
- | Next we will download the Certificate (Base64) from the "SAML Signing Certificate" | ||
- | |||
- | {{ :: | ||
- | |||
- | Next we will make sure we have added the correct users and/or groups to the Enterprise Application. (only users/ | ||
- | |||
- | {{ :: | ||
- | |||
- | Finally, we will ensure we are passing all the correct attributes that the File Fabric Needs. | ||
- | |||
- | In the "User Attributes & Claims" | ||
- | |||
- | {{ :: | ||
- | |||
- | === Setup Graph API === | ||
- | |||
- | In order to get the correct group names from ADFS, we will need to enable the Azure Graph API. | ||
- | |||
- | In App Registrations, | ||
- | |||
- | Once created, we will edit the API permissions, | ||
- | |||
- | In the Request API Permissions screen, we will select: | ||
- | Azure Active Directory Graph > Application permissions > Directory.Read.All | ||
- | And hit "Add permissions" | ||
- | |||
- | Now we will gather the credentials. | ||
- | In " | ||
- | |||
- | In " | ||
- | |||
- | === Setup File Fabric Auth System === | ||
- | |||
- | As an Org admin, we will now enable SAML Authentication. | ||
- | Click on: Organization > SAML 2 | ||
- | |||
- | Fill in the following details: | ||
- | |||
- | __Auth System Name__ - Azure SAML | ||
- | |||
- | __Login Button label__ - This text field will be what is displayed in the login button on the File Fabric login page. Use something that the users will understand like “Login with Microsoft Azure” | ||
- | |||
- | __The service provider entity ID__ - Enter the "Azure AD Identifier" | ||
- | |||
- | __SSO Entry point__ - Enter the "Login URL" you saved from the Azure Enterprise Application SAML App setup screen above | ||
- | |||
- | __Logout Service Endpoint__ - Enter the " | ||
- | |||
- | __Certificate Data__ - Enter the certificate text you downloaded from the Azure Enterprise Application SAML App setup screen above | ||
- | |||
- | __Fetch User Role\Group Name by id__ - Check | ||
- | |||
- | __Azure AD Application ID__ - Enter the GraphAPI " | ||
- | |||
- | __Azure AD Application Key__ - Enter the " | ||
- | |||
- | __Auto create user on login__ - Check if you would like users to be auto provisioned when logging in via SAML | ||
- | |||
- | __Update user roles/ | ||
- | |||
- | __Update user info on login__ - Check to update all user information on SAML login | ||
- | __User Import Fields__ | ||
- | |||
- | Ensure the following mappings are set: | ||
- | |||
- | Unique user attribute > user | ||
- | |||
- | User login field > user | ||
- | |||
- | User Name field > fullname | ||
- | |||
- | User email field > mail | ||
- | |||
- | Role\Group name field > groups | ||
- | |||
- | User Phone field > phone | ||
- | |||
- | {{ :: | ||
- | {{ :: | ||
- | ===== Configuring with G Suite (Google) ===== | ||
- | |||
- | === Setup G Suite SAML App === | ||
- | |||
- | As the administrative user for your G Suite domain, login to the [[https:// | ||
- | |||
- | Then Select Apps > SAML Apps from the menu on the left hand side of the screen (" | ||
- | |||
- | {{:: | ||
- | |||
- | On the following screen, click the yellow plus (+) symbol in the bottom left to add a new SAML Application. | ||
- | Then select "Setup my own custom app" | ||
- | |||
- | On the next screen you will want to save the SSO URL, Entity ID and download the certificate. | ||
- | |||
- | {{:: | ||
- | |||
- | On the next page enter an Application Name that matches your File Fabric system, and use any Description or Logo you would like, and click next. | ||
- | |||
- | Next fill out the " | ||
- | |||
- | __ACS URL__ = File Fabric URL + "/ | ||
- | |||
- | __Entity ID__ = File Fabric URL - ex: https:// | ||
- | |||
- | __Start URL__ = File Fabric URL - ex: https:// | ||
- | |||
- | __Name ID__ = Leave as Default: Basic Information > Primary Email | ||
- | |||
- | __Name Format__ = Leave as Default: Unspecified | ||
- | |||
- | {{:: | ||
- | |||
- | We will setup the following mappings in the Attribute Mapping Section: | ||
- | |||
- | Username > Basic Information > Primary Email | ||
- | |||
- | email > Basic Information> | ||
- | |||
- | fullname > Basic Information > First Name | ||
- | |||
- | groups > Employee Details > Department | ||
- | |||
- | phone > Contact Information> | ||
- | |||
- | upn > Basic Information > Full Name | ||
- | |||
- | {{:: | ||
- | |||
- | Click Finish to complete the setup of the SAML App. | ||
- | |||
- | Finally select the three dot menu for the app and select "ON for everyone" | ||
- | |||
- | {{:: | ||
- | |||
- | === File Fabric Auth System === | ||
- | |||
- | As the Org admin, we will now enable the SAML Authentication. | ||
- | |||
- | Click on: Organization > Auth Systems. | ||
- | |||
- | Select: Auth System > SAML 2 | ||
- | |||
- | Fill in the following details: | ||
- | |||
- | __Auth System Name__ - G Suite SAML | ||
- | |||
- | __Login Button label__ - This text field will be what is displayed in the login button on the File Fabric login page. Use something that the users will understand like "Login with Google" | ||
- | |||
- | __The service provider entity ID__ - Enter the Entity ID you saved from the Google SAML App setup screen | ||
- | |||
- | __SSO Entry point__ - Enter the SSO URL you saved from the Google SAML App setup screen | ||
- | |||
- | __Logout Service Endpoint__ - https:// | ||
- | |||
- | __Certificate Data__ = Enter the certificate text you downloaded from the Google SAML App setup screen | ||
- | |||
- | __Fetch User Role\Group Name by id__ - Leave unchecked | ||
- | |||
- | __Auto create user on login__ - Check if you would like users to be auto provisioned when logging in via SAML | ||
- | |||
- | __Update user roles/ | ||
- | |||
- | __Update user info on login__ - Check to update all user information on SAML login | ||
- | |||
- | __User Import Fields__ | ||
- | |||
- | Ensure the following mappings are set: | ||
- | |||
- | Unique user attribute > username | ||
- | |||
- | User login field > username | ||
- | |||
- | User Name field > fullname | ||
- | |||
- | User email field > email | ||
- | |||
- | Role\Group name field > groups | ||
- | |||
- | User Phone field > phone | ||
- | |||
- | {{:: | ||
- | |||
- | Click Test and then Update to save these settings | ||
- | |||
- | ===== Configuring with Okta ===== | ||
- | |||
- | From your Okta's Administrative account, click on **Applications** from the top menu, and then click **Add Application**. From the left menu click on the **Create New App** button. | ||
- | |||
- | For the **Platform** option, select **Web**. | ||
- | |||
- | For the **Sign on method**, select **SAML 2.0**. | ||
- | |||
- | Then click **Create**. | ||
- | |||
- | On the next screen, we need to supply some basic information for the application. | ||
- | |||
- | For the **App Name**, provide a friendly name for the SME service, e.g. **Enterprise File Fabric**. Optionally you can also provide an **App logo** that users would recognize. | ||
- | |||
- | Click **Next**. | ||
- | |||
- | On the **SAML settings** screen we want to configure the fields as follows: | ||
- | |||
- | * __Single sign on URL__ - This should be the URI of your Enterprise File Fabric appliance, appended by "/ | ||
- | * __Audience URI__ - This should be the URI of your Enterprise File Fabric appliance, e.g. " | ||
- | * __Default RelayState__ - This should be left blank | ||
- | * __Name ID format__ - Select Email Address | ||
- | * __Application username__ - Select Okta Username | ||
- | |||
- | Under **Show Advanced Settings**: | ||
- | |||
- | * Tick **Enable Single Logout** | ||
- | * In **Single Logout URL** enter the value you entered in **Audience URI** | ||
- | * In **SP Issuer** enter the value you entered in **Audience URI** | ||
- | * From the **Signature Certificate** upload the Signing Certificate that can be obtained from your Enterprise File Fabric appliance Auth System configuration screen. | ||
- | |||
- | Under **Attribute Statements** configure the mappings as follows: | ||
- | |||
- | * Name " | ||
- | * Name " | ||
- | * Name " | ||
- | |||
- | Under **Group Attribute Statements**, | ||
- | |||
- | A Groups Entry will need to be added with a name of " | ||
- | |||
- | * Contains: IT - Matches groups containing the word " | ||
- | * Regex: " | ||
- | |||
- | Follow the on-screen steps to save the changes. | ||
- | |||
- | On the **Application Details** screen, under **Sign On**, click the **View Setup Instructions** button. | ||
- | |||
- | On the File Fabric SAML Auth System screen, enter the following values: | ||
- | |||
- | * The Service provider entity ID - The URI entered earlier from the **Audience URI** field | ||
- | * SSO entry point - Enter the **Identity Provider Single Sign-On URL** found on the Okta setup instructions screen | ||
- | * The logout service endpoint - Enter the **Identity Provider Single Logout URL** found on the Okta setup instructions screen. | ||
- | * x509 Certificate - Enter the **X.509 Certificate** found on the Oka setup instructions screen | ||
- | |||
- | Before users are able to access the Okta application, | ||
- | |||
- | Your Okta setup with the Enterprise File Fabric is now complete. | ||