Logo
  • Other versions
  • Virage Group
  • Espace Magenta
  • Support ticket
  • Strat Monitor documentation
Project Monitor v7.7 Knowledge Center
Project Monitor v7.7 Knowledge Center
SAML2 Authentication Memo

SAML2 Authentication Memo

‣
Table of contents
‣
history modifications

1. Preamble

SAML enables users to uniquely identify themselves to the various web applications they use.

In the SAML model Project MonitorProject Monitor is a Service Provider.

You need an Identity Provider. In the rest of this document, IDP refers to your Identity Provider (e.g. Okta / Shibboleth / Keycloak or ADFS - Microsoft Active Directory Federation Services).

Remarks

Data expected by Virage GroupVirage Group :

  • Customer metadata file
  • customer authentication attribute

Data provided by Virage GroupVirage Group :

  • Metadata file to be integrated into the customer's Identity Provider

2. Activate SAML authentication in 4 steps

2.0 Technical requirements: For installed platforms only (excluding SAAS)

  1. In the monitormaker.properties file: configure the authentication strategy: Saml2Authenticator
    2. com.vc.mm.authenticator= com.vc.mm.modules.user.Saml2Authenticator
    💡
    See the Operating folder for more information on available authentication strategies.
    🚩
    Specific to ADFS :
    • Unzip the file Java Cryptography Extension jce_policy-8.zip in the %PM_HOME%\install\JDK or in your customer area http://file.viragegroup.com (public/delivery/install).
    • Copy files local_policy.jar and US_export_policy.jar and paste them to replace the existing ones in the %PM_HOME%\jre\lib\security.
  2. Restart the Wildfly service to take account of the change.

2.1. Get your IDP configuration: METADATA XML file

  1. Obtain a metadata file in xml format from your IDP. This file will enable Project MonitorProject Monitor know your IDP and communicate with him.
    2. 🚩
    Specific to Keycloak:
    • The metadata file to be retrieved is that of the Realm (available from the configuration tab General)
  2. Obtain or set the code of the user login field in your IDP
🚩
Specific to ADFS :

When adding the rule to link the Active Directory LDAP identifier to the Project MonitorProject Monitor please specify the following information:

  1. In the Issuance Transform Rulesto add and configure a rule.
  2. In the Attribute Store indicate Active Directory.
  3. In the LDAP Attributes select SamAccountName.
  4. In the Outgoing Claim Type select Name ID.
  5. Addition of a second line, in the LDAP Attributes select again SamAccountName.
  6. In the Outgoing Claim Type enter the login you provided at Project MonitorProject Monitor (ex : login)
🚩
Specific to Keycloak:

When configuring the client in Keycloak :

  • The clientID field must contain the platform access URL Project MonitorProject Monitor suffixed with /sp (ex : https://serveur.p-monitor.com/sp)
  • In the Generalthe fields Valid Redirect URIs and Assertion Consumer Service POST Binding URL must contain the address Project MonitorProject Monitor SAML reception (e.g: https://serveur.p-monitor.com/MonitorMakerWeb/api/auth/saml2/consume)

When creating a new mapper from the Mapper client configuration :

  1. In the name indicate login
  2. In the Mapper Type select User Property
  3. In the Property indicate username
  4. In the Friendly name indicate login
  5. In the SAML Attribute Name indicate login
  1. During authentication, Project MonitorProject Monitor and the IDP exchange information. This code is necessary for Project MonitorProject Monitor to find out which of this information contains the user login. For example, in Shibboleth urn:oid:0.9.2342.19200300.100.1.1 or according to the IDP, login or other "

2.2 Declaring your IDP in Project MonitorProject Monitor

  1. Go to page AdministrationAdministration > Advanced settings >Technical configuration > SAML2 authenticationSAML2 authentication
  2. In the first field of the page, paste the XML content of the metadata file obtained in step SAML2 Authentication Memo - 2.1. Get your IDP configuration: METADATA XML fileSAML2 Authentication Memo - 2.1. Get your IDP configuration: METADATA XML file .
  3. Enter the code for the login field. This code was obtained in step SAML2 Authentication Memo - 2.1. Get your IDP configuration: METADATA XML fileSAML2 Authentication Memo - 2.1. Get your IDP configuration: METADATA XML file.
    4. 🚩
    Specific to ADFS :
    • Set the maximum authentication time at 8 hours.
  4. Click on RegisterRegister.

2.3 Generate configuration for Project MonitorProject Monitor METADATA XML file

  1. Still on the AdministrationAdministration > Advanced settings >Technical configuration > SAML2 authenticationSAML2 authenticationin the second part of the page
  2. Click on Generate to display all Project MonitorProject Monitor that will be required for the IDP, namely :
    • metadata in XML format
    • Assertion consumer service
    • Service provider entity ID location
    • Service provider entity ID binding
      • 🚩

      This information will enable your IDP to Project MonitorProject Monitor as Service Provider and communicate with it.

      Please note: depending on the IDP settings, not all information may be required.

  3. Copy the contents of the metadata (xml). These metadata will enable your IDP to know Project MonitorProject Monitor as Service Provider and communicate with it.

2.4. Register Project MonitorProject Monitor in your IDP

  1. Create Project MonitorProject Monitor as an application in your IDP.
  2. Supply the metadata obtained in step SAML2 Authentication Memo - 2.3 Generate the ‣ configuration : METADATA XML fileSAML2 Authentication Memo - 2.3 Generate the ‣ configuration : METADATA XML file to your IDP. 2 alternatives :
  1. Copy the xml into the appropriate field.
  1. Or transfer values Assertion consumer service, Service provider entity ID location and Service provider entity ID binding.

3. Test configuration

  1. Create your users in Project MonitorProject Monitor if you haven't already.
  2. Create your users in your IDP if you haven't already done so.
  3. Connect to the application to validate the configuration.

4. SAML with AzureAD

🚦
Prerequisites :
  • An enterprise application in Azure AD.
  • Users must be added in the Azure AD application: add a user / group to have access to Project MonitorProject Monitor.
  • Users must be added in Project MonitorProject Monitor (manually or via import).

4.1 In AzureAD

  1. Access the AzureAD administration center.
  2. Enable SAML authentication.
    3. 🚩
    The AD group must contain users directly. Group nesting does not work in Azure AD.
  3. Use the enterprise application Demonstrator-internal (up: adazure) present in Azure Active Directory.
    4. image
  4. Configure single sign-on in the application.
    5. image
    🚩
    SAML details are displayed on the single sign-on page. The login mapping between Project MonitorProject Monitor and Azure.
  5. Download XML file.
  6. Check user list.
    7. image
    🚩
    Users who need to connect to Project MonitorProject Monitor with the same login must be present in the enterprise application, in the section Users and Groups.

4.2 In Project MonitorProject Monitor

  1. Click on AdministrationAdministration > Advanced settings >Technical configuration > SAML2 authenticationSAML2 authentication
  2. Paste the previously downloaded XML configuration.
  3. Add the Login attribute of your ID ProviderLogin attribute of your ID Provider.
    4. image
  4. Click on RegisterRegister.
    5. image
  5. Click on AdministrationAdministration > User settings > User management > UsersUsers.
  6. Add users.
    7. image
  7. Check that they have also been added to Azure AD.

5. Connecting without SAML

Some users of Project MonitorProject Monitor are unknown to the IDP (external service provider, consultant). For these users, it is possible to connect to Project MonitorProject Monitor by login and password with the url : http://maplateforme/nex/login?local=true

6. Set exclusive connection mode

By default, users can log in using both SAML authentication and local authentication (url /neo/auth/auth.html?local=true or nex/login?local=true)

It is possible to disable this local authentication mode for all or some users, to allow them to use only the SAML authentication mode.

To disable local authentication mode, in the SAMLv2 authentication settings interface, check the box SSO access only :

image

This default setting can be overridden when :

  • Some users of the application are not listed in the organization's directory (external users).
  • Some technical users (interfaces) are used.

To authorize a specific user to use local authentication by override :

  • In the user details screen, in the Parameterscheck the box Local authentication possibleLocal authentication possible.
image
Logo

Produced by Virage Group