Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
75:integration:saml [2022/03/28 09:38] – [Validated IdP Vendors] alz | 75:integration:saml [2024/02/15 00:00] (current) – external edit 127.0.0.1 | ||
---|---|---|---|
Line 9: | Line 9: | ||
===== Restrictions ===== | ===== Restrictions ===== | ||
- | Stages currently supports single sign on (SSO) **<font inherit/ | + | Stages currently supports single sign on (SSO) ** only with one ** SAML server. |
- | + | ||
===== Generate a signing key ===== | ===== Generate a signing key ===== | ||
- | If you already have a SSL server certificate for Stages, you can use that certificate to sign the SAML requests. If you use encrypted SAML assertions - a separate certificate is required. If you do not have a certificate or you want to use a separate certificate, | + | If you already have a SSL server certificate for Stages, you can use that certificate to sign the SAML requests. If you use encrypted SAML assertions - a separate certificate is required. If you do not have a certificate or you want to use a separate certificate, |
+ | < | ||
keytool -genkeypair -alias " | keytool -genkeypair -alias " | ||
Line 20: | Line 19: | ||
</ | </ | ||
- | Enter your Stages | + | Enter your Stages |
You can choose an arbitrary key name (e.g. '' | You can choose an arbitrary key name (e.g. '' | ||
Line 29: | Line 28: | ||
< | < | ||
| | ||
- | keystore="/ | + | keystoreFile="/ |
| | ||
... | ... | ||
Line 37: | Line 36: | ||
To globally enable SAML, set the '' | To globally enable SAML, set the '' | ||
+ | |||
+ | |||
===== Configure the SAML Service Provider (SP) ===== | ===== Configure the SAML Service Provider (SP) ===== | ||
Line 65: | Line 66: | ||
===== Generate the SAML SP metadata ===== | ===== Generate the SAML SP metadata ===== | ||
- | After configuring the SAML SP, you can download the SAML SP metadata directly by navigating to the URL '' | + | After configuring the SAML SP and logged on as root, you can download the SAML SP metadata directly by navigating to the URL '' |
The resulting XML file can be sent to the SAML IdP administrators and contains all information necessary to set up the trust relationship on the IdP side. After the SAML IdP has been configured with the SP metadata, users will be able to authenticate successfully with Stages through the SAML IdP. | The resulting XML file can be sent to the SAML IdP administrators and contains all information necessary to set up the trust relationship on the IdP side. After the SAML IdP has been configured with the SP metadata, users will be able to authenticate successfully with Stages through the SAML IdP. | ||
===== ===== | ===== ===== | ||
+ | |||
===== Configure the SAML Identity Provider (IdP) ===== | ===== Configure the SAML Identity Provider (IdP) ===== | ||
Line 87: | Line 89: | ||
* EMailAddress | * EMailAddress | ||
- | for the following configuration:< | + | for the following configuration: |
+ | < | ||
< | < | ||
Line 96: | Line 99: | ||
providerUrl="< | providerUrl="< | ||
nameIdPolicyFormat=" | nameIdPolicyFormat=" | ||
+ | sendBinding=" | ||
userFullnameTemplate=" | userFullnameTemplate=" | ||
Line 180: | Line 184: | ||
After you configured the service provider and identity provider in '' | After you configured the service provider and identity provider in '' | ||
+ | |||
+ | |||
+ | ===== Changing the license pool and license type for existing users ===== | ||
+ | |||
+ | By default, existing users are not modified by the SAML authentication process when the SAML configuration was changed after the user had been created. However, you can set the '' | ||
===== Configuring Stages attributes in default-matcher section with JavaScript ===== | ===== Configuring Stages attributes in default-matcher section with JavaScript ===== | ||
Line 208: | Line 217: | ||
</ | </ | ||
- | **JavaScript notation of value conditions: | + | **JavaScript notation of value conditions: |
+ | |||
+ | SAML Attributes that are defined via identity_provider_attribute elements can be used in these scripts. E.g. | ||
+ | |||
+ | < | ||
+ | < | ||
+ | |||
+ | </ | ||
+ | |||
+ | < | ||
+ | Attribute contains value: | ||
+ | |||
+ | </ | ||
< | < | ||
- | <saml_attribute> | + | <saml_attribute_id> |
+ | < | ||
</ | </ | ||
Line 218: | Line 240: | ||
< | < | ||
- | <saml_attribute> | + | <saml_attribute_id> |
+ | < | ||
</ | </ | ||
Line 225: | Line 248: | ||
* The pattern matches the entry of the SAML attribute " | * The pattern matches the entry of the SAML attribute " | ||
- | * Depending on the users' email address (domain-part), | + | * Depending on the users' email address (domain-part), |
< | < | ||
< | < | ||
- | | + | |
| | ||
| | ||
- | if (mail.match(/ | + | if (email.match(/ |
- | else if (mail.match(/ | + | else if (email.match(/ |
else ' | else ' | ||
" | " | ||
| | ||
- | if (mail.match(/ | + | if (email.match(/ |
- | else if (mail.match(/ | + | else if (email.match(/ |
else ' | else ' | ||
" | " | ||
| | ||
- | if (mail.match(/ | + | if (email.match(/ |
else ''; | else ''; | ||
" | " | ||
Line 249: | Line 272: | ||
</ | </ | ||
+ | |||
+ | Please note that the values of multi value attributes are provided to the scripts as one value as a comma separated string. | ||
===== ===== | ===== ===== | ||
+ | |||
===== Configure the SAML Request Type ===== | ===== Configure the SAML Request Type ===== | ||
Line 269: | Line 295: | ||
Stages SAML has successfully been deployed with the following IdP servers: | Stages SAML has successfully been deployed with the following IdP servers: | ||
+ | * Azure AD IdP | ||
+ | * Okta | ||
+ | * JumpCloud | ||
* Cisco Central Web Authentication (CWA) | * Cisco Central Web Authentication (CWA) | ||
* Oracle Access Manager (OAM) | * Oracle Access Manager (OAM) | ||
* Shibboleth IdP | * Shibboleth IdP | ||
* Active Directory Federation Services (ADFS) | * Active Directory Federation Services (ADFS) | ||
- | * Azure AD IdP | ||
Please let us know if you were able to make Stages SAML work with your server and it is not on this list yet. | Please let us know if you were able to make Stages SAML work with your server and it is not on this list yet. | ||