Ubisecure SSO Server is a standards based Identity Provider (IDP). One of the roles of an Identity Provider is to enable federation of user identities from one independent domain to another. Federation is a term used to describe a functionality which transfers a user between two separate IDPs.
Ubisecure SSO provides OpenID Connect, SAML and WS-Federation protocols for identity federation. This page describes how to integrate another domain to a Ubisecure identity domain using SAML 2.0 protocol. This page will describe how to create an IDP Proxy authentication method that will authenticate users from another domain for SPs in the Ubisecure identity domain.
The process of creating a trust relationship from another domain to Ubisecure SSO Server follows the procedure described in the SSO Management documentation, where the other domain is treated as a SAML Service Provider.
|Figure 1. Trust relationships between 2 domains|
This chapter goes through the necessary steps to make Ubisecure SSO Server trust another SAML Identity Provider and to configure the IDP Proxy authentication method.
Configuring Ubisecure Authentication Server as a Trusting Party
Add the trust relationship to the Ubisecure Directory
The IDP Proxy authentication method is added to the Ubisecure Directory by importing a LDIF file. Replace the dn and cn attributes with the name of the IDP Proxy instance and use the following script to import the LDIF to Ubisecure Directory. Note that for the least, you have to change the last part of the distinguished name from dc=localhost to the distinguished name of your local Ubisecure Directory.
You can find an example LDIF excerpt at the end of ubilogin/ldap/methods.ldif under the title SAML Federation.
Import the Identity Provider metadata
Log into Ubisecure Server Management with System Administrator privileges. Navigate to the Server Authentication Methods view. Open the settings of the IDP Proxy method you just installed and choose the SAML view. Click Upload SAML Metadata and either upload the Identity Providers metadata file or copy and paste the metadata.
Export the SAML service provider metadata
Click Download SAML Metadata to download the Service Provider metadata and save it for configuring Ubisecure SSO Server as Service Provider for Identity Provider in the other identity domain.
Once you have configured your Identity Provider to accept SAML authentication requests from Ubisecure SSO Server, the IDP Proxy method has been set up.
Forces value urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified to AuthnContextClassRef in an outbound SAML2 Authentication Response. This is regardless of what might have been received in an inbound SAML2 Authentication Response. This improves compatibility with third-party applications and third-party identity providers which send different values than expected.
In all cases, negotiation between connected parties for agreed values for AuthnContextClassRef should be the first approach.
There are various compatibility flags that can be used with SAML2 Authentication Methods.
|Figure 2. SAML authentication method with SendAssertionConsumerServiceURL feature enabled|
Forces sending AssertionConsumerServiceURL. Some services require this optional element.
Forces sending the Finnish Trust Network SAML 2.0 Protocol Profile version 1.0 compliant SAML2 Extension
Note that only the information listed below is included in the element:
- UI locale of the login page
An example of the included
Extensions element is shown below.
It is possible to configure either AuthnContextClassRef or AuthnContextDeclRef together with Comparison. This is possible by specifying the following configuration
Value of the Comparison attribute of RequestedAuthnContext.
Needs to be one of the following:
This configuration key needs to be configured together either with
If this parameter is left empty, then no Comparison attribute is set for RequestedAuthnContext.
List of values of AuthnContextClassRef elements added to RequestedAuthnContext.
Multiple values are separated by white space.
If this parameter is left empty, then no AuthnContextClassRef elements are added to RequestedAuthnContext.
List of values of AuthnContextDeclRef elements added to RequestedAuthnContext.
Multiple values are separated by white space.
If this parameter is left empty, then no AuthnContextDeclRef elements are added to RequestedAuthnContext.
NOTE: According to SAML2 protocol schema, it's not allowed to add both AuthnContextClassRef and AuthnContextDeclRef elements in an RequestedAuthnContext.
Configuration can be done via management user interface by opening the authentication method from global method settings view (Home → Global Method Settings). Then configure the setting by entering the values into Configuration String text field.
|Figure 3. SAML RequestedAuthnContext configuration|
The following configuration in an authentication method :
Results in the following RequestedAuthnContext in the authentication request: