Smartstaff, administrator
687
edits
Changes
various updates
===Prerequisites===
* You must provision your own Identity Provider service, third-party or otherwise, for use with this feature. Enabling and maintaining the Identity Provider is your responsibility.* You must provide SmartSimple with a public key in base64-encoded X.509 Certificate format for digital signature validation.
===SSO Service Provider Configuration in - SmartSimple===Within SmartSimple, SSO settings are accessed through the Global Setting, Connectivity -> Integration tab.
[[imageFile:sso-001.png|thumb|none|middle|600px|Navigating to the SSO configuration.]]
[[imageFile:sso-002.png|thumb|none|middle|400px|SSO configuration settings.]]
* "SSO Alias" is - used to identify the SSO connection and should be configured by default to be 'SAML2'. If multiple SSO connections are to be configured then you may include an additional <Attribute> element on the client-side assertion named 'SSOModule' to specify the SmartSimple connection by matching a unique "SSO Alias" value.* "Unique Identifier Field (UID)" is - used to identify the user account and needs to be an attribute that is unique to each user in SmartSimple. This needs to be an attribute common to both the SmartSimple and the client-side system (typically e-mail address or employee ID).* "X509Certificate (SAML2 Only)" is - the signing certificate to be provided by the client. The formatting of this should be the certificate value without the "begin certificate" and "end certificate" header and footer lines. Also, depending on how the client-side system sends this value within the SAML assertion the certificate value will typically be formatted to just a single line but could also be multiple lines and so must be entered into SmartSimple in the same format.* It is also recommended to disable the Session Timeout Alert setting within the Global Settings -> Security section as that feature would not be applicable to users logged in through single sign-on.
===SSO Identity Provider Configuration in - Client-Side System===
The elements required for setup of the client-side identity provider connection are listed below.
* Unique user identifier. Within - within the SAML assertion, this value can be sent in the standard <NameID> element, or optionally within an <Attribute> element named 'UID'.* Assertion Consumer Service URL. This - this will be equal to '/SAML2/' appended to your SmartSimple instance URL, e.g. '''https://alias.smartsimple.com/SAML2/'''.* Service Provider's Entity ID. This - this can be equal to the same as above Assertion Consumer Service URLto your SmartSimple system.* Service Provider metadata XML- the following is an example service provider metadata that can be used, however you must first replace every instance of 'alias.smartsimple.com' instead with the URL to your SmartSimple system. <pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;"><?xml version="1.0"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2. This is available upon request0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://alias.smartsimple.com/"> <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://alias.smartsimple.com/SAML2/" index="1"/> </md:SPSSODescriptor> <md:ContactPerson contactType="technical"> <md:GivenName>SmartSimple Support</md:GivenName> <md:EmailAddress>support@smartsimple.com</md:EmailAddress> </md:ContactPerson> <md:ContactPerson contactType="support"> <md:GivenName>SmartSimple Support</md:GivenName> <md:EmailAddress>support@smartsimple.com</md:EmailAddress> </md:ContactPerson></md:EntityDescriptor></pre>
====Active Directory Federation Services====
If using ADFS refer to the below steps as related to SmartSimple for setup. Some steps unrelated to your SmartSimple configuration have been omitted.
* Add a new "Relying Party Trust".* "Select Data Source: " - Import the Service Provider metadata XML file obtained from SmartSimple.* "Display Name: " - Give the trust a display name, e.g. 'SmartSimple'.* In Finish the setup, and then return to the claim rules "Claim Rules" editor , and select the "Issuance Transform Rules" tab and add a new rule. The Set the "Rule Type" to use the 'Send LDAP attribute should be mapped Attributes as Claims' template and configure the mapping to the agreed upon user identifier and an (e.g. LDAP attribute 'E-Mail-Addresses' to Outgoing Claim Type of 'NameID').* To test or use this connection you will need to use the your internal ADFS login URL and specify the loginToRp parameter as the SmartSimple SAML entity ID, e.g. '''https://adfs.yourlocaldomain.com/adfs/ls/idpinitiatedsignon.aspx?loginToRp=https://alias.smartsimple.com/SAML2/'''. To create an automatic redirect <br/> If you aren't automatically redirected into SmartSimple you will may need to have RelayState enabled in ADFS , and can then begin using use a RelayState parameter to achieve this, e.g. '''https://adfs.yourlocaldomain.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Dalias3Dhttps%3A%2F%2Falias.smartsimple.com%2F%26RelayState%3Dhttps%253A%252F%252Falias.smartsimple.com%252F'''.
===Optional Information===
The following optional attributes can be used in the assertion:. Please note that they are case sensitive and should be labelled exactly.
* SSOModule - used to specify the SmartSimple SSO connection when there are multiple connections configured.* UID (- can be used instead of NameID as the user identifier).
* Email
* First name
* Last name
* Department- used to update the user's organization. This will attempt to match an organization by name and will move the user to that organization if found.* Roles (- used to update the user's roles in SmartSimple. This should be a comma delimited list of SmartSimple user roles (by name) to be assigned to the user).* Language- used to specify the initial language displayed to the user. This should be an integer value that corresponds with a language ID value in SmartSimple (e.g. 1=English).* RedirectURL- used to specify an initial landing page in SmartSimple. This should be a relative patch (e.g. /iface/ex/ax_index.jsp).
===SAML Assertion Example===
</pre>
<!--
==Cipher encrypted reference==
{{Template:Deprecated-sm}}
End Function
</pre>
[[Category:Integration]]