Can someone explain Saml2 authentication process? I have installed ckanext-saml2 extension for ckan.I have a extra button in login form which is called login with sso.But I donot have any sp metadata(sp.xml).Also I have idp.xml but what should I write to the this file.Do you have any idea about these files?Should I create a sp.xml file?Also should I change idp.xml file?When I click the button where should I read user information ?
You shouldn't change the idp.xml.
Basically ckanext-saml2 is used to allow Users to enter CKAN portal from other places, rather than only CKAN.
In order to do that, you'll need an idp.xml and sp.xml files.
idp.xml - file that consists of a unique path to the remote Portal where all Users already exists (usually it marked as entityID) and X509 Certificate.
sp.xml - file that is generated by CKAN portal and has pretty much same data as the idp.xml.
Both of those files are used to allow Users to log in into CKAN from other portals. In other words, sp.xml file is provided to the IdP (Identity Provider) and the idp.xml file is provided to the CKAN portal (Service Provider) that is going to use it.
According to the ckanext-saml2 documentation, all configuration should be done in ckanext/saml2/config/sp_config.py file. Configuration should consist entityID URL from idp.xml, path to the idp.xml file, path to logs, data about the CKAN portal, fields that should be taken from the response, their mapping and so on...
After the configuration done, according to documentation, you will be able to generate the sp.xml from the sp_config.py file by using python make_metadata.py sp_config.py.
The button on the login page should redirect you to the IdP login page, where you should log in and be redirected back to CKAN. CKAN will automatically create a User for you if it not exists on the CKAN Portal using the response from the IdP.
For more details, you can check out the Datashades SAML2 CKAN repo or at the original once.
if you are not sure about SSO then you need to have a good reading about that.
Can you tell us what kind of IdP you integrate with? AD FS?
Your sp.xml should be generated by the ckanext-saml2 extension, have a look their git hub page. Then you need to upload sp.xml (sp metadata to your IdP)
Related
I have a little bit of problem with the authentication on Sitecore website. Basically there is a button on the navbar, and when user clicks on the button, it redirects the same user to Salesforce to log in (Implementation of SSO). Basically I am using Salesforce as a identity provider and Sitecore Website as a service provider. Now I have a question? When user is logged, how can I get the ID of that user.
Do users in Sitecore User Manager have the same ID as the users in Salesforce, or I can just get a email to identify the user?
P.S: Sorry if this is a really stupid question, but I am a begineer when it comes to making Sitecore websites and the SAML SSO. Thank you in advance
Stop with the Sitecore and Salesforce for a second, you'll need to cover some basics and click through the login process manually before you automate it.
You probably are using a "connected app" in Salesforce that includes OAuth2 config (consumer key also known as client id; a secret; a list of scopes telling what this app is allowed to do on behalf of this SF user; a list of allowed urls that can login using this consumer key and secret. Etc.) It might even have something about Canvas Apps at bottom of the page.
Next would be - who's logging in. A core Salesforce user or do you have Partner Community, Customer Community (recently rebranded to "Digital Experiences").
Open incognito window and go to https://openidconnect.herokuapp.com/
For login host leave as is if you have production user or test.salesforce.com if you go from sandbox (you can also use branded urls, mycompany--dev.my.salesforce.com etc). If you have a community user you'll have to change the url to whatever is the community base url, like https://dev-mycompany.cs123.force.com/mycommunity
Don't change anything else, click next, next, next. This will take you through OAuth2 "web server flow" (one of many ways to log in). You type the username/password to SF screen and go back to that herokuapp with "authorisation code". The app has few minutes to swap that code for actual final "access token" and couple other pieces of info. Final step in this wizard calls OpenId "userinfo" - returning some info about the user that logged in. That's where you could pull the email if needed (and if there are extra fields you'd like SF to return in this process that's configurable too)
Close that browser window. Check the "connected app" in SF. Open new incognito window, do same thing but this time put your url, consumer key and secret (you might have to edit the app in SF first to allow callbacks to https://openidconnect.herokuapp.com/callback).
So now you should have rough idea about whole login process. Your sitecore app probably does same thing, receives authorisation code and exchanges it for final token. At that point you have valid SF session ID you could use to call that "userinfo", run queries (if the app allowes API access, check the "scopes") etc.
I doubt the Sitecore developer created it all by hand, you probably have some Spring stuff like spring.security.oauth2.client... My Java days are long gone but if you get better at manual click-click-click through the flow you should be able to follow existing code?
It's a big topic and there are other ways to do it (other OAuth flows, sending info about the current user when you have external page embedded in SF as iframe, you'd need to read about "canvas apps")... but that's best guess based on info you provided. You might want to check some trailhead courses too like https://trailhead.salesforce.com/content/learn/projects/build-a-connected-app-for-api-integration/implement-the-oauth-20-web-server-authentication-flow
https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm
https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/code_sample_auth_oauth.htm (Java but very hand-crafted raw HTTP, probably that Spring security is better)
I am trying to setup SSO for PSM application as per this link - https://www.ibm.com/support/knowledgecenter/en/SSL5ES_2.3.2.0/intel/iwd/aat_sec_sso.html
It says I should - upload the IdP metadata XML file received from the Identity Provider.
The Identity provider available in-house is Active Directory.
How to get the metadata XML for Active Directory ?
I am unable to find it .
Thanks,
ADFS does not provide SAML IdP meta data alone, but Federation meta data. Typically you can get it from https://FQDN_OF_THE_ADFS_SERVER/FederationMetadata/2007-06/FederationMetadata.xml
Then you need to extract the SAML IdP meta data from it. Alternatively you may reach out to the ADFS admnistrator and request it. Judging from my experience, you mostly also get the Federation meta data, instead of the SAML one.
SAML metadata is used to share configuration information between the Identity Provider (IdP) and the Service Provider (SP). Metadata for the IdP and the SP is defined in XML files:
The IdP metadata XML file contains the IdP certificate, the entity ID, the redirect URL, and the logout URL, for example, saml_idp_metadata.xml.
The SP metadata XML file contains the SP certificate, the entity ID, the Assertion Consumer Service URL (ACS URL), and a log out URL (SingleLogoutService), for example, saml_sp_metadata.xml.
Before using SAML to log on to the Web Console, metadata from the IdP must be uploaded and metadata from the SP must be generated. After the SP metadata is generated, it must be shared with the IdP. Contact the IdP for instructions on securely sharing the SP metadata.
Download Windows Identity Foundation SDK, below url
https://www.microsoft.com/en-us/download/details.aspx?id=4451
After install run fedutil.exe from sdk
After open federation utility Create one empty web.config file with following content
Now paste the web config path in “Application configuration location”.
Paste application url under section Application URL, click next
Select Use an Existing STS, click next
Put metadata xml url , which is provided by client.
Click next., select no encryption.
Click next to add claims
Click next then you will get the summery.
Click finish., find location of web.config file, at that location one folder is created names as “FederationMetadata”
Open this folder “FederationMetadata”, inside this one folder is exists, inside this folder one file is exists named as “FederationMetadata.xml”.
This is your final xml file.
Take a sample userid, password from adfs/server team, to test your application.
Then after open metadata xml and provide claims to adfs teams like
Group
Department
Mail
EmailAddesss
Given Name
Name
Name ID
Windows account name
Once get confirmation from Adfs team (he will create trust on his server using our xml file). We can test our application using shared user credentials.
I need to set up Shibboleth IdP to validate user name and password against a custom application.
Our application exposes a REST API to which one can pass a user's credentials and either returns a 401 on failure or a JSON object with some user metadata on success.
I was able to achieve this in SimpleSamlPHP IdP with a 30-line class, but having to switch to Shibboleth, I am having a hard time finding directions to do the same there.
Reading through the documentation the suggested solution seems to be to create a custom back end for the password login flow but the Wiki does not explain in detail how to do this.
Can somebody point me out to some tutorials or sample code on which files need to be created or changed in order to do this (even basic examples of checking against a credential file or database would be fine)?
You are looking for an [External Authentication Flow] (https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAuthnConfiguration)
For an example, see the shib-cas-authn3 project (https://github.com/Unicon/shib-cas-authn3). It uses the CAS Server to authenticate the users. It then creates an IdP session from information retrieved from CAS.
I hit the below error when trying to insert the permission
"code": 403,
"message": "The authenticated user has not granted the app xxx write access to the child file xxx, which would be affected by the operation on the parent"
Here is what I am doing
We have two Google Account,
1. API Account - we used to create folder and change the ownership to Business account
2. Business Account - upload a file
now we try to share to folder to customer and we hit the above error
And here I using OAuth 2.0 Installed Applications to get the access token.
Please advise what is wrong I am doing here
I had the same issue but I realize that its because of the scope for credential wasn't setup properly. I only had DriveScopes.DRIVE_METADATA set which was not enough for downloading files. Once I added DriveScopes.DRIVE_FILE, DriveScopes.DRIVE, and DriveScopes.DRIVE_APPDATA, I was able to download the file without any problem. Hope this helps.
P.S. if you are changing credentials, you have to delete the previously saved credential file.
Based on the Official Google Documentation you received '403: The user has not granted the app' because the request is not on the ACL for the file. The user never explicitly opened the file with this Drive app.
It is highly recommended to use Google Open Picker and prompt the user to open the file or direct the user to Drive to open the file with the app.