At line 1 changed one line |
!!The SAMLSSO plugin requires an enterprise license.\\ |
!!Enterprise Licenses Only\\ |
SAMLSSO Plugin\\ |
At line 3 changed one line |
This plugin is for advanced users in an organization using SAML. |
This plugin is for advanced users in an organization using SAML. While this config is generic (from [Okta]) in its description to all SAML providers, see the Microsoft ADFS config example for specifics on ADFS. *[SAMLSSO_ADFS]* Another example is *[SAMLSSO_AZURE]* config example.\\ |
''Okta calls their generic config 'SAML Service Provider'.''\\ |
!For a generic config, you can get these items from the 'config.xml' (Keycloak for example):\\ |
{{{ |
CrushFTP:Redirect URL = HTTP-POST URL |
CrushFTP:SAML Provider URL = EntityID |
CrushFTP:SAML Issuer = ClientID (or ApplicationID) |
CrushFTP:Signing certificate = X.509 Certificate |
}}} |
\\ |
For configuring through a DMZ, this requires Crush 8.3.0_8+ and for both the DMZ instance and internal instance to have identical configurations. If you are using the groups attribute in SAML to specify group memberships, add them into the LDAP roles area using the same group name SAML returns. Set the cache timeout to be "-1" and it will skip connecting to the LDAP configured server info. (Which is what you want if using SAML groups.) If you don't have LDAP and don't have groups being passed through, you can add the special group name "-ALL_ROLES-" and it will allow all logins from SAML.\\ |
\\ |
This plugin can be linked together with the WebApplication plugin for a scenario where your LDAP does not apply to your SAML logins. *[SAMLSSO_WebApplication]*\\ |
At line 7 changed one line |
We provide an example screenshot for an OKTA account. Both HTTP POST and redirect does are supported.\\ |
We provide an example screenshot for an OKTA account. Both HTTP POST and redirect modes are supported.\\ |
At line 35 added 7 lines |
\\ |
Also be sure prefs.XML has "http_redirect_base" set to a blank value, or your actual URL, or else the redirection will be blocked.\\ |
\\ |
\\ |
---- |
''PLEASE NOTE! Java 16 and above require a JVM flag to allow XML signing. So if you utilize XML signing of your AuthN request and you are using newer Java versions (you should be regardless), then add this JVM flag to allow signing to operate:\\ |
--add-opens=java.xml.crypto/org.jcp.xml.dsig.internal.dom=ALL-UNNAMED'' |