View Attach (6) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
png
 csutom_app_new_attribute.png 55.0 kB 2 05-Dec-2023 05:32 krivacsz
png
 custom_app.png 105.1 kB 1 05-Dec-2023 05:32 krivacsz
png
 custom_app_assign_users.png 64.1 kB 1 05-Dec-2023 05:32 krivacsz
png
 custom_app_attribute_mappings_... 43.2 kB 1 05-Dec-2023 05:32 krivacsz
png
 custom_app_crushftp_settings.p... 217.3 kB 1 05-Dec-2023 05:32 krivacsz
png
 custom_app_settings.png 149.6 kB 1 05-Dec-2023 05:32 krivacsz

This page (revision-60) was last changed on 22-May-2025 05:11 by krivacsz

This page was created on 05-Dec-2023 05:32 by krivacsz

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 2 changed 2 lines
Amazon supports custom SAML 2.0 applications. See [https://docs.aws.amazon.com/singlesignon/latest/userguide/samlapps.html]\\
\\
Amazon supports custom SAML 2.0 applications. See [Amazon: Set up your own SAML 2.0 application Link|https://docs.aws.amazon.com/singlesignon/latest/userguide/customermanagedapps-set-up-your-own-app-saml2.html]\\
----
⚠️ __Important__: User to the SAML Provider Is Not Supported. Amazon SAML 2.0 does not support automatic redirection of CrushFTP users to the SAML provider using a direct login URL like:\\
{{{
https://domain.com/?u=SSO_SAML&p=redirect
}}}\\
Users must access the application through the SAML identity provider’s portal (such as AWS IAM Identity Center or similar), where they are authenticated and then redirected back to CrushFTP.\\
----
⚠️ __Proxy Configuration__: If your server accesses the internet through a proxy, make sure to whitelist the following domains required for __Amazon SAML SSO__ to function properly:\\
• __signin.aws.amazon.com__\\
• __sts.amazonaws.com__\\
• __iam.amazonaws.com__\\
• __amazonaws.com__ (general endpoint access)\\
----
At line 6 changed one line
Open the IAM Identity Center Console [https://console.aws.amazon.com/singlesignon] and create a new custom application.\\
Open the IAM Identity [Center Console Link|https://console.aws.amazon.com/singlesignon] and create a new __custom application__.\\
\\
At line 9 changed one line
Configure the name, Application ACS URL, and SAML Audience, then submit the application.\\
Configure SAML Settings:\\
Enter the __Application Name__, __Application ACS URL__, and __SAML Audience__ in the provided fields.\\
Once all required values are set, click Submit to complete the application setup.\\
At line 16 changed one line
https://your.crushftp.com/?u=SSO_SAML&p=none
https://your.crushftp.com/
At line 21 changed one line
Configure the attribute mappings of your application.\\
Configure Attribute Mappings:\\
Set up the attribute mappings for your application to define which user details (such as username, email, or roles) are passed during the SAML authentication process.\\
These mappings ensure that the correct user information is shared between your identity provider and the application.\\
At line 25 changed one line
Add new attribute mapping.\\
Add New Attribute Mapping:\\
To create a new attribute mapping, specify the value you want to send to the application. In the field __Maps to this string value or user attribute in IAM Identity Center,__ enter:
At line 48 added 2 lines
This maps the attribute to the user’s unique identifier in IAM Identity Center, typically used as the username or user ID during authentication.\\
\\
At line 32 changed one line
__Warning:__ Assign users/groups to the created application!\\
⚠️ __Warning__: Assign Users/Groups to the Application!\\
After creating the application, make sure to assign the appropriate users or groups to it in your IAM Identity Center.\\
At line 38 changed one line
Download the IAM Identity Center SAML metadata file.\\
⚠️ Download the __IAM Identity Center SAML metadata__ file. This file contains important configuration details required by the service provider (e.g., CrushFTP) to establish a secure SAML connection.\\
At line 40 changed 16 lines
<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://portal.sso.us-east-1.amazonaws.com/saml/assertion/XXX">
<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MXXXX</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://portal.sso.us-east-1.amazonaws.com/saml/logout/XX"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://portal.sso.us-east-1.amazonaws.com/saml/logout/X"/>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://portal.sso.us-east-1.amazonaws.com/saml/assertion/XX"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://portal.sso.us-east-1.amazonaws.com/saml/assertion/XX"/>
</md:IDPSSODescriptor>
</md:EntityDescriptor>
[Amazon SSO SAML 2.0 Configuration] [CrushFTP settings]
entityID value of IAM Identity Center SAML metadata XML file -> SAML Provider URL (EntityID)
Application SAML audience -> SAML Audience
SingleSignOnService SAML:2.0:bindings:HTTP-POST Location value
of IAM Identity Center SAML metadata XML file -> IDP Redirect URL (HTTP-POST)
IAM Identity Center SAML issuer URL -> SAML Issuer
X509Certificate value of IAM Identity Center SAML metadata XML file -> Base64 encoded PEM Signing certificate
At line 75 added 6 lines
On CrushFTP SAMLSSO plugin for __Authentication type:__ set __urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport__\\
\\
{{{
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
}}}\\
\\
Version Date Modified Size Author Changes ... Change note
60 22-May-2025 05:11 3.878 kB krivacsz to previous
59 22-May-2025 05:11 3.882 kB krivacsz to previous | to last
58 22-May-2025 05:08 3.579 kB krivacsz to previous | to last
57 22-May-2025 05:07 3.617 kB krivacsz to previous | to last
56 22-May-2025 05:03 3.254 kB krivacsz to previous | to last
55 22-May-2025 05:03 3.255 kB krivacsz to previous | to last
54 22-May-2025 05:01 3.112 kB krivacsz to previous | to last
53 22-May-2025 05:00 2.995 kB krivacsz to previous | to last
52 22-May-2025 04:58 2.66 kB krivacsz to previous | to last
51 22-May-2025 04:56 2.393 kB krivacsz to previous | to last
50 22-May-2025 04:55 2.266 kB krivacsz to previous | to last
49 22-May-2025 04:54 2.257 kB krivacsz to previous | to last
48 22-May-2025 04:54 2.257 kB krivacsz to previous | to last
47 22-May-2025 04:54 2.261 kB krivacsz to previous | to last
46 22-May-2025 04:54 2.261 kB krivacsz to previous | to last
45 22-May-2025 04:53 2.265 kB krivacsz to previous | to last
44 22-May-2025 04:52 2.251 kB krivacsz to previous | to last
43 05-Dec-2023 05:32 2.164 kB krivacsz to previous | to last
42 05-Dec-2023 05:32 2.182 kB krivacsz to previous | to last
41 05-Dec-2023 05:32 2.202 kB krivacsz to previous | to last
« This page (revision-60) was last changed on 22-May-2025 05:11 by krivacsz
G’day (anonymous guest)
CrushFTP11 | What's New

Referenced by
LeftMenu

JSPWiki