View Attach (2) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
png
 saml1.png 177.8 kB 1 25-Oct-2018 04:31 Ben Spink
png
 saml2.png 211.5 kB 1 25-Oct-2018 04:31 Ben Spink

This page (revision-14) was last changed on 17-Dec-2020 07:28 by Ben Spink

This page was created on 25-Oct-2018 04:31 by Ben Spink

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 1 changed one line
!!The SAMLSSO plugin requires an enterprise license.\\
!!Enterprise Licenses Only\\
SAMLSSO Plugin\\
At line 3 changed one line
This plugin is for advanced users in an organization using SAML.
This plugin is for advanced users in an organization using SAML. While this config is generic (from [Okta]) in its description to all SAML providers, see the Microsoft ADFS config example for specifics on ADFS. *[SAMLSSO_ADFS]*\\
!For a generic config, you can get these items from the 'config.xml' (Keycloak for example):\\
{{{
CrushFTP:Redirect URL = HTTP-POST URL
CrushFTP:SAML Provider URL = EntityID
CrushFTP:SAML Issuer = ClientID (or ApplicationID)
CrushFTP:Signing certificate = X.509 Certificate
}}}
\\
For configuring through a DMZ, this requires Crush 8.3.0_8+ and for both the DMZ instance and internal instance to have identical configurations. If you are using the groups attribute in SAML to specify group memberships, add them into the LDAP roles area using the same group name SAML returns. Set the cache timeout to be "-1" and it will skip connecting to the LDAP configured server info. (Which is what you want if using SAML groups.) If you don't have LDAP and don't have groups being passed through, you can add the special group name "-ALL_ROLES-" and it will allow all logins from SAML.\\
\\
This plugin can be linked together with the WebApplication plugin for a scenario where your LDAP does not apply to your SAML logins. *[SAMLSSO_WebApplication]*\\
!!1)\\
The top half controls the connection parameters to the SAML provider server.\\
We provide an example screenshot for an OKTA account. Both HTTP POST and redirect modes are supported.\\
[attachments|saml1.png]\\
\\
!!2)\\
The lower half controls what to do with the resulting user that is validated once they are redirected back to your CrushFTP server. This mainly contains configuration items related to LDAP. An LDAP server is required for looking of role associations for the user that SAML validated.\\
[attachments|saml2.png]\\
\\
!!3)\\
The final item is using a Url like this to make CrushFTP redirect a user to the SAML provider.\\
{{{
http://domain.com/?u=SSO_SAML&p=redirect
}}}
This could be placed on your login page, or even use javascript to auto redirect the user to that URL.\\
\\
Be certain the Preferences, Misc tab has the remember invalid usernames configured to 0 seconds or your SAML login will get rejected since CrushFTP caches the username as being invalid and doesn't even ask the plugin.\\
\\
Also be sure prefs.XML has "http_redirect_base" set to a blank value, or your actual URL, or else the redirection will be blocked.\\
Version Date Modified Size Author Changes ... Change note
14 17-Dec-2020 07:28 2.527 kB Ben Spink to previous
13 21-May-2020 03:36 2.525 kB Ben Spink to previous | to last
12 19-Nov-2018 04:07 2.368 kB Ben Spink to previous | to last
11 19-Nov-2018 04:05 2.347 kB Ben Spink to previous | to last
10 25-Oct-2018 04:31 2.069 kB Ben Spink to previous | to last
9 25-Oct-2018 04:31 2.069 kB Ben Spink to previous | to last
8 25-Oct-2018 04:31 1.62 kB Ben Spink to previous | to last
7 25-Oct-2018 04:31 1.482 kB Ben Spink to previous | to last
6 25-Oct-2018 04:31 1.49 kB Ben Spink to previous | to last
5 25-Oct-2018 04:31 1.488 kB Ben Spink to previous | to last
4 25-Oct-2018 04:31 1.321 kB Ben Spink to previous | to last
3 25-Oct-2018 04:31 1.171 kB Ben Spink to previous | to last
2 25-Oct-2018 04:31 1.17 kB Ben Spink to previous | to last
1 25-Oct-2018 04:31 0.126 kB Ben Spink to last
« This page (revision-14) was last changed on 17-Dec-2020 07:28 by Ben Spink
G’day (anonymous guest)
CrushFTP9 | What's New

Referenced by
Enterprise License Enhancements
LeftMenu

JSPWiki