Skip to content

Commit 884fc25

Browse files
maximthomasmaximthomas
committed
SSO Configuration: OpenIG as SAML Service Provider for OpenAM
1 parent 8368c17 commit 884fc25

File tree

1 file changed

+336
-0
lines changed

1 file changed

+336
-0
lines changed

‎_posts/2025-11-25-openam-openig-saml.md‎

Lines changed: 336 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,336 @@
1+
---
2+
layout: home
3+
title: "SSO Configuration: OpenIG as SAML Service Provider for OpenAM"
4+
landing-title2: "SSO Configuration: OpenIG as SAML Service Provider for OpenAM"
5+
description: "Implement SAML 2.0 Single Sign-On (SSO) instantly using OpenIG as a proxy and OpenAM as your Identity Provider. This guide details the setup of OpenAM Fedlet and OpenIG configurations via Docker, allowing you to add robust SAML authentication to any application without modifying its source code. Achieve enterprise-grade access management with minimal effort."
6+
keywords: 'SAML 2.0, Single Sign-On, SSO, OpenIG, OpenAM, Identity Provider, Service Provider, IdP, SP, Fedlet, Open Identity Platform, enterprise security, authentication, proxy, Docker, access management, technical guide, SAML configuration, OpenAM configuration, OpenIG configuration, secure applications, no-code authentication'
7+
imageurl: 'openam-og.png'
8+
share-buttons: true
9+
products:
10+
- openam
11+
- openig
12+
---
13+
14+
# SSO Configuration: OpenIG as SAML Service Provider for OpenAM
15+
16+
## Introduction
17+
18+
The SAML 2.0 protocol is the standard for Single Sign-On (SSO) in enterprise environments. In this guide, we will show you how to use OpenIG as a proxy and service provider to easily add SAML authentication to any of your applications without changing its code.
19+
20+
## Preparation
21+
22+
1. To simplify service deployment, we will use OpenAM and OpenIG's Docker images. Therefore, you must have Docker installed.
23+
2. Enter the host names for OpenAM and OpenIG in the `hosts` file. On Windows systems, the hosts file is located in the `C:\Windows/System32/drivers/etc/hosts` directory, and on Linux or Mac OS, it is located in `/etc/hosts`.
24+
25+
```
26+
127.0.0.1 openam.example.org openig.example.org
27+
```
28+
29+
## Configuring OpenAM
30+
31+
### Installing OpenAM
32+
33+
Deploy the OpenAM container with the command:
34+
35+
```bash
36+
docker run -h openam.example.org -p 8080:8080 --name openam openidentityplatform/openam
37+
```
38+
39+
And perform the initial configuration:
40+
41+
```bash
42+
docker exec -w '/usr/openam/ssoconfiguratortools' openam bash -c \
43+
'echo "ACCEPT_LICENSES=true
44+
SERVER_URL=http://openam.example.org:8080
45+
DEPLOYMENT_URI=/$OPENAM_PATH
46+
BASE_DIR=$OPENAM_DATA_DIR
47+
locale=en_US
48+
PLATFORM_LOCALE=en_US
49+
AM_ENC_KEY=
50+
ADMIN_PWD=passw0rd
51+
AMLDAPUSERPASSWD=p@passw0rd
52+
COOKIE_DOMAIN=example.org
53+
ACCEPT_LICENSES=true
54+
DATA_STORE=embedded
55+
DIRECTORY_SSL=SIMPLE
56+
DIRECTORY_SERVER=openam.example.org
57+
DIRECTORY_PORT=50389
58+
DIRECTORY_ADMIN_PORT=4444
59+
DIRECTORY_JMX_PORT=1689
60+
ROOT_SUFFIX=dc=openam,dc=example,dc=org
61+
DS_DIRMGRDN=cn=Directory Manager
62+
DS_DIRMGRPASSWD=passw0rd" > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
63+
```
64+
65+
### OpenAM Identity Provider Setup
66+
67+
1. Access the administrator console via the link [http://openam.example.org:8080/openam](http://openam.example.org:8080/openam). Use the login `amadmin` and password `passw0rd`.
68+
2. Select Top Level Realm
69+
3. Go to **Create SAMLv2 Providers** → **Create Hosted Identity Provider**
70+
4. Set Metadata Name: `openam`
71+
5. In the Signing Key setting, select `test`
72+
6. Enter the name of the Circle of Trust, for example, `cot`
73+
7. In the Attribute Mapping section, add the mapping uid → uid, mail → mail
74+
8. Click **Configure**
75+
76+
### OpenAM Fedlet Configuration
77+
78+
1. Open the administrator console
79+
2. Select Top Level Realm
80+
3. Go to **Create Fedlet Configuration**
81+
4. Enter the fedlet name in the Name field, for example, openig.
82+
5. Set the **Destination URL of the Service Provider which will include the Fedlet** to the URL that points to OpenIG: `http://openig.example.org:8081/saml`
83+
6. In the Attribute Mapping section, add the mapping uid → uid, mail → mail
84+
7. Click **Create**
85+
86+
The Fedlet settings will be saved in the container in the directory `/usr/openam/config/myfedlets/openig/Fedlet.zip`.
87+
88+
Copy the settings to the host machine using the command:
89+
90+
```bash
91+
docker cp openam:/usr/openam/config/myfedlets/openig/Fedlet.zip .
92+
```
93+
94+
### Preparing a test user
95+
96+
1. Open the administrator console
97+
2. Select Top Level Realm
98+
3. In the left pane, select Subjects
99+
4. In the list of accounts, open the `demo` account
100+
5. In the Email Address field, enter `[email protected]` or another valid email
101+
6. Click **Save**
102+
103+
## OpenIG Setup
104+
105+
### Preparing OpenIG Configuration Files
106+
107+
1. Create a directory for OpenIG configuration files `openig-saml`
108+
2. Add a directory `config` to it
109+
3. In the `config` directory, create the files `admin.json` and `config.json`:
110+
111+
`admin.json`:
112+
```json
113+
{
114+
"prefix" : "openig",
115+
"mode": "PRODUCTION"
116+
}
117+
```
118+
119+
`config.json`:
120+
```json
121+
{
122+
"heap": [
123+
{
124+
"name": "JwtSession",
125+
"type": "JwtSession"
126+
},
127+
{
128+
"name": "capture",
129+
"type": "CaptureDecorator",
130+
"config": {
131+
"captureEntity": true,
132+
"_captureContext": true
133+
}
134+
}
135+
],
136+
"handler": {
137+
"type": "Chain",
138+
"config": {
139+
"filters": [],
140+
"handler": {
141+
"type": "Router",
142+
"name": "_router",
143+
"capture": "all"
144+
}
145+
}
146+
}
147+
}
148+
```
149+
150+
4. Add a directory for routes named `routes` to the `config` directory.
151+
5. Add the default route `99-default.json` to the `routes` directory. OpenIG will serve static content on this route and will not require authentication:
152+
153+
```json
154+
{
155+
"handler": {
156+
"type": "DispatchHandler",
157+
"config": {
158+
"bindings": [
159+
{
160+
"handler": {
161+
"type": "StaticResponseHandler",
162+
"config": {
163+
"status": 200,
164+
"reason": "OK",
165+
"entity":
166+
"<!doctype html>
167+
<html>
168+
<head>
169+
<title>Home</title>
170+
<meta charset='UTF-8'>
171+
</head>
172+
<body>
173+
<h1><a href='/app'>Login</a></h1>
174+
</body>
175+
</html>"
176+
}
177+
}
178+
}
179+
]
180+
}
181+
},
182+
"session": "JwtSession"
183+
}
184+
```
185+
186+
6. Start the OpenIG Docker container with the command. Note the mounted directory `/app-saml`.
187+
188+
```bash
189+
docker run -h openig.example.org -p 8081:8080 --name openig \
190+
-v ./app-saml:/usr/local/app-saml:ro \
191+
-e "CATALINA_OPTS=-Dopenig.base=/usr/local/app-saml" \
192+
openidentityplatform/openig
193+
```
194+
195+
7. Check if the application is working:
196+
197+
```bash
198+
$ curl -v http://openig.example.org:8081
199+
* Trying 127.0.0.1:8081...
200+
* Connected to openig.example.org (127.0.0.1) port 8081 (#0)
201+
> GET / HTTP/1.1
202+
> Host: openig.example.org:8081
203+
> User-Agent: curl/7.81.0
204+
> Accept: */*
205+
>
206+
* Mark bundle as not supporting multiuse
207+
< HTTP/1.1 200
208+
< Content-Length: 146
209+
< Date: Mon, 24 Nov 2025 12:46:56 GMT
210+
<
211+
<!doctype html>
212+
<html>
213+
<head>
214+
<title>Home</title>
215+
<meta charset='UTF-8'>
216+
</head>
217+
<body>
218+
<h1><a href='/app'>Login</a></h1>
219+
</body>
220+
```
221+
### Configuring SAML Fedlet in OpenIG
222+
223+
1. In the `openig-saml` directory, create a directory named `SAML`.
224+
2. Copy the contents of the Fedlet.zip archive that you received from OpenAM into this directory.
225+
226+
```bash
227+
unzip Fedlet.zip
228+
cp conf/* app-saml/SAML/
229+
```
230+
231+
3. Create a route for obtaining credentials from SAML assertions `05-saml.json`
232+
```json
233+
{
234+
"handler": {
235+
"type": "SamlFederationHandler",
236+
"config": {
237+
"assertionMapping": {
238+
"uid": "uid",
239+
"mail": "mail"
240+
},
241+
"redirectURI": "/app"
242+
}
243+
},
244+
"condition": "${matches(request.uri.path, '^/saml')}",
245+
"session": "JwtSession"
246+
}
247+
```
248+
249+
4. Create a route for the application requiring SAML authentication `05-app.json`:
250+
251+
```json
252+
{
253+
"handler": {
254+
"type": "DispatchHandler",
255+
"config": {
256+
"bindings": [
257+
{
258+
"condition": "${empty session.uid}",
259+
"handler": {
260+
"type": "StaticResponseHandler",
261+
"config": {
262+
"status": 302,
263+
"reason": "Found",
264+
"headers": {
265+
"Location": [
266+
"http://openig.example.org:8081/saml/SPInitiatedSSO"
267+
]
268+
}
269+
}
270+
}
271+
},
272+
{
273+
"handler": {
274+
"handler": {
275+
"type": "StaticResponseHandler",
276+
"config": {
277+
"status": 200,
278+
"reason": "OK",
279+
"entity":
280+
"<!doctype html>
281+
<html>
282+
<head>
283+
<title>OpenID Connect Discovery</title>
284+
<meta charset='UTF-8'>
285+
</head>
286+
<body>
287+
<h1>User: ${session.uid}, email: ${session.mail} </h1>
288+
</body>
289+
</html>"
290+
}
291+
}
292+
}
293+
}
294+
]
295+
}
296+
},
297+
"condition": "${matches(request.uri.path, '^/app')}",
298+
"session": "JwtSession"
299+
}
300+
```
301+
302+
5. Start the OpenIG container:
303+
304+
```bash
305+
docker run -h openig.example.org -p 8081:8080 --name openig \
306+
-v ./app-saml:/usr/local/app-saml:ro \
307+
-e “CATALINA_OPTS=-Dopenig.base=/usr/local/app-saml” \
308+
openidentityplatform/openig
309+
```
310+
311+
## Test the Solution
312+
313+
1. Exit the OpenAM console or open your browser in incognito mode.
314+
2. Open the link to the OpenIG application, which does not require authentication: [http://openig.example.org:8081/](http://openig.example.org:8081/).
315+
316+
![OpenIG Application Login](https://raw.githubusercontent.com/wiki/OpenIdentityPlatform/OpenAM/images/openam-openig-saml/0-openig-application-login.png)
317+
318+
3. Click on the `Login` link.
319+
4. The OpenAM authentication form will open.
320+
5. Enter the demo user credentials. Login: `demo`, password: `changeit`, and click the **Login** button.
321+
322+
![OpenAM Login](https://raw.githubusercontent.com/wiki/OpenIdentityPlatform/OpenAM/images/openam-openig-saml/1-openam-login.png)
323+
324+
6. You will be redirected to the application with the demo user credentials:
325+
326+
![OpenIG Logged In](https://raw.githubusercontent.com/wiki/OpenIdentityPlatform/OpenAM/images/openam-openig-saml/2-openig-logged-in.png)
327+
328+
329+
## Conclusion.
330+
331+
We have successfully configured OpenIG as a Service Provider and implemented SAML 2.0 authentication via OpenAM. You can now use this approach to secure any applications in your infrastructure. The next step could be to configure Log Out.
332+
333+
For more details on configuring OpenAM and OpenIG, please refer to the documentation:
334+
335+
- [https://doc.openidentityplatform.org/openam](https://doc.openidentityplatform.org/openam/)
336+
- [http://doc.openidentityplatform.org/openig](http://doc.openidentityplatform.org/openig)

0 commit comments

Comments
 (0)