You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/administration/saml-2-0-configuration.mdx
+89-84Lines changed: 89 additions & 84 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,223 +5,228 @@ sidebar_position: 13
5
5
6
6
Device42 integrates with SAML 2.0 in conjunction with AD or LDAP user synchronizations to provide Single Sign On (SSO) support in Device42. Once users are added to Device42 via Active Directory or LDAP, they will automatically be logged into Device42 when they load the site.
7
7
8
-
_Note_ Since authorization is handled by Device42, the user needs to exist within Device42 before they can log in for single sign on functionality to work.
8
+
:::note
9
+
Since authorization is handled by Device42, the user needs to exist within Device42 before they can log in for single sign on functionality to work.
10
+
:::
9
11
10
12
SAML configuration varies between providers, but we'll provide the steps for configuration with Microsoft ADFS, Okta and Onelogin below as examples. Device42 SSO should also work with **any** SAML2.0 compatible Identity Provider, and has been confirmired working with IDaaS providers Centrify and PingIdentity's PingOne and PingFederate as well.
11
13
12
14
Should you need further assistance, please contact [Support](mailto:[email protected]).
13
15
14
-
###Microsoft ADFS Configuration
16
+
## Microsoft ADFS Configuration
15
17
16
18
Add new relying party trust.
17
19
18
20
19
21
20
-
Next screen: Add data manually.
22
+
Next screen: Add data manually.
21
23
22
24
23
25
24
-
Next screen: Specify your app display name.
26
+
Next screen: Specify your app display name.
25
27
26
-
Next screen: Choose AD FS profile.
28
+
Next screen: Choose AD FS profile.
27
29
28
-
Next screen: Choose SAML 2.0 SSO and set proper D42 ACS url – https://\_\_\_device42\_\_\_url/saml2\_auth/acs/.
30
+
Next screen: Choose SAML 2.0 SSO and set proper D42 ACS url – `https://___device42___url/saml2_auth/acs/`.
29
31
30
32
31
33
32
-
Next screen: Set identifiers access – https://\_\_\_device42\_\_\_url/saml2\_auth/acs/.
34
+
Next screen: Set identifiers access – `https://___device42___url/saml2_auth/acs/`.
33
35
34
36
35
37
36
-
Next screen: Permit all users
38
+
Next screen: Permit all users
37
39
38
-
Next screen: In claims section (click “edit claims” on relying party / automatic go to this section after initial setup), add the following claims
40
+
Next screen: In claims section (click **Edit claims** on relying party / automatic go to this section after initial setup), add the following claims
39
41
40
-
username claim
42
+
The `username` claim:
41
43
42
44
43
45
44
-
nameid claim
46
+
The `nameid` claim:
45
47
46
48
47
49
48
-
Copy metadata url from endpoints
50
+
Copy metadata URL from the endpoints.
49
51
50
52
51
53
52
-
\*\* if you receive time synchronization error please write this command in powershell : Set-ADFSRelyingPartyTrust -TargetIdentifier "" -NotBeforeSkew 5
54
+
If you receive a time synchronization error please write this command in PowerShell:
1. Navigate to Azure AD in the Azure portal _\> Enterprise Applications > New Application > Create your own application_. Give your app a name (the app shown in the screenshots is _Device42SAML_) and select the third option _Integrate any other application..._, then click _Create_.
60
+
## Azure AD Configuration
57
61
58
-
62
+
1. Navigate to Azure AD in the Azure portal via **Enterprise Applications > New Application > Create your own application**. Give your app a name (the app shown in the screenshots is `Device42SAML`) and select the third option **Integrate any other application...**, then click **Create**.
59
63
60
-
2. Open your newly created enterprise app _\> Option 2- Set up Single sign on_, or select _Single sign-on_ under Manage in left-hand toolbar.
64
+
61
65
62
-
66
+
2. Open your newly created enterprise app the select Option 2 **Set up Single sign on**, or select **Single sign-on** under **Manage** in the left-hand toolbar.
63
67
64
-
3. Enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/` in Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) in Section 1 Basic SAML Config.
68
+
65
69
66
-
70
+
3. Enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/`**in Identifier (Entity ID)** and Reply URL **(Assertion Consumer Service URL)** in Section 1 - Basic SAML Config.
67
71
68
-
4. Navigate to the Device42 Appliance Manager > Global Settings > SAML 2.0 Settings. Copy the App Federation Metadata URL in the SAML Signing Certificate section from the enterprise app you created in Azure AD and paste into Metadata auto conf url in the D42 Appliance Manager.
72
+
69
73
70
-
74
+
4. Navigate to the Device42 Appliance Manager and go to **Global Settings > SAML/SSO Settings**. Copy the App Federation Metadata URL in the SAML Signing Certificate section from the enterprise app you created in Azure AD and paste into the **Metadata auto conf url** field in the Device42 Appliance Manager.
75
+
76
+
71
77
72
78
5. While still in the SAML 2.0 settings of the Appliance Manager, enter `username` or other appropriate SAML attribute. Unless you have signed responses configured on your Azure AD provider side, keep **Require signed response** unchecked, otherwise you'll get an unavailable page message.
73
79
74
-
Azure's built-in claims like `emailaddress` may not work with Device42, even though they appear in the Azure interface because the built-in claim uses a namespace URI format. The solution is to create a new claim for `emailaddress` in your Azure AD enterprise app, map the claim to the user attribute and use the custom claim name in the Device42 SAML **Username field**.
80
+
Azure's built-in claims like `emailaddress` may not work with Device42, even though they appear in the Azure interface because the built-in claim uses a namespace URI format. The solution is to create a new claim for `emailaddress` in your Azure AD enterprise app, map the claim to the user attribute, and use the custom claim name in the Device42 SAML **Username field**.
75
81
76
-
Save and restart the appliance from the VM console menu. You may wish to complete steps 6 and 7 before saving or restarting so that you can still login to Device42 and create users with the local admin account you've used so far.
82
+
Save and restart the appliance from the VM console menu. You may wish to complete steps 6 and 7 before saving or restarting so that you can still log in to Device42 and create users with the local admin account you've used so far.
6. Assign users/groups to the SAML enterprise app you created in Azure AD. These should be users/groups that you want to allow authentication into Device42 via this SAML integration.
86
+
6. Assign users or groups to the SAML enterprise app you created in Azure AD. These should be users or groups that you want to allow authentication into Device42 via this SAML integration.
81
87
82
88
7. For any users associated with the enterprise app in Azure AD, create the user in Device42 using the appropriate Azure AD value with a dummy password. The integration does not pull and create users directly from Azure AD, so the users must be created within Device42 prior to any attempt to authenticate via Azure AD.
83
89
84
-
8. Once the above has been completed, you should be able to login to your D42 instance with your Azure AD credentials.
90
+
8. Once the above has been completed, you should be able to login to your Device42 instance with your Azure AD credentials.
In the “Applications” page find “Add application” button and click it.
102
+
In the Applications page, find and click the **Add application** button..
97
103
98
104
99
105
100
-
Choose “Create new app”
106
+
Choose **Create new app**.
101
107
102
108
103
109
104
-
Select platform as Web and sign on method as SAML 2.0.
110
+
Select **Web** as the **Platform**and select **SAML 2.0** and the **Sign on method**.
105
111
106
112
107
113
108
-
Set application preferences and click next
114
+
Set your application preferences and click **Next**.
109
115
110
116
111
117
112
118
On the next page setup ACS url and field mapping. The Single Sign On URL & Audience URI should be `https://yourdevice42address/saml2_auth/acs/`. The Attribute value should be the same AD or LDAP attribute that your users will log into Device42 with. Note the "Name" given to it as this will be needed in the Device42 Appliance Manager configurations.
113
119
114
120
115
121
116
-
Click “Next” and finish setup. Open your application settings, go to the “Sign On” tab and copy url from “Identity provider metadata” link. This will be used as the "Metadata URL" in Device42's Appliance Manager.
122
+
Click **Next** and finish setup. Open your application settings, go to the **Sign On** tab and copy the URL from **Identity provider metadata** link. This will be used as the **Metadata auto conf url** in Device42's Appliance Manager.
117
123
118
124
119
125
120
-
###OneLogin Configuration
126
+
## OneLogin Configuration
121
127
122
128
To configure SAML2 integration between OneLogin and Device42, you have to create a `SAML2 connector app` in OneLogin. Then, you will need to add users to the `SAML2 connector app` so they can login via a OneLogin account.
123
129
124
130
**Creating SAML2 Connector App**
125
131
126
-
1. Create and login into your OneLogin account.
132
+
1. Create and log in to your OneLogin account.
127
133
128
-
2. Create an app connector in OneLogin.
134
+
2. Create an app connector in OneLogin:
129
135
130
-
- Go to Applications > Applications.
136
+
- Go to **Applications > Applications**.
131
137
132
-
138
+
133
139
134
-
- Click Add App.
140
+
- Click **Add App**.
135
141
136
-
142
+
137
143
138
-
3. Search for `SAML custom connector` and select `SAML Custom Connector (Advanced)`
144
+
3. Search for **SAML custom connector** and select **SAML Custom Connector (Advanced)**
139
145
140
-
146
+
141
147
142
-
4. Type a display name and Save.
148
+
4. Type a display name and **Save**.
143
149
144
-
5\. Go to the `Configuration` tab
150
+
5. Go to the **Configuration** tab:
145
151
146
-
- Put the value `https://<<fqdn>>/saml2_auth/acs/` in `Audience (EntityID)`, `Recipient` and `ACS (Consumer)URL`
147
-
- Put `.*` in `ACS(Consumer) URL Validator`
148
-
- Save
152
+
- Put the value `https://<<fqdn>>/saml2_auth/acs/` in **Audience (EntityID)**, **Recipient** and **ACS (Consumer)URL**
153
+
- Put `.*` in **ACS(Consumer) URL Validator**
154
+
- Save
149
155
150
-
156
+
151
157
152
-
6\. Go to the `Parameters` tab and add a new field (by clicking on the `+` icon)
158
+
6. Go to the **Parameters** tab and add a new field by clicking on the **plus icon**.
153
159
154
-
160
+
155
161
156
-
- Type the`username` as `Field name`.
157
-
- Check `Include in SAML assertion`.
162
+
- Type `username` as **Field name**.
163
+
- Check the **Include in SAML assertion** checkbox.
158
164
159
-
165
+
160
166
161
-
-Save
162
-
- Choose the `Username` from the drop down as the value.
167
+
- Click **Save**.
168
+
- Choose the **Username** from the dropdown as the **Value**.
163
169
164
-
170
+
165
171
166
-
-Save
172
+
- Click **Save**.
167
173
168
-
7\. In the `SSO` tab:
174
+
7. In the **SSO** tab:
169
175
170
-
- Copy the “Issuer URL”. This will be entered in the “Metadata URL” field in Device42.
176
+
- Copy the **Issuer URL**. This will be entered in the **Metadata auto conf url** field in Device42.
171
177
172
-
178
+
173
179
174
-
- After this, the SAML2 app is created and ready to be integrated with Device42.
180
+
- After this, the SAML2 app is created and ready to be integrated with Device42.
175
181
176
182
**In Device42 Appliance Manager Configuration**
177
183
178
-
Login to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above.
184
+
Login to the Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to **SAML/SSO settings** on the left, then set the **Metadata auto conf url** you obtained above.
179
185
180
-
186
+
181
187
182
188
After this has been saved, SAML integration should be complete.
183
189
184
-
_Now that SAML integration is complete you need to add users to the_`SAML Connector App`_so they can login into Device42 via OneLogin account._
190
+
Now that SAML integration is complete you need to add users to the`SAML Connector App`so they can log in to Device42 via the OneLogin account.
185
191
186
192
**Create a User in OneLogin**
187
193
188
-
- Go to Users > Users.
189
-
- Click New User.
194
+
- Go to **Users > Users**.
195
+
- Click **New User**.
190
196
191
197
192
198
193
-
- Fill the form. **Username should match the username in device42 app**.
199
+
- Fill the form. **Username should match the username in device42 app**.
194
200
195
201
196
202
197
-
- Save.
203
+
-Click **Save**.
198
204
199
205
**Add User to Application**
200
206
201
-
1. Click on the user name.
207
+
1. Click on the username.
202
208
203
-
2. Go to the `Applications` tab and add `Application` by clicking on the `+` icon.
209
+
2. Go to the **Applications** tab and add an **Application** by clicking on the **plus icon**.
Now you can log into Device42 using the OneLogin account.
224
+
Now you can log in to Device42 using the OneLogin account.
220
225
221
-
###Device42 Appliance Manager Configuration
226
+
## Device42 Appliance Manager Configuration
222
227
223
-
Login to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above. Set the "username" field to match the value you saved in the SAML configuration.
228
+
Log in to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above. Set the **Username field** to match the value you saved in the SAML configuration.
224
229
225
-
230
+
226
231
227
232
After this has been saved, SAML integration should be complete!
0 commit comments