Single Sign-On

Single Sign-On (SSO) is a technology that lets corporate networks use external user authentication services (also can be called 'identity providers', or IdPs). It is used to set up access authorization within corporate services along with basic authentication methods provided with the local database.

The assigned IdP authenticates users by their logins and passwords. Certain network resources, like applications and servers, are configured to trust the user authentication performed by the IdP. In such cases, users do not need to enter their logins and passwords when accessing these resources.

With SSO enabled, when a user with no active ADFS logon session connects to a SimpleOne instance, they are redirected to the ADFS logon. After typing in their corporate Active Directory (AD) login and password, a user enters an instance with their relevant ID, configuration preferences, membership in groups, roles, and the rest of their personal user context. Every next time such a user connects to the instance before their ADFS logon session is over, they do not enter any login or password and get logged in automatically again. 

Configuring Single Sign-On

In SimpleOne, SSO relies on ADFS 2.0+ as the IdP and the XML-based Security Assertion Markup Language (SAML) 2.0 to exchange data with it. Therefore, as an administrator, you should complete the following tasks before enabling SSO on your instance:

1. Create a SAML connection.
2. Enable the SSO property.
3. Create ADFS Relying Party Trust:
   
   • through import from XML
   • manually.
4. Create a SAML Assertion Consumer and Logout Endpoints.
5. Create ADFS relying party claim party rules.
6. Test SAML connection.

Creating SAML connection

To configure a SAML connection, complete the steps below:

1. Navigate to Single Sign-On → SAML2 Settings.
2. Click New and fill in the fields
3. Click Save or Save and Exit to apply changes.

SAML2 Connection form fields

When the record is created, the Open metadata UI action appears at the bottom of the form. Click it to open the https://instance.simpleone.ru/v1/saml/metadata page that allows you to download a metadata file. This file is needed to import when creating a Relying Party Trust. 

Enabling or disabling Single Sign-On 

To enable SSO for your instance, you need to do the following:

1. Configure at least one SAML connection as described below.
2. Change the simple.sso.active property value to 'true'.

The simple.sso.active property can also be used to disable SSO and force your instance to authenticate users by logins and passwords from the local profile storage. This may be required, for example, if user authentication data stops coming from the IdP as expected, and users are unable to access the instance. 

Creating ADFS Relying Party Trust

Importing ADFS relying party trust settings from XML

To use a pre-set configuration data, you should prepare a metadata file first. To do so, complete the steps below:

1. Navigate to https://instance.simpleone.ru/v1/saml/metadata.
2. To copy the metadata into a new file with the '.xml' extension (for example, ExampleComSSOMetadata.xml), right-click on the page and click Save as.
3. Save the file.

To configure ADFS relying party, you need to:

1. Log into your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust on the top right and click Start.
4. Select the Import data about the relying party from a file option and attach the file with the metadata info that you previously saved. For example, ExampleComSSOMetadata.xml.
5. Specify a display name and type some notes if needed.
6. Do not select any encryption certificate.
7. Specify user permissions for this relying party. By default, all users are permitted. Click Next.
8. Click Next again, and click Close. The new relying party trust appears.

Creating relying party trust manually

To create relying party trust manually, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust at the top right and click Start with the Claims aware option chosen.
4. Specify the Enter data about the relying party manually option.
5. Specify a display name and type some notes if needed.

6. From the Configure Certificate step, click Next. Do not select any encryption certificate.

7. On the Configure URL step, select the Enable support for the SAML 2.0 WebSSO protocol.

   • Type https://instance.simpleone.ru

8. Specify Relying party trust identifiers.
   • Relying party identifiers = https://instance.simpleone.ru. Click Add.
9. Specify user permissions for this Relying party. By default, the Permit everyone option is chosen. Click Next.
10. Click Next again, and click Close. A new Relying party trust appears.

You also need to configure the created party trust. To do it, complete the following steps:

1. Open the created trust in the ADFS management tool.
2. In the Monitoring tab fill in the following fields:
   • Monitoring relying party = 'true'
   • Relying party's federation metadata URL = https://instance.simpleone.ru/v1/saml/metadata
   • Automaticaly update relying party = 'false'.
3. In the Endpoints tab you need to create endpoints. Instructions for creating endpoints are given below.

Creating SAML Endpoints

Generally, SAML endpoints are created automatically when the relying party trust created via the setting import. You can create or edit them manually if needed. To create SAML Assertion Consumer Endpoint, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Click on the Endpoints tab.
4. Click the Add SAML button.
5. Enter values as listed below:
   • Endpoint type = SAML 
   • Binding = Redirect
   • Trusted URL = https://instance.simpleone.ru/auth-sso
6. Click OK.

To create SAML Logout Endpoint, complete the following steps:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Click on the Endpoints tab.
4. Click the Add SAML button.
5. Enter values as listed below:
   • Endpoint type = SAML Logout
   • Binding = Redirect
   • Trusted URL = https://instance.simpleone.ru/logout
6. Click OK.

List of endpoints specific to Single Sign-On

An instance configured to use SSO has the following endpoints available for HTTP requests related to signing users in and out:

Creating ADFS relying party claim rules

Relying party claim rules allow for establishing communication between ADFS infrastructure and SimpleOne instance.

There are two main claim rules, that should be configured:

• Send LDAP Attribute as Claims – select attributes from the Active Directory to send as claim to the relying party. 
• Transform an Incoming Claim – select an incoming claim, change its claim type and its claim value.

Send LDAP Attribute as Claims

To configure the Send LDAP Attribute as Claims rule, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the Relying party trust created earlier.
3. Select the Edit Claim Issuance Policy item.
4. Click Add Rule.
5. Select the Send LDAP Attribute as Claims option in the Claim rule template field and click Next.
6. Name the claim. For example, Get LDAP Attributes.
7. Enter values as listed below:
   • Attribute store = Active directory
   • LDAP Attribute = E-Mail-Addresses

   • Outgoing Claim Type = E-Mail Address.

     You can specify more attributes that should be fetched from AD.

8. Click Finish.

Transform an Incoming Claim

To configure the Transform an Incoming Claim rule, complete the steps below:

1. Click Add Rule again.
2. Select the Transform an Incoming Claim option in the Claim rule template field and click Next.
3. Name the claim, for example, Email2Name.
4. Set the Incoming claim type equal to the outgoing claim type in the previous rule. For example, E-mail Address.
5. Set the values as listed below:
6. Outgoing claim type = Name ID
7. Outgoing name ID format = Email
8. Choose the Pass through all claim values option.
9. Click Finish.
10. Click Apply and then OK to close the window.

Testing Single Sign-On configuration

To test configuration, complete the steps below:

1. Navigate to your SimpleOne instance. For example, https://instance.simpleone.ru. If all configurations have been made properly, you will be redirected to https://adfs.example.com/adfs/ls/IdpInitiatedSignon.aspx?logintoRP=https://instance.simpleone.ru/.
2. Sign in to your instance. If the configuration is correct, you will be logged in automatically.
3. Select Logout from the profile menu to test the logout endpoint functionality.