Single Sign-On

Single Sign-On (SSO) is a technology that lets corporate networks use external user authentication services (also known as 'identity providers', or IdPs). It is used to set up access authorization within corporate services along with basic authentication methods provided with the local database.

The assigned IdP authenticates users by their logins and passwords. Certain network resources, like applications and servers, are configured to trust the user authentication performed by the IdP. In such cases, users do not need to enter their logins and passwords when accessing these resources.

With SSO enabled, when a user with no active ADFS logon session connects to a SimpleOne instance, they are redirected to the ADFS logon. After typing in their corporate Active Directory (AD) login and password, a user enters an instance with their relevant ID, configuration preferences, membership in groups, roles, and the rest of their personal user context. Every next time such a user connects to the instance before their ADFS logon session is over, they do not enter any login or password and get logged in automatically again. 

Configure Single Sign-On

In SimpleOne, SSO relies on ADFS 2.0+ as the IdP and the XML-based Security Assertion Markup Language (SAML) 2.0 to exchange data with it. Therefore, as an administrator, you should complete the following tasks before enabling SSO on your instance:

1. Create a SAML connection.
2. Enable the SSO property.
3. Create ADFS Relying Party Trust:
   
   • through import from XML
   • manually.
4. Create a SAML Assertion Consumer and Logout Endpoints.
5. Create ADFS relying party claim party rules.
6. Test SAML connection.

Create SAML connection

To configure a SAML connection, complete the steps below:

1. Navigate to Single Sign-On → SAML2 Settings.
2. Click New and fill in the fields.
3. Click Save or Save and exit to apply the changes.

SAML2 Setting form fields

<saml:Attribute FriendlyName="username"
    Name="SAM-Account-Name"
    NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
  <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:type="xs:string">ad.viewer</saml:AttributeValue>
</saml:Attribute>

When the record is created, the Open metadata UI action appears at the bottom of the form. Click it to open the https://instance.simpleone.ru/v1/saml/metadata page that allows you to download a metadata file. Import this file when creating a Relying Party Trust. 

Enable Single Sign-On

To enable SSO for your instance, do the following:

1. Configure at least one SAML connection as described above.
2. Change the simple.sso.active property value to true.

Until the steps above are completed, the authentication proceeds with the use of the local profile storage.

Use the simple.sso.active property to disable SSO and to make your instance to authenticate users by logins and passwords from the local profile storage. This may be required, for example, if user authentication data stops coming from the IdP, and users are unable to access the instance. 

Create ADFS relying party trust

Import settings from XML file

To use a preset configuration data, you prepare a metadata file. To do so, complete the steps below:

1. Navigate to https://instance.simpleone.ru/v1/saml/metadata.
2. To copy the metadata into a new file with the '.xml' extension (for example, ExampleComSSOMetadata.xml), right-click the page and select Save as.
3. Save the file.

To configure ADFS relying party, you need to:

1. Log in to your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust on the top right, and then click Start.
4. Select the Import data about the relying party from a file option and attach the file with the metadata info that you previously saved. For example, ExampleComSSOMetadata.xml.
5. Specify a display name and type some notes if needed.
6. Do not select any encryption certificate.
7. Specify user permissions for this relying party. By default, all users are permitted. Click Next.
8. Click Next again, and click Close. A new relying party trust appears.

Create relying party trust manually 

To create relying party trust manually, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust at the top right corner and click Start with the Claims aware option chosen.
4. Specify the Enter data about the relying party manually option.
5. Specify a display name and type some notes if needed.

6. From the Configure Certificate step, click Next. Do not select any encryption certificate.

7. On the Configure URL step, select the Enable support for the SAML 2.0 WebSSO protocol.

   • Type https://instance.simpleone.ru

8. Specify Relying party trust identifiers.
   • Relying party identifiers = https://instance.simpleone.ru. Click Add.
9. Specify user permissions for this Relying party. By default, the Permit everyone option is selected. Click Next.
10. Click Next again, and click Close. A new Relying party trust appears.

You also need to configure the created party trust. To do so, complete the following steps:

1. Open the created trust in the ADFS management tool.
2. In the Monitoring tab fill in the following fields:
   • Monitoring relying party = true
   • Relying party's federation metadata URL = https://instance.simpleone.ru/v1/saml/metadata
   • Automaticaly update relying party = false
3. In the Endpoints tab you need to create endpoints. Instructions for creating endpoints are given below.

Create SAML endpoints

Generally, SAML endpoints are created automatically when the relying party trust created via the setting import. You can create or edit them manually if needed. To create SAML Assertion Consumer Endpoint, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Select the Endpoints tab.
4. Click Add SAML.
5. Enter values as listed below:
   • Endpoint type = SAML 
   • Binding = Redirect
   • Trusted URL = https://instance.simpleone.ru/auth-sso
6. Click OK.

To create SAML Logout Endpoint, complete the following steps:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Select the Endpoints tab.
4. Click Add SAML.
5. Enter values as listed below:
   • Endpoint type = SAML Logout
   • Binding = Redirect
   • Trusted URL = https://instance.simpleone.ru/logout
6. Click OK.

List of endpoints specific to Single Sign-On

An instance configured to use SSO has the following endpoints available for HTTP requests related to signing users in and out:

Create ADFS relying party claim rules

Relying party claim rules allow the system to establish communication with ADFS infrastructure.

There are two main claim rules, that should be configured:

• Send LDAP Attribute as Claims – select attributes from the Active Directory to send as claim to the relying party. 
• Transform an Incoming Claim – select an incoming claim, change its claim type and its claim value.

Send LDAP Attribute as Claims

To configure the Send LDAP Attribute as Claims rule, complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the Relying party trust created earlier.
3. Select the Edit Claim Issuance Policy item.
4. Click Add Rule.
5. Select the Send LDAP Attribute as Claims option in the Claim rule template field and click Next.
6. Name the claim. For example, Get LDAP Attributes.
7. Enter values as listed below:
   • Attribute store = Active directory
   • LDAP Attribute = E-Mail-Addresses

   • Outgoing Claim Type = E-Mail Address.

     You can specify more attributes to be retrieved from AD.

8. Click Finish.

Transform an Incoming Claim

To configure the Transform an Incoming Claim rule, complete the steps below:

1. Click Add Rule again.
2. Select the Transform an Incoming Claim option in the Claim rule template field and click Next.
3. Name the claim. For example, Email2Name.
4. Set the Incoming claim type equal to the outgoing claim type in the previous rule. For example, E-mail Address.
5. Set the values as listed below:
   • Outgoing claim type = Name ID
   • Outgoing name ID format = Email
6. Choose the Pass through all claim values option.
7. Click Finish.
8. Click Apply and then OK to close the window.

Test the Single Sign-On configuration

To test the configuration, complete the steps below:

1. Navigate to your SimpleOne instance. For example, https://instance.simpleone.ru. If all configurations are set correctly, the system redirects you to https://adfs.example.com/adfs/ls/IdpInitiatedSignon.aspx?logintoRP=https://instance.simpleone.ru/.
2. Sign in to your instance. If the configuration is correct, you will be logged in automatically.
3. Select Logout from the profile menu to test the logout endpoint functionality.