Single Sign-On

Single Sign-On (SSO) authorization allows using external authorization services (also can be called "identity providers", IdP). It allows configuring authorization within corporate services along with basic authentication methods provided with the local database. SSO uses SAML (Security Assertion Markup Language), an XML-based markup language, for data exchanging between identity providers and service providers. This procedure can be implemented based on ADFS 2.0. 

To configure SSO in your system, you need to follow a simple procedure:

1. Configure at least one SAML connection.
2. Change the simple.sso.active property value to 'true'.

Until this steps are not completed, the authentication will proceed using the local profile storage.

To configure SSO properly, you need to follow a procedure as listed below:

1. Create ADFS relying party trust.
2. Create ADFS relying party claim party rules. 
3. (optional) Create a SAML logout endpoint.
4. Create a SAML connection.
5. Test connection.

Create ADFS relying party trust

In this step, you should prepare a metadata file first. To perform this, please complete the steps below:

1. Navigate to https://instance.example.com/v1/saml/metadata
2. Copy the metadata into a new file with an XML extension (for example, ExampleComSSOMetadata.xml)
3. Save the file.

To configure ADFS relying party, you need to:

1. Log into your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust on the top right and click Start.
4. Select the Import data about the relying party from a file option.
5. Specify a display name and type some notes if needed.
6. Do not select any encryption certificate.
7. Specify user permissions for this relying party. By default, all users are permitted. Click Next.
8. Click Next again, and click Close. The new relying party trust appears.

Manual relying party trust creation

To create relying party trust manually, please complete the steps below:

1. Log into your ADFS server and open the management console.
2. Select Relying Party Trusts.
3. Click Add Relying Party Trust on the top right and click Start.
4. Specify the Enter data about the relying data manually option.
5. Specify a display name and type some notes if needed.

6. Do not select any encryption certificate.

7. Select the Enable support for the SAML 2.0 WebSSO protocol
   • Type https://instance.example.com/adfs/fs
8. Specify relying parties identifiers
   • Type https://instance.example.com/adfs/services/trust
9. Specify user permissions for this relying party. By default, all users are permitted. Click Next.
10. Click Next again, and click Close. The new relying party trust appears.

Create ADFS relying party claim rules

Relying party claim rules allow to establish communication between ADFS infrastructure and SimpleOne instance.

To configure them, please complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Select the Edit Claim Issuance Policy item.
4. Click Add Rule.
5. Select the Send LDAP Attribute as Claims option and click Next.
6. Name the claim. for example, Get LDAP Attributes.
7. Enter values as listed below:
   • Attribute store = Active directory
   • LDAP Attribute = E-Mail-Addresses
   • Outgoing Claim Type = E-mail Address
8. Click Finish.
9. Click Add Rules again.
10. Select the Transform an Incoming Claim option and click Next.
11. Name the claim, for example, Email2Name.
12. Set the Incoming claim type equal to the outgoing claim type in the previous rule. For example, Email Address.
13. Set the values as listed below:
    • Outgoing claim type = Name ID
    • Outgoing name ID format = Email
14. Choose the Pass through all claim values option.
15. Click Finish.
16. Click OK to close the window.

Create SAML logout endpoint

Generally, SAML logout endpoints are created automatically within relying party trust creating. You can create or edit them manually if needed. To perform this, please complete the steps below:

1. Log into your ADFS server and open the management console.
2. Right-click the relying party trust created earlier.
3. Click on the Endpoints tab.
4. Click the Add SAML button.
5. Enter values as listed below:
   • Endpoint type = SAML Logout
   • Binding = POST
   • Trusted URL = https://instance.example.com/logout
6. Click OK.

Create a SAML connection

To configure a SAML connection, please complete the steps below:

1. Navigate to Single Sign-On → SAML Definition.
2. Click New and fill in the fields
3. Click Save or Save and Exit to apply changes.

SAML definition form fields

Test configuration

To test configuration, please complete the steps below:

1. Navigate to your SimpleOne instance. For example, https://instance.example.com. If all configurations have been made properly, you will be redirected to https://adfs.example.com/adfs/ls/IdpInitiatedSignon.aspx?logintoRP=https://instance.example.com/
   • adfs.example.com is an example hostname for the ADFS instance.
   • instance.example.com is an example hostname for the SimpleOne instance.
2. Sign in to your instance. If configurations have been made correctly, you will be logged automatically.
3. Select Logout from the profile menu to test the logout endpoint functionality.