Web Applications represent the applications and services that use Ubisecure SSO for authentication and access management.

The first view of Web Applications is presented in Figure 1. There is a list of Web Applications that are configured in this particular site, which means that Ubisecure SSO authenticates all of the applications behind these Web Applications.

The following functions are available:

There are following application types:

New Application

The window after clicking "New Application…" in Applications view is presented in Figure 2.

After creating an application for the first time, please go through the following steps to make your application works with Ubisecure SSO:

1. Generate an Activator file (Web Application)
2. Select the link Allowed Methods: and choose the authentication methods that are available for users logging in to this application or service provider. Please see section Allowed Methods chapter below for details.
3. Select the link Allowed To: and choose the user groups that are allowed to access this application or service. Please see section Allowed To chapter below for details.

Web Application

The Web Application object contains also the following tasks:

SAML Service Provider (Ubisecure Integration Modules)

Please see additional Ubisecure documentation for configuring Ubisecure SAML Service Provider integration modules such as Ubisecure SAML SP for Java or Ubisecure SAML SP for ASP.NET.

SAML Service Provider (Ubisecure SSO as a SAML Service Provider)

1. Create a new SAML Service Provider instance to the Ubisecure SSO acting as an IDP.
2. In the Ubisecure SSO acting as a SP, IDP Ubisecure SSO is configured as SAML 2.0 authentication method. Please see more information in page SAML IDP Proxy - SSO.
3. Exchange SAML 2.0 metadata files (export and import in both Ubisecure SSOs)
4. Configure Allowed To –list and Method –views in the Ubisecure SSO acting as IDP

SAML Service Provider (Third party SAML Service Providers)

Please contact Ubisecure for configuring Ubisecure SSO with third party SAML 2.0 Service Provider.

WS-Federation

Support for WS-Federation is intended for integrating Ubisecure SSO with Microsoft SharePoint 2013.

The optional wres, wctx, wp, wct request parameters are ignored. Sign-out is achieved by terminating application session and calling the Ubisecure SSO sign-out endpoint. No WS-Federation sign-out endpoint is provided in the Ubisecure SSO Metadata.

For more information, please refer to Ubisecure SSO Sharepoint 2013 Integration WS-Federation.

OAuth 2.0 Client

OAuth 2.0 Clients which use Ubisecure SSO as OAuth 2.0 Authorization Server are registered as Applications in Ubisecure SSO Management.

1. Create a new application of type OAuth 2.

2. Click “Upload” and enter OAuth2 JSON formatted client registration metadata (see page Client registration and activation - SSO)
3. Click “Activate” to generate client_id / client_secret pair and download them as a JSON formatted file.
4. Configure Allowed To –list and Method –views
5. In case Refresh Tokens are to be requested by the OAuth 2.0 Resource Server or Client, a Refresh Token Table must be associated with the application.
   To create a new Refresh Token Table:
   • Go to: Site → Mappings → New Mapping…
     
     • Set name, eg. Refresh Token Table 1
     • Set mapping type to OAuth
     • Click OK
   To associate an existing Refresh Token Table with an application:
   
   • Go to: Site → Mappings → Refresh Token Table 1
     
     • Select tab “Applications”
     • Click Add…

     • Select the application,

       • If needed use Site Navigator to navigate to the site where the application is

Mobile Connect client

Mobile Connect clients are configured as OAuth2 applications, but with an extra Compatibility Flag MobileConnectLoginHint set (see Figure 5).

The compatibility flag is required, because Mobile Connect clients send Authorization Request with a special version of login_hint, where user's mobile number is prefixed with "ENCR_MSISDN:" followed by RSA-encrypted mobile number, which the client got from Discovery API response. Provided that the encryption is done using SSO's public RSA key, SSO is able to decrypt the encrypted mobile number, if the application doing the Authorization Request has the Compatibility Flag MobileConnectLoginHint set.

Tupas IDP

To use SSO as TUPAS identity provider you need to register a TUPAS IDP application to SSO.

More information on page TUPAS IDP - SSO.

Allowed Methods

In the Allowed Methods view (Figure 6) you can select authentication methods for your application. This application will only be accessible using the authentication methods that are ticked as active in this context view.

• Update / Check box
  Enable or disable this authentication method for the current application

Allowed To

In Allowed To view (Figure 7) you can configure the application access control list.

• Group name
  Select the group for Group view. Selecting the group is allowed only if you are Site Manager in the selected group's site
• Add
  Add new groups to the access control list
• Remove
  Select groups to remove from the access control list. Click Remove to finally remove the groups from the access control list