Contents

Introduction

This page is a guide for configuring SAML 2.0 application integration in Ubisecure SSO.

This page does not explain how to create an application metadata or how to generate SAML requests. There are some open source toolkits available such as https://www.samltool.com/online_tools.php that can be used to generate and validate SAML requests and metadata.

Also it is good to understand what requests application’s SAML plug-in supports. Good to keep in mind that Ubisecure provides a plug-in SAML SP for Java application as well if needed.

SAML 2.0 Application Creation and Metadata Activation

Log in into Ubisecure SSO and follow the steps below to complete the task. You can obtain the SSO metadata file or link, from the [SAML 2.0], in the image in step 1 below. This information, either the metadata file or the link, to the application integrator.

Start the configuration by creating a new site. Give a name to the site. E.g. ‘Extranet’. You may have several applications in this site
Show image
Create a new application by clicking on “New Application…”
Show image
Name it e.g. ‘Web Shop’, select Application type as ‘SAML Service Provider’ and check the ‘Enable’ check box. Click ‘OK’
Show image
Activate the web application’s Metadata, either by uploading the xml file, or by pasting the content for the xml file
Show image
Click ‘Update’ to save the configuration to finalize the metadata activation

Creating Authorization Policy

Next, we will create an authorization policy for the site and add it to the application’s agent. Go to the site level (Extranet), and select ‘Authorization’ –tab. Click ‘New Policy…’ and select ‘CustomerID password’. From now on all these methods added at the site level are available for activation for the applications in this Site

Go to the ‘Authorization’ –tab now, and create a new policy e.g. ‘AP for the Web Shop’. Click ‘OK’. Next, go to ‘Attributes’ –tab to add the attributes which are forwarded to the application
Show image
Attributes can be added to the Application’s Authorization Policy.
Show image (example attributes)
Click ‘Add…’ and select the Application to use this authorization policy. Click ‘OK’
Show image

Adding Authentication Method

Next will add the authentication method to the site and activate it to the ‘Web Shop’ -application. Select ‘Extranet’ –site and ‘Site Methods’ –tab.

Enable the authentication method for the ‘Extranet’ -site by checking the check box in front of the method and click ‘OK’. Finally, press ‘Update’ -button below once the method has been added to the site
Show image
Assign the method to the ‘Web Shop’ –application by selecting the ‘Applications’ -tab in the site. Select the application by clicking on it and select ‘Allowed Methods’ –tab
Select the authentication method and click ‘Update…’
Show image
Click ‘Add…’ and select eIDMUser group (all users in CustomerID) to use this application and click ‘OK’.
Show image

Now the Web Shop application is integrated with Ubisecure SSO using SAML 2.0.

Next, pass the Ubisecure SSO metadata information to the application development if you haven’t done so.

Finnish Trust Network specific configurations

Trusted SAML 2.0 applications in Finnish Trust Network (FTN) can provide their friendly name to be shown in the login UI and sent as the display name for Authentication Methods by setting the Configuration String AllowFtnSpname as true. This can be done in the Management UI by adding AllowFtnSpname=true to the last line in the Configuration String.

Show image

Configuration String Since Version Description

AllowFtnSpname

8.10.0

Can be true or false.

Controls whether or not the value of spname (i) is allowed to be used as the friendly name for the application.

If true, then the value of spname is used as the friendly name of the application and overrides any value of mdui:DisplayName (ii).

If false, then the value of spname is ignored.

Default is false.

(i) spname is a shortened form for the Authentication Request extension element /samlp:AuthnRequest/samlp:Extensions/ftn/spname.

(ii) mdui:DisplayName is a shortened form for the Service Provider Metadata extension element /md:EntityDescriptor/md:SPSSODescriptor/md:Extensions/mdui:UIInfo/mdui:DisplayName.

Browser not supported