Jump to: navigation, search
(Created Fix blank page For Version: HTCC:8.5.2DRAFT)
 
 
(19 intermediate revisions by 4 users not shown)
Line 1: Line 1:
−
<!-- Creation of the fix page -->
+
=SAML authentication=
 +
__TOC__
 +
Web Services supports Security Assertion Markup Language (SAML) for single sign-on (SSO) authentication.
 +
 
 +
==Configuring SAML==
 +
To enable SAML, make the following configuration changes in the serverSettings section of the '''application.yaml''' file on each of your Web Services nodes ('''server-settings.yaml''' if you're installing Web Services and Applications version 8.5.201.09 or earlier):<br/>
 +
 
 +
'''Start'''
 +
<ol>
 +
<li>Set the following options in the SSL and CA section:
 +
<ul>
 +
<li>[[HTCCConfigurationOptionsReference#caCertificate|caCertificate]] &mdash; should point to a JKS key storage that includes the SAML encryption key. See [[SecuredConnectionsSAML#Generating_security_keys|Generating security keys]] for details.</li>
 +
<li>[[HTCCConfigurationOptionsReference#jksPassword|jksPassword]] &mdash; should be the password for the '''caCertificate''' key storage.</li>
 +
</ul>
 +
</li>
 +
<li>Set the following option in the SAML section:
 +
<ul>
 +
<li>[[HTCCConfigurationOptionsReference#samlSettings|samlSettings]] &mdash; the following properties are mandatory:
 +
<ul>
 +
<li>encryptionKeyName</li>
 +
<li>signingKeyName</li>
 +
<li>identityProviderMetadata</li>
 +
</ul>
 +
</li>
 +
</ul>
 +
</li>
 +
<li>Save the changes to the file. Your configuration should look something like this:
 +
<source lang="text">
 +
# SSL and CA
 +
caCertificate: /Users/samluser/Documents/Keys/keystore.jks
 +
jksPassword: password
 +
 
 +
# SAML
 +
samlSettings:
 +
    serviceProviderEntityId: genesys.staging.htcc
 +
    encryptionKeyName: client
 +
    signingKeyName: client
 +
    identityProviderMetadata: /Users/samluser/Documents/Metadata/idp-metadata.xml
 +
</source>
 +
</li>
 +
<li>To activate SAML authentication, append the browser URL for Workspace Web Edition with <tt>?authType=saml</tt>.</li>
 +
<li>To enable extended SAML logging, add the following string to '''logback.xml''' file:
 +
<tt><logger name="org.springframework.security.saml" level="%LEVEL%"/></tt>, where valid values for LEVEL are INFO (preferred) or DEBUG.</li>
 +
</ol>
 +
'''End'''
 +
==Generating security keys==
 +
You can use the keytool utility that comes with the Java SDK to generate a JKS key store. Use the following command:
 +
<source lang="text">
 +
keytool -genkey -keystore <path_to_jks_file> -alias <key_name> -keypass <key_password> -storepass <store_password> -dname <distinguished_name>
 +
</source>
 +
 
 +
If you already have a JKS key store, you can add a key to it by executing the command above with the same file name and the new key name and key password. For example:
 +
<source lang="text">
 +
keytool -genkey -keystore /opt/keystore.jks -alias encryption_key -keypass genesys -storepass genesys -dname "CN=HTCC, OU=R&D, O=Genesys, L=Daly City, S=California, C=US"
 +
</source>
 +
 
 +
==Next step==
 +
*[[Security|Back to Configuring security]]
 +
 
 +
[[Category:V:HTCC:8.5.2DRAFT]]

Latest revision as of 12:37, October 25, 2021

SAML authentication

Web Services supports Security Assertion Markup Language (SAML) for single sign-on (SSO) authentication.

Configuring SAML

To enable SAML, make the following configuration changes in the serverSettings section of the application.yaml file on each of your Web Services nodes (server-settings.yaml if you're installing Web Services and Applications version 8.5.201.09 or earlier):

Start

  1. Set the following options in the SSL and CA section:
  2. Set the following option in the SAML section:
    • samlSettings — the following properties are mandatory:
      • encryptionKeyName
      • signingKeyName
      • identityProviderMetadata
  3. Save the changes to the file. Your configuration should look something like this: 
    # SSL and CA
caCertificate: /Users/samluser/Documents/Keys/keystore.jks
jksPassword: password

# SAML
samlSettings:
    serviceProviderEntityId: genesys.staging.htcc
    encryptionKeyName: client
    signingKeyName: client
    identityProviderMetadata: /Users/samluser/Documents/Metadata/idp-metadata.xml
  4. To activate SAML authentication, append the browser URL for Workspace Web Edition with ?authType=saml.
  5. To enable extended SAML logging, add the following string to logback.xml file: <logger name="org.springframework.security.saml" level="%LEVEL%"/>, where valid values for LEVEL are INFO (preferred) or DEBUG.

End

Generating security keys

You can use the keytool utility that comes with the Java SDK to generate a JKS key store. Use the following command: 

keytool -genkey -keystore <path_to_jks_file> -alias <key_name> -keypass <key_password> -storepass <store_password> -dname <distinguished_name>

If you already have a JKS key store, you can add a key to it by executing the command above with the same file name and the new key name and key password. For example: 

keytool -genkey -keystore /opt/keystore.jks -alias encryption_key -keypass genesys -storepass genesys -dname "CN=HTCC, OU=R&D, O=Genesys, L=Daly City, S=California, C=US"

Next step

This page was last edited on October 25, 2021, at 12:37.
Comments or questions about this documentation? Contact us for support!