Jump to: navigation, search
(→‎Configuring SAML)
Line 7: Line 7:
  
 
'''Start'''
 
'''Start'''
−
# Set the following options in the SSL and CA section:  
+
<ol>
−
#* {{#ppin:{{SectionTransclusion|HTCCConfigurationOptionsReference|caCertificate}}|caCertificate|||60%|60%}} &mdash; should point to a JKS key storage that includes the SAML encryption key. See [[SecuredConnectionsSAML#Generating_Security_Keys|Generating Security Keys]] for details.
+
<li>Set the following options in the SSL and CA section:  
−
#* [[Documentation:HTCC:Dep:HTCCConfigurationOptionsReference#jksPassword|jksPassword]] &mdash; should be the password for the '''caCertificate''' key storage.
+
<ul>
−
# Set the following option in the SAML section:
+
<li>{{#ppin:{{SectionTransclusion|HTCCConfigurationOptionsReference|caCertificate}}|caCertificate|||60%|60%}} &mdash; should point to a JKS key storage that includes the SAML encryption key. See [[SecuredConnectionsSAML#Generating_Security_Keys|Generating Security Keys]] for details.</li>
−
#* [[Documentation:HTCC:Dep:HTCCConfigurationOptionsReference#samlSettings|samlSettings]] &mdash; the following properties are mandatory:
+
<li>[[Documentation:HTCC:Dep:HTCCConfigurationOptionsReference#jksPassword|jksPassword]] &mdash; should be the password for the '''caCertificate''' key storage.</li>
−
#** encryptionKeyName
+
</ul>
−
#** signingKeyName
+
</li>
−
#** identityProviderMetadata
+
<li>Set the following option in the SAML section:
−
# Save the changes to the '''server-settings.yaml''' file. Your configuration should look something like this:
+
<ul>
 +
<li>[[Documentation:HTCC:Dep:HTCCConfigurationOptionsReference#samlSettings|samlSettings]] &mdash; the following properties are mandatory:
 +
<ul>
 +
<li>encryptionKeyName</li>
 +
<li>signingKeyName</li>
 +
<li>identityProviderMetadata</li>
 +
</ul>
 +
</li>
 +
</ul>
 +
</li>
 +
<li>Save the changes to the '''server-settings.yaml''' file. Your configuration should look something like this:
 
<source lang="text">
 
<source lang="text">
 
# SSL and CA
 
# SSL and CA
Line 28: Line 38:
 
     identityProviderMetadata: /Users/samluser/Documents/Metadata/idp-metadata.xml
 
     identityProviderMetadata: /Users/samluser/Documents/Metadata/idp-metadata.xml
 
</source>
 
</source>
 +
</li>
 +
</ol>
 
'''End'''
 
'''End'''
  

Revision as of 14:25, February 27, 2015

SAML Support

Genesys Web Services supports Security Assertion Markup Language (SAML) for single sign-on (SSO) authentication.

Configuring SAML

To enable SAML, make the following configuration changes in the server-settings.yaml file on each of your Workspace Web Edition & Web Services nodes:

Start

  1. Set the following options in the SSL and CA section:
  2. Set the following option in the SAML section:
    • samlSettings — the following properties are mandatory:
      • encryptionKeyName
      • signingKeyName
      • identityProviderMetadata
  3. Save the changes to the server-settings.yaml file. Your configuration should look something like this: 
    # SSL and CA
caCertificate: /Users/samluser/Documents/Keys/keystore.jks
jksPassword: password

# SAML
samlSettings:
    serviceProviderEntityId: genesys.staging.htcc
    encryptionKeyName: client
    signingKeyName: client
    identityProviderMetadata: /Users/samluser/Documents/Metadata/idp-metadata.xml

End

Generating Security Keys

You can use the keytool utility that comes with the Java SDK to generate a JKS key store. Use the following command: 

keytool -genkey -keystore <path_to_jks_file> -alias <key_name> -keypass <key_password> -storepass <store_password> -dname <distinguished_name>

If you already have a JKS key store, you can add a key to it by executing the command above with the same file name and the new key name and key password. For example: 

keytool -genkey -keystore /opt/keystore.jks -alias encryption_key -keypass genesys -storepass genesys -dname "CN=HTCC, OU=R&D, O=Genesys, L=Daly City, S=California, C=US"
Comments or questions about this documentation? Contact us for support!