1

Navigate to Admin Center >System Administration > Authentication Options

2

The Authentication Options page displays. Click Add.

3

Complete the fields on the General tab. For more information, see Authentication Option - General Tab.

4

After saving you will be redirected to Edit SSO Provider Applet which contains a Tab based on the selected SSO Provider Type. For more information, see either Authentication Option - SAML Tab or Authentication Option - OAuth2 Tab

5

6

7

SSO Provider Type

Select from the following SSO Provider Types: SAML, OAuth2

Name

Users will see this name as a log in option in the providers drop-down:

Open

Default Provider

This option enables to automatically redirect to Identity Provider when the user is not authorized. This option allows the user to be enabled only on one Identity Provider.

NOTE: When a user wants to log in with a password or other Identity Provider with this option enabled, he can go to http(s)://<site_url>/LoginFull.do for show login form.

Enabled

“Enabled” checkbox enables this Identity Provider, but not all SSO.

SAML Provider Meta Source

Source for SAML Metadata.

Available Options: HTTP (URL) or XML Data

SAML Provider Meta URL

Contains the URL of SAML Metadata when HTTP(S) URL option selected at SAML Provider Meta Source.

SAML Provider Meta XML Data

Contains XML text with SAML Metadata when XML Data option selected at SAML Provider Meta Source. You need to click the Setup button to open a window where you can paste this text into the textbox.

SAML Entity ID

Click the Load Entities button. The server will attempt to parse SAML Metadata which present as URL or entered text and give you a list of available SAML entities to select from. This action is needed because XML can contain more than one Identity Providers. You should select only one of the list.

Load Entities

Populates metadata XML

SAML Provider Relogin URL

The URL that displays on the login page (lower left corner) when a user’s SSO session age exceeds the setting for System Parameter SamlMaxAuthenticationAge. This is the URL for the hyperlink provider name in the message that displays for exceeded session age. The user clicks the hyperlink in the message to be automatically logged out of the provider site and be presented with the login page where they need to log out / log back in to continue with SSO in their OneVizion Platform system.

Open

Parameter

Value

Description

EnableSSOLogin

Yes

Enable ability to authorize with SSO.

SigningAlgorithm

You need to set value depending on what algorithm is required to be used by Identity Providers

The algorithm used for the creation of digital signature metadata.

Algorithms supported:

rsa-ripemd160

rsa-sha1

rsa-sha256

rsa-sha384

rsa-sha512

SslCertEncryption

You can generate certificate using the following command:

openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:2048 -keyout private_key.key -out certificate.crt

and concatenating content of the generated private_key.key  and certificate.crt files.

SSL certificate (X.509 PEM format) used for encrypt SAML requests.

Take into account, this certificate will not include certification chain, i.e. is not signed by the trusted authority, and your SAML Identity Provider may refuse it or require additional configuration steps (refer to your identity provider documentation for more details).

SslCertSigning

You can generate certificate using the following command:

openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:2048 -keyout private_key.key -out certificate.crt

and concatenating content of the generated private_key.key  and certificate.crt files.

SSL certificate (X.509 PEM format) used for encrypt SAML requests.

Take into account, this certificate will not include certification chain, i.e. is not signed by the trusted authority, and your SAML Identity Provider may refuse it or require additional configuration steps (refer to your identity provider documentation for more details).

Parameter

Default Value

Description

RequireArtifactResolveSigned

Yes

This parameter indicates that “artifact resolve” (SAML terms) messages should be signed. A web server restart is required when a parameter is changed. It depends on IDP internal configuration.

RequireLogoutRequestSigned

Yes

This parameter indicates that “logout request” (SAML terms) messages should be signed. A web server restart is required when a parameter is changed. It depends on IDP internal configuration.

RequireLogoutResponseSigned

Yes

This parameter indicates that “logout response” (SAML terms) messages should be signed. It depends on IDP internal configuration.

SSLHostnameVerification

Default

Algorithm for verification of a match between hostname in URL and hostname in the presented certificate.

 default

• standard hostname verifier;

defaultAndLocalhost

• Standard hostname verifier (skips verification for localhost);

strict

• strict hostname verifier;

allowAll

• disable hostname verification.

SSLSecurityProfile

pkix

SSL/TLS Security profile determines how is trust of the peer's SSL/TLS certificate against a set of trust anchors. All certificates defined in metadata, extended metadata or present in the keystore are considered as trusted anchors (certification authorities) for PKIX validation. In MetaIOP mode server's SSL/TLS certificate is trusted when it is explicitly declared in the metadata or extended metadata of the peer.

SecurityProfile

metaiop

The security profile determines how the trust of digital signatures is handled. In MetaIOP mode certificate is deemed valid when it is declared in the metadata or extended metadata of the peer entity. No validation of the certificate is performed (e.g. revocation) and no certificate chains are evaluated. PKIK profile verifies credentials against a set of trust anchors. Certificates present in the metadata or extended of the peer entity are treated as trust anchors, together with all keys in the keystore. Certificate chains are verified in the mode.

SignMetadata

No

If Yes then the generated metadata will be digitally signed using the specified signature key. It depends on IDP internal configuration.

General

SSO Provider Certificate Chain

Certificate chain is a X.509 PEM text data. You can load chain automatically using Load Certificates button. In case of OAuth2 it is used for server-side communications security.

Login URL (suffix)

Unique Login URL for this SSO Provider. Use this URL for generate ClientID and ClientSecret before set it at OneVizion.

Logout Redirect URL

Optional. Redirect URL (HTTP GET) after user logout from OneVizion. Placeholder “{returnTo}” can be used for specify back url.

Client ID

OAuth2 Client ID

Client Secret

OAuth2 Client Secret

Scope

Optional. OAuth2 Scope which will be used at Authentication process. Separate multiple values using comma or semicolon.

Fixed State

Optional. By default “state” parameter is generating using random for every Authenticaton attempt. If you require to use fixed “state” parameter for all attempts - specify value at this field.

User Authorization

User Authorization URL

URL for retrieve OAuth2 Authorization Code

User Authorization Response Type

Optional. Response type for Authorization Code which should be received from OAuth2 server. Default: “code”

Access Token retrieve method: Authorization code

Authorization Code Grant Type

Optional. Grant Type which will be used in Access Token retrieve request. Default: “authorization_code”

Access Token Request URL

URL for retrive OAuth2 Access Token using OAuth2 Authorization Code.

Access Token Request Authentication scheme

Available options: Header, Form Body.

For Header option the “Authorization: Basic client_id:client_secret” (base64 encoded) HTTP header will be passed to request.

For Form Body option data (client_id, client_secret) will be passed at body as “application/x-www-form-urlencoded” content type.

User Information retrieve method: User Information Service

User Information Service URL

URL for service which returns User information in JSON format

User Information Grant Type

Required Grant Type for this User Information Service

User Select SQL query

You need to click Setup button to open SQL query editor window.

Open

This SQL query is used for get an association between OneVizion User and OAuth2 User entity.

The values returned from User Information Service will be bind to SQL parameter using it’s key as parameter name.

Example SQL query finds an association using E-Mail returned from User Information Service.

Parameter

Value

Description

EnableSSOLogin

Yes

Enable ability to authorize with SSO.

1

Navigate to the Edit Security Role applet for the security role you want to change.

2

Click the SSO tab and check the provider(s) to allow for this security role.

3

Click OK.

4

Click the SSO Provider checkbox.

5

Click OK.