Configure SAML2 Authentication and SSO
Configure SAML2 Authentication and SSO
SAML2 is a commonly used, standardized approach of securing logon to web based systems, where the authentication is delegated to another system or third party. The following section will describe both the pre-requisites and the Evolve configuration required to enable SAML2 as your authentication provider. It is largely assumed that you are knowledgeable about the configuration of your SAML2 authority.
|
|
For details on how SAML2 is offered when Evolve is hosted and you wish to integrate your corporate authentication with the platform, an overview document can be found here... |
The instructions below explain how to configure your Evolve Server so that you can use SAML2 as an authentication method to access your sites.
|
|
Changes to these settings will require the re-publication of the site. |
Pre-requisites for SAML2 authentication:
Firstly it is a requirement to have a SAML2 authentication provider. This is the service that will provide both authentication responses and offer users a means to logon. One common example is Microsoft Active Directory, which can be configured natively, or through SAML2.
The authentication provider will be able to supply the following:
•Either a SAML2 metadata file, or a URL that links to a SAML2 metadata file
•An EntityID – this is the URL that points to the authentication provider (this may often be found in the SAML2 metadata file)
The Evolve web site will need to be operated over a Secure HTTP protocol (HTTPS). This will mean you are also in possession of:
•An SSL certificate to ensure both end-user clients and the authentication provider can trust Evolve.
Preparing the SSL certificate:
Since Evolve needs to be able to communicate securely with the SAML2 Auth provider, it will need to use an SSL certificate. The certificate which is validating the Evolve site (SSL domain certificate) can be used, however it is necessary to change the password on the certificate to make is usable by Evolve. In order to achieve this:
1. If you have not done so already, import the domain SSL certificate into Windows
2. Export the certificate to a new *.PFX file
3. Use the following password to secure the certificate :
LQMrnsuLpVAZ9ePd
Note that it is not currently possible to choose an alternative password. However the certificate is stored securely on your server, and is not made available externally, so this should not pose a concern.
4. Save the filename: CasewiseAuth.pfx
in the folder: c:\Casewise\Evolve\Site\bin
To configure SAML2 on your Evolve server:
1. Run Evolve Designer.
2. On the Evolve Designer Models launcher dialog, click the Server Configuration button.
The Server Configuration dialog opens.
3. Configure the settings according to the table below:
Authentication
|
Authentication Mode |
Choose how you want Users to be logged on to Evolve: Use Saml2 to make Evolve expect a SAML2 authentication |
|
Enable Automatic Logon |
Leave un-checked |
|
Domain Short Name |
Leave this setting blank. |
|
Use SSL Connection (Active Directory) |
Leave un-checked. |
|
AD Connection Path |
Leave this setting blank. |
|
AD Port |
Leave this setting blank. |
|
AD Group Membership Selection Mode |
Leave this setting blank. |
|
AD Connection Username |
Leave this setting blank. |
|
Connect to Active Directory Forest |
Leave this setting blank. |
|
Domain Exclusion List |
Leave this setting blank. |
|
SAML2 Entity ID |
This is often found in the metadata.xml file, and consists of the URL that Evolve needs to check authentication. |
|
SAML2 Meta Url |
This could be a public URL, a private URL or a local file path. The meta data consists of an XML file that contains the settings for the SAML2 configuration. where the metadata file should be stored in the Site folder |
|
Evolve's Url |
Enter the URL to the Evolve home page - e.g. |
4. Click Save to save your configuration.
|
|
If you make any further changes to the server configuration in this dialog, you must Save again. |
At this point it will no longer be possible to logon to Evolve, as the final steps are to configure the permissions based on Claims configured on the Authentication Server, and their mapping to groups on the Evolve server.
To configure Groups and Roles on your Evolve server:
Groups and Roles for SAML2 are configured in exactly the same way as they are for Active Directory. Take a look at this to see how they work. You will find this detail in the "AD Mapping" details of the "Site Level Settings" - "Deployment Node Settings".
Further instructions for specific Identity Providers:
See here for help on Integrating with Okta Identity Provider
Google Suite Idp Configuration
Configuring SAML2 Authentication and SSO with Google Suite
If your organization uses Google (gsuite.google.com) as an Identity provider, these instructions will help you to configure Single Sign On, between Evolve and your IdP.
Create new Application in G Suite
1. Goto the homepage of your G Suite Admin Console
Choose Apps (top right icon in below screenshot)
2. Choose SAML Apps (top right icon in below screenshot)
3. Press the Yellow (+) button at the bottom right of the window (see below)
This will create a new App in your G Suite.
4. Choose "SETUP MY OWN CUSTOM APP" at the bottom of the list (see below)
SAML Meta Data - Part 1
1. Download the IDP metadata file, using the "DOWNLOAD" button in Option 2 (see below)
Select this link and download it to your evolve server. (Saving the File as an XML file)
2. Press NEXT
Configure the Application
1. Provide App name, Description and provide a Picture to represent it.
Then press NEXT
2. Configure the Settings
Set the ACS URL to:
https://{your-domain}/evolve/AuthServices/Acs
e.g. https://evolvemain.host.casewise.com/evolve/AuthServices/Acs
Set the Entity ID to:
https://{your-domain}/evolve/AuthServices
e.g. https://evolvemain.host.casewise.com/evolve/AuthServices
Set the Start URL to:
https://{your-domain}/evolve/
e.g. https://evolvemain.host.casewise.com/evolve/
Set Name ID Format to:
EMAIL
Press NEXT
3. Set the Attributes
Using the "ADD NEW MAPPING" button add attribute mappings for the following 4 attributes
Add 4 new Attributes
Application Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Category: Basic Information
User Field: Primary Email
Application Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Category: Basic Information
User Field: Last Name
Application Attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Category: Basic Information
User Field: First Name
Application Attribute: http://schemas.xmlsoap.org/claims/Group
Category: Employee Details
User Field: Department
Accept all other defaults
SAML Meta Data - Part 2
1. Taking the file you downloaded in SAML Meta Data (Part 1)
2. Place your metadata file on the Evolve server in the following location “C:\Casewise\Evolve\Site” (ensure it’s an XML file)
3. Now in Evolve Designer under server Configuration/Authentication tab
i. Select Authentication mode to “Saml2”
ii. SAML2 Entity id = taken from your Metadata xml File
iii. SAML2 Meta url = “~/NAME OF YOU METADATA FILE.xml”
e.g. ~/GoogleIDPMetadata-erwingsuite.net.xml
4. Evolve’s url = YOUR EVOLVE URL
5. Save and Configure IIS
Publishing Evolve Site
1. For each model you publish under the deployment of the model you must specify the Department names in the “AD Group” Fields this must Match the G Suite Department Names you have set up along with the Values you specified in the attribute statement
2. Once set you must save. Then deploy the full site
|
|
HOW AD GROUP WORKS: In G Suite you already setup SAML Groups and mapped the value from a User's "Department" to be used as the Group in Evolve. Naturally, other properties can be used to act as the Group, although we have not yet worked out how to persuade G Suite to pass the ACTUAL Google Group information. If you are able to solve this, please let us know, and we'd be happy to update the page, to let others know. |
Okta Idp Configuration
Configuring SAML2 Authentication and SSO with Okta
If your organization uses Okta (www.okta.com) as an Identity provider, these instructions will help you to configure Single Sign On, between Evolve and your IdP.
Create new Application in Okta
1. Select Create new App
2. Platform = Web
3. Sign on Method = SAML2.0
4. Click create
Configure the Application
1. Provide app name
2. General
a. Single Sign on URL: Your Evolve URL followed by “/AuthServices/Acs”
Example https://EvolveTest/evolve/AuthServices/Acs
b. Ensure “Use this for Recipient URL and Destination UR” is checked
c. Audience URI (SP Entity ID): Your Evolve URL followed by “/AuthServices”
Example https://EvolveTest/evolve/AuthServices
d. Name ID format: EmailAddress
e. Application username: Email
3. ATTRIBUTE STATEMENTS
Add 4 new Attributes
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Name Format: URI Reference
Value: user.emailaddress
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Name Format: URI Reference
Value: user.surname
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Name Format: URI Reference
Value: user.givenname
Name: http://schemas.xmlsoap.org/claims/Group
Name Format: URI Reference
Value: isMemberOfGroupName("Evolve Contributor") ? "Evolve Contributor" : (isMemberOfGroupName("Evolve Social") ? "Evolve Social" : "NO")
|
|
IMPORTANT NOTE: in the above value we have specified the name of the Okta Groups in this case the group names are “Evolve Contributor” and “Evolve Social”. These are the Group names you must specify in Evolve Designer. This States that any user that in in the Okta group “Evolve Contributor” will be passed as a Contributor user and any user in the Okta group “Evolve Social” will be passed as a Social user. Finally any user that is not a member of either Okta groups will be passed as “No” and will gain no access. |
|
|
Accept all other defaults
SAML Meta Data
1.In the Okta Admin Page under “Sign On” you will find the “Identity Provider metadata” link to download you’re the metadata.
Select this link and download it to your evolve server. (Saving the File as a XML file)
2. Place your metadata file on the Evolve server in the following location “C:\Casewise\Evolve\Site” ensure it’s a XML file)
3. Now in Evolve Designer under server Configuration/Authentication tab
a.Select Authentication mode to “Saml2”
b.SAML2 Entity id = taken from your Metadata xml File
c.SAML2 Meta url = “~/NAME OF YOU METADATA FILE.xml”
d.Evolve’s url = YOUR EVOLVE URL
4. Save and Configure IIS
Publishing Evolve Site
1. For each model you publish under the deployment of the model you must specify the Okta group names in the “AD Group” Fields this must Match the Okta group Names you have set up along with the Values you specified in the attribute statement
2. Once set you must save. Then deploy the full site.
Authentication and Active Directory
Authentication and Active Directory