Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...


Info
iconfalse

OperationsCommander can be integrated with single sign-on services such as SAML or LDAP to allow users to sign into the User Portal.  Configuration is straight forward and can be easily accomplished by following the details listed on this page.

Table of Contents

Twitterconnector
width460
height500
tweetLimit20


Working with Login Sources

Login Sources define where the user comes from. For example, if the user authenticates with a username and password stored in OPS-COM then OPSCOM is the source. They could also come from SAML, LDAP etc. 

You can add login sources in the Admin Options under Users. 

By default, you will have the OPSCOM login source. You can see that this will give users the option of entering their username and password.

If we were to disable this option then we would only be left with our SAML login source. 

Adding Login Sources

To add login sources we click the Add Login Source button at the top right corner of the page.

Any required fields will be displayed in red letting you know they must be completed before you can save. 

Info
titleImportant

The fields have multiple states which are reflected by the color they are highlighted with. 

  1. Red fields are required to click save.
  2. Yellow fields are required to work but still allow empty or invalid values to be saved.
  3. Yellow fields can also indicate that a change has been made.


The Code field is what the user profile will match against when adding users to the new login source. However, only one login source code can be activated at a time. 

Service Provider Fields

The Unique Identifier is the ID of the external SAML system that comes from the provider. 

The Entity ID for Service Provider is the name that our system communicates with the SAML system for example. It also becomes part of the URL for the user portal 

The x509 certificate can be generated and added to the service provider. 


Identity Provider Fields

These fields come from the system you are working with such as SAML when communicating with ops-com. For example, SAML should display its metadata under Federation → Show Metadata. 


Once the settings have been completed and saved you will have access to the MetaData, Synchronization and Translations tab. 

Image RemovedImage Added

Metadata

The Metadata tab provides the XML that would be provided to the service provider

Sample XML File

The following is an example of a response from an external system to OPS-COM. In this case, it is a SimpleSAMLPhp service set up as the identity provider. At the bottom are several attributes within an saml:AttributeStatement tag. These are required for our system to match to a user within our system. The one field that matters in this attribute section is what is being used as the permanently unique identifier for a user. In this case it is "uid". Since "uid" is being sent back, then the setup for Identity Provider Fields should have "uid" as the Unique ID Field. If the unique ID is something else such as SAMaccountName, then that should be used for UniqueID. 

... DEV-2K8 - DEBUG: Saml2 Incoming User Array ( [uid] => Array ( [0] => 6ddf4027-3397-4e45-8628-0189f60fe91e ) [full name] => Array ( [0] => Sarah Knowles ) [email] => Array ( [0] => sknowles@tomahawk.ca ) ) []

Code Block
languagexml
<?xml version="1.0"?>
        <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_aa1963115aa6490e728c7376f4c8849813bbb...">
          ...
          <saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_9efd79bf6425983ee9176f3d33a99d1a9176180...">
            ...
            <saml:Subject>
              <saml:NameID SPNameQualifier="MinionOpsComStaff" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_7a426e0be71f14c1f349db00d7d543b6f7dcb52baa</saml:NameID>
              <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData NotOnOrAfter="2021-08-24T16:00:41Z" Recipient="https://minion-3.dev.parkadmin.com/auth/saml2/MinionOpsComStaff/acs" InResponseTo="ONELOGIN_bb8a09203c888cf59af4c621a71cfa8f7559c016"/>
              </saml:SubjectConfirmation>
            </saml:Subject>
            <saml:Conditions NotBefore="2021-08-24T15:55:11Z" NotOnOrAfter="2021-08-24T16:00:41Z">
              <saml:AudienceRestriction>
                <saml:Audience>MinionOpsComStaff</saml:Audience>
              </saml:AudienceRestriction>
            </saml:Conditions>
            <saml:AuthnStatement AuthnInstant="2021-08-24T15:34:46Z" SessionNotOnOrAfter="2021-08-24T23:34:46Z" SessionIndex="_a7a68666092117d24aab8adecf1b0830622855b85...">
              <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
              </saml:AuthnContext>
            </saml:AuthnStatement>


            <saml:AttributeStatement>
              <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">6ddf4027-3397-4e45-8628-0189f60fe91e</saml:AttributeValue>
              </saml:Attribute>
              <saml:Attribute Name="full name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">Sarah Knowles</saml:AttributeValue>
              </saml:Attribute>
              <saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">sknowles@tomahawk.ca</saml:AttributeValue>
              </saml:Attribute>
            </saml:AttributeStatement>


          </saml:Assertion>
        </samlp:Response>

Translations

Translations can be used to change the text displayed on your login button from the user side. We can create as many different translations as we have available on our system. For this example, we have English and French. 

Synchronization

The synchronization tab allows you to create users in OPS-COM when they login from SAML that do not already exist by mapping your user attributes to our system. This also lets you update existing users information in the system. In this example, any field that is mapped and has a value from your SSO side should get updated to the value from SAML. 

To begin, ensure that you enable Auto Create/Update User. Keep in mind that these are sample values from our test system and your SAML system may differ. 

Image Added

After you have supplied the information in each field you can click Save Changes and your users will begin to be created/updated. If any of the fields supplied by you are incorrect then the information will be blank when the user logs in or  it will stay the same if the user already existed. 

Managing Login Sources

We can manage our login sources by either editing or deleting them using the two buttons to the right of each source.

Archiving a login source means that it will no longer display on the user side and any users associated with this source will be removed from logging in this way. 

Related Pages

Content by Label
showLabelsfalse
showSpacefalse
sorttitle
cqllabel in ("sso","ldap","login") and space = currentSpace()


Show If
special@authenticated


Warning
titleSupport Agent Notes

Widget Connector
urlhttps://www.youtube.com/watch?v=yIzwj5lWtq0&feature=youtu.be

Troubleshooting LDAP - 

When LDAP has connection issues (server temporarily offline / not setup properly etc) papertrail will get a log about it:

https://my.papertrailapp.com/systems/WEB-OC_WVU-NP/events?selected=1329931097278210058


  • It is required that the Login Sources are created first and then the accounts can be created on our system using the login source. Using SAML for example doesn't actually create the accounts for us and changes made on either system are not communicated between each other. 
  • If the client requires a certificate from us we need to know if a self-signed cert is enough or if they require a valid paid certificate. 


Troubleshooting SAML

Note, SAML doesn't work if the user isn't already imported into our system. Clients should use the API for User Push to set this up before SAML can work.

The following is an example of a response from an external system to OPS-COM. In this case, it is a SimpleSAMLPhp service set up as the identity provider. At the bottom are several attributes within an saml:AttributeStatement tag. These are required for our system to match to a user within our system. The one field that matters in this attribute section is what is being used as the permanently unique identifier for a user. In this case it is "uid". Since "uid" is being sent back, then the setup for Identity Provider Fields should have "uid" as the Unique ID Field. If the unique ID is something else such as SAMaccountName, then that should be used for UniqueID. When testing on preview, Papertrail will report the incoming attributes:

... DEV-2K8 - DEBUG: Saml2 Incoming User Array ( [uid] => Array ( [0] => 6ddf4027-3397-4e45-8628-0189f60fe91e ) [full name] => Array ( [0] => Sarah Knowles ) [email] => Array ( [0] => sknowles@tomahawk.ca ) ) []

Code Block
languagexml
<?xml version="1.0"?>
        <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_aa1963115aa6490e728c7376f4c8849813bbb...">
          ...
          <saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_9efd79bf6425983ee9176f3d33a99d1a9176180...">
            ...
            <saml:Subject>
              <saml:NameID SPNameQualifier="MinionOpsComStaff" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_7a426e0be71f14c1f349db00d7d543b6f7dcb52baa</saml:NameID>
              <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData NotOnOrAfter="2021-08-24T16:00:41Z" Recipient="https://minion-3.dev.parkadmin.com/auth/saml2/MinionOpsComStaff/acs" InResponseTo="ONELOGIN_bb8a09203c888cf59af4c621a71cfa8f7559c016"/>
              </saml:SubjectConfirmation>
            </saml:Subject>
            <saml:Conditions NotBefore="2021-08-24T15:55:11Z" NotOnOrAfter="2021-08-24T16:00:41Z">
              <saml:AudienceRestriction>
                <saml:Audience>MinionOpsComStaff</saml:Audience>
              </saml:AudienceRestriction>
            </saml:Conditions>
            <saml:AuthnStatement AuthnInstant="2021-08-24T15:34:46Z" SessionNotOnOrAfter="2021-08-24T23:34:46Z" SessionIndex="_a7a68666092117d24aab8adecf1b0830622855b85...">
              <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
              </saml:AuthnContext>
            </saml:AuthnStatement>


            <saml:AttributeStatement>
              <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">6ddf4027-3397-4e45-8628-0189f60fe91e</saml:AttributeValue>
              </saml:Attribute>
              <saml:Attribute Name="full name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">Sarah Knowles</saml:AttributeValue>
              </saml:Attribute>
              <saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">sknowles@tomahawk.ca</saml:AttributeValue>
              </saml:Attribute>
            </saml:AttributeStatement>


          </saml:Assertion>
        </samlp:Response>