AppSuite:SAML SSO Integration - Revision history

Khgras at 09:39, 18 May 2021

2021-05-18T09:39:58Z

← Older revision		Revision as of 09:39, 18 May 2021
Line 1:		Line 1:
	= SAML SSO Integration =		= SAML SSO Integration =

	The content on this page has moved to https://documentation.open-xchange.com/~~latest~~/middleware/login_and_sessions/saml_2.0_sso.html.		The content on this page has moved to https://documentation.open-xchange.com/7.10.5/middleware/login_and_sessions/saml_2.0_sso.html

	~~Note~~: ~~Open~~-~~Xchange is in~~ the ~~process of migrating all its technical documentation to a new and improved documentation system (documentation.open~~-~~xchange.com). Please note as the migration takes place more information will~~ be ~~available on the new system and less on this system~~. ~~Thank you for your understanding during this period of transition~~.		== Optional: Univention Corporate Server SAML-SSO Configuration with OX App Suite ==

			Further information on the optional Univention Corporate Server SAML-SSO Configuration with OX App Suite, can be found here: https://oxpedia.org/wiki/index.php?title=AppSuite:UCS_SAML_SSO_with_OX_App_Suite

Choeger at 09:37, 22 July 2019

2019-07-22T09:37:34Z

← Older revision		Revision as of 09:37, 22 July 2019
Line 1:		Line 1:
	= SAML SSO Integration =		= SAML SSO Integration =

	The content on this page has moved to https://documentation.open-xchange.com/~~7.10.2~~/middleware/login_and_sessions/saml_2.0_sso.html.		The content on this page has moved to https://documentation.open-xchange.com/latest/middleware/login_and_sessions/saml_2.0_sso.html.

	Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.		Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.

Khgras at 09:15, 15 May 2019

2019-05-15T09:15:04Z

← Older revision		Revision as of 09:15, 15 May 2019
Line 1:		Line 1:
	= SAML SSO Integration =		= SAML SSO Integration =

	The content on this page has moved to https://documentation.open-xchange.com/~~latest~~/middleware/~~components~~/~~saml~~.html.		The content on this page has moved to https://documentation.open-xchange.com/7.10.2/middleware/login_and_sessions/saml_2.0_sso.html.

	Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.		Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.

Khgras at 10:29, 22 May 2017

2017-05-22T10:29:12Z

← Older revision		Revision as of 10:29, 22 May 2017
Line 1:		Line 1:
	= SAML SSO Integration =		= SAML SSO Integration =

	The content on this page has moved to https://documentation.open-xchange.com/~~7.8.2~~/middleware/components/saml.html.		The content on this page has moved to https://documentation.open-xchange.com/latest/middleware/components/saml.html.

	Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.		Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.

Khgras: Replaced content with "= SAML SSO Integration = The content on this page has moved to https://documentation.open-xchange.com/7.8.2/middleware/components/saml.html. Note: Open-Xchange is in the..."

2016-07-12T09:19:50Z

Replaced content with "= SAML SSO Integration = The content on this page has moved to https://documentation.open-xchange.com/7.8.2/middleware/components/saml.html. Note: Open-Xchange is in the..."

@@ Line 1: / Line 1: @@
 = SAML SSO Integration =
-With 7.8.0 OX App Suite supports single sign-on via SAML 2.0. In concrete the backend supports the ''Web Browser SSO Profile'' and the ''Single Logout Profile'', supported bindings are ''HTTP-Redirect'' and ''HTTP-POST''. The core implementation of SAML needs always be complemented by an environment-specific counterpart. Such a counterpart is called a ''SAML backend''. It is responsible for resolving users by incoming assertions and can make use of several extension points that allow to customize the generation and processing of SAML messages.
+The content on this page has moved to https://documentation.open-xchange.com/7.8.2/middleware/components/saml.html.
-=== Message Flows ===
+Note: Open-Xchange is in the process of migrating all its technical documentation to a new and improved documentation system (documentation.open-xchange.com). Please note as the migration takes place more information will be available on the new system and less on this system. Thank you for your understanding during this period of transition.

Steffen.templin: /* Backend Configuration */

2015-04-21T10:01:02Z

Backend Configuration

← Older revision		Revision as of 10:01, 21 April 2015
Line 45:		Line 45:

	As the lifetime of user sessions is under control of the SAML IdP, you must not activate autologin. It's currently not supported anyway. Make sure that <code>com.openexchange.sessiond.autologin</code> in <code>/opt/open-xchange/etc/sessiond.properties</code> is set to <code>false</code>. Also have a look at the other properties within that file. Its noteworthy that every refresh (e.g. closing the App Suite browser tab and opening it again at a later point) will create a new user session. So the lifetime of App Suite sessions should be short while a user should be able to acquire quite some sessions in parallel.		As the lifetime of user sessions is under control of the SAML IdP, you must not activate autologin. It's currently not supported anyway. Make sure that <code>com.openexchange.sessiond.autologin</code> in <code>/opt/open-xchange/etc/sessiond.properties</code> is set to <code>false</code>. Also have a look at the other properties within that file. Its noteworthy that every refresh (e.g. closing the App Suite browser tab and opening it again at a later point) will create a new user session. So the lifetime of App Suite sessions should be short while a user should be able to acquire quite some sessions in parallel.

			The path of the final login redirect that ends up in the web UI along with a valid session must be configured via <code>/opt/open-xchange/etc/server.properties</code>. If you haven't already (because of other requirements), set <code>com.openexchange.UIWebPath</code> to <code>/appsuite/</code>. App Suite is the only officially supported frontend for SAML authentication.

	Note that session fail-over is currently not possible, because the central session storage only works with autologin enabled.		Note that session fail-over is currently not possible, because the central session storage only works with autologin enabled.

Steffen.templin: /* Operators Guide */

2015-04-10T09:22:06Z

Operators Guide

← Older revision		Revision as of 09:22, 10 April 2015
Line 47:		Line 47:

	Note that session fail-over is currently not possible, because the central session storage only works with autologin enabled.		Note that session fail-over is currently not possible, because the central session storage only works with autologin enabled.

			SAML sessions will not contain the users password. Thus it cannot be used to encrypt/decrypt secrets for external services (e.g. OAuth token). Configure <code>/opt/open-xchange/etc/secret.properties</code> to support other encryption/decryption mechanisms (e.g. "<list>").

			The same problem exists for the primary mail account. Therefore the IMAP accounts must be accessible with a global master password. You need to configure this in <code>/opt/open-xchange/etc/mail.properties</code>

	==== Frontend Configuration ====		==== Frontend Configuration ====

Steffen.templin: /* Configuration */

2015-04-10T07:57:26Z

Configuration

← Older revision		Revision as of 07:57, 10 April 2015
Line 41:		Line 41:
	=== Configuration ===		=== Configuration ===

	The ~~core~~ configuration takes place in <code>saml.properties</code>. Step through this file and set the property values in accordance to their explanation.		==== Backend Configuration ====
			The main configuration takes place in <code>/opt/open-xchange/etc/saml.properties</code>. Step through this file and set the property values in accordance to their explanation.

			As the lifetime of user sessions is under control of the SAML IdP, you must not activate autologin. It's currently not supported anyway. Make sure that <code>com.openexchange.sessiond.autologin</code> in <code>/opt/open-xchange/etc/sessiond.properties</code> is set to <code>false</code>. Also have a look at the other properties within that file. Its noteworthy that every refresh (e.g. closing the App Suite browser tab and opening it again at a later point) will create a new user session. So the lifetime of App Suite sessions should be short while a user should be able to acquire quite some sessions in parallel.

			Note that session fail-over is currently not possible, because the central session storage only works with autologin enabled.

			==== Frontend Configuration ====
			The frontend plugin <code>open-xchange-appsuite-saml</code> is deactivated by default. In order to enable the special SAML login handling, enable a samlLogin flag in <code>/opt/open-xchange/etc/as-config.yml</code>:
			<pre>
			default:
			host: all
			samlLogin: true
			</pre>

			'''Please note:''' Make sure to use spaces not tabs to indent!

Steffen.templin: /* The SAML backend */

2015-04-07T15:22:52Z

The SAML backend

← Older revision		Revision as of 15:22, 7 April 2015
Line 25:		Line 25:
	=== The SAML backend ===		=== The SAML backend ===

	A SAML backend consists at least of an implementation of <code>com.openexchange.saml.spi.SAMLBackend</code>. An instance of this implementation must be registered as OSGi service under this interface. It is considered best practice to start with inheriting from <code>com.openexchange.saml.spi.AbstractSAMLBackend</code> instead of implementing the interface directly. This reduces the number of methods to implement while default implementations are used where it is possible. You probably need to override some of the other methods as well to customize their behavior. Especially the validation of SAML responses needs likely to be adjusted, as the default strategy is very strict and will fail if the IdP does not obey the specification in every point. Start with reading the JavaDoc of the mentioned classes and follow their references to get an overview of what you need to implement. Additionally there is an example implementation in the <code>~~exaples~~/backend-samples</code> repository that targets WSO2 Identity Server as IdP. The according project is <code>com.openexchange.saml.wso2</code>, its packaging information is contained in <code>open-xchange-saml-wso2</code>.		A SAML backend consists at least of an implementation of <code>com.openexchange.saml.spi.SAMLBackend</code>. An instance of this implementation must be registered as OSGi service under this interface. It is considered best practice to start with inheriting from <code>com.openexchange.saml.spi.AbstractSAMLBackend</code> instead of implementing the interface directly. This reduces the number of methods to implement while default implementations are used where it is possible. You probably need to override some of the other methods as well to customize their behavior. Especially the validation of SAML responses needs likely to be adjusted, as the default strategy is very strict and will fail if the IdP does not obey the specification in every point. Start with reading the JavaDoc of the mentioned classes and follow their references to get an overview of what you need to implement. Additionally there is an example implementation in the <code>examples/backend-samples</code> repository that targets WSO2 Identity Server as IdP. The according project is <code>com.openexchange.saml.wso2</code>, its packaging information is contained in <code>open-xchange-saml-wso2</code>.

	SAML might replace the web login of OX App Suite but it cannot be used by non-web clients that make use of the HTTP API directly. Therefore it uses sepcial login/logout calls instead of changing the behavior of the calls from the login module. While those calls are based on an installed authentication service (i.e. a package that provides <code>open-xchange-authentication</code>), SAML is not. Nevertheless an authentication service must always be provided. If you want SAML as your only login mechanims, you can simply register an instance of <code>com.openexchange.saml.spi.DisabledAuthenticationService</code> as OSGi service and let your package provide <code>open-xchange-authentication</code>. You can also decide to implement an own authentication service that takes care of authentication for other clients. It is also possible to install one of the existing <code>open-xchange-authentication</code> providers to allow e.g. IMAP or LDAP authentication.		SAML might replace the web login of OX App Suite but it cannot be used by non-web clients that make use of the HTTP API directly. Therefore it uses sepcial login/logout calls instead of changing the behavior of the calls from the login module. While those calls are based on an installed authentication service (i.e. a package that provides <code>open-xchange-authentication</code>), SAML is not. Nevertheless an authentication service must always be provided. If you want SAML as your only login mechanims, you can simply register an instance of <code>com.openexchange.saml.spi.DisabledAuthenticationService</code> as OSGi service and let your package provide <code>open-xchange-authentication</code>. You can also decide to implement an own authentication service that takes care of authentication for other clients. It is also possible to install one of the existing <code>open-xchange-authentication</code> providers to allow e.g. IMAP or LDAP authentication.

Steffen.templin: /* Message Flows */

2015-04-07T15:20:41Z

Message Flows

← Older revision		Revision as of 15:20, 7 April 2015
Line 8:		Line 8:
	Every SAML request message (i.e. <code><AuthnRequest></code> or <code><LogoutRequest></code>) is sent via the ''HTTP-Redirect'' binding to a formerly configured endpoint. The binding for <code><LogoutResponse></code> messages, that are sent in response to IdP-initiated logout requests is configurable and can be either ''HTTP-Redirect'' or ''HTTP-POST''. Messages of type <code><Response></code> are accepted via the ''HTTP-POST'' binding only, while <code><LogoutRequest></code> and <code><LogoutResponse></code> messages are accepted via ''HTTP-Redirect'' too.		Every SAML request message (i.e. <code><AuthnRequest></code> or <code><LogoutRequest></code>) is sent via the ''HTTP-Redirect'' binding to a formerly configured endpoint. The binding for <code><LogoutResponse></code> messages, that are sent in response to IdP-initiated logout requests is configurable and can be either ''HTTP-Redirect'' or ''HTTP-POST''. Messages of type <code><Response></code> are accepted via the ''HTTP-POST'' binding only, while <code><LogoutRequest></code> and <code><LogoutResponse></code> messages are accepted via ''HTTP-Redirect'' too.

	Below are illustrations ~~for~~ the supported message flows. For reasons of clarity several query parameters like ''SAMLRequest'' or ''RelayState'' have been omitted.		Below are illustrations of the supported message flows. For reasons of clarity several query parameters like ''SAMLRequest'' or ''RelayState'' have been omitted.

	==== Login ====		==== Login ====