| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
| Info |
|---|
About SAML Single Sign-On in SMACS Single Sign-On can be setup in SMACS ZPM against any Identity Provider (IdP) which supports SAML 2.0. This guide covers the steps required to setup SAML SSO against Okta, Azure AD & ADFS IdP’s. For an exhaustive list of supported IDP’s, visit SAML-based products and services. |
Install signed certificate on the SMACS machine
| Note |
|---|
|
...
Generate a CSR
...
Import the Signed Certificate
...
Restart Apache via the Stack8 Console (SSH)
...
| Anchor | ||||
|---|---|---|---|---|
|
Once the certificate is installed and working correctly, export Export the SP Metadata to provide to your IdP.
...
...
If you change/renew your SSL certificate, you will need to perform the following steps:
Restart ZIRO Platform from the stack8-console
Export the SP Metadata from ZIRO Provisioning and update the Service Provider entry in your IdP.
Once completed, your SSO configuration should work using the new SSL certificate.
...
Alternatively, you can provide the URL to the hosted metadata.xml file to your IdP.
| Code Block | ||
|---|---|---|
| ||
https://<SMACS<ZPM-FQDN>:8443/saml/medatada |
Adding
...
ZPM as a Service Provider (SP) in OKTA using URL to the hosted metadata.xml file:
Open the SMACS ZPM SP Metadata file you exported in the previous step to get the information required for configuring the required SAML settings in OKTA
...
Fill in the Single sign on URL and Audience URI (SP Entity ID) fieldsin OKTAby searching your SMACS ZPM SP Metadata file for the values in red below:
Copy the entityID value from the SMACS ZPM SP metadata to the Single sign on URL field in OKTA.
In this example the value is https://stack8-demo.smacs.stack8.com:443/saml/SSO
Copy the </md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location= value from the SMACS ZPM SP metadata to the Audience URI (SP Entity ID) field in OKTA.
In this example the value is https://stack8-demo.smacs.stack8.com:443/saml/metadata
...
Adding
...
ZPM as a Service Provider (SP) in ADFS using metadata.xml file:
Click on Add Relying Party Trust
Select default option “Claims Aware”
Select “Import data about the relying party from a file”
Upload the Service Provider (SP) metadata file from previous step.
Provide a meaningful Display Name for the SMACS ZPM relying party and click “Next”
Select “Permit everyone” and click “Next””
Enable “Configure claims issuance policy for this application” checkbox and click “Close”
...
Set Name ID format to “Unspecfied”
Set Application username to “AD SAM account “User Principal name”
Click Next and then Finish.
...
Edit Claim Issuance Policy
Click “Add Rule”
Choose Claim rule template “Send LDAP Attributes as Claims” and click “Next”
Provide a Claim rule name, select the Attribute Store “Active Directory” from the dropdown, provide the SAM-Account-Name UserPrincipalName to Name ID mapping and click “Finish”.
Provide Users Access to the
...
ZPM Application
In OKTA
Go to the Assignments tab of your newly created application and click the Assign dropdown to select people or groups to assign.
...
Click on “View Setup Instructions” of the SMACS ZPM Application you created for OKTA.
Navigate to the bottom of the page and copy paste the contents of the box containing your IDP metadata to a text file. You will upload this file to SMACS ZPM to complete your SSO setup.
| Note |
|---|
Making changes to the OKTA applications SAML Settings (the steps completed in previous sections) will modify the IDP Metada. You must re-download the latest IDP Metadata anytime a change is made to these settings. |
Go back into
...
ZPM and complete the SAML SSO Configuration
Import your IDP metadata
Enable SSO
Logout from SMACS
Login to the stack8-console using s8admin account and restart the active side of the machine.
Follow the instructions here on how to restart the active side of the smacs machine.
ZPM
Go to the SMACS ZPM URL & click the orange teal login button to authenticate using SAML SSO
Use the Recovery URL to bypass Single Sign-On and to login using LDAPFor any login issues with SSO, please reach out to ZIRO Support.
| Tip |
|---|
SSO Configuration Complete ✔ Once logged in you will have initiated a Single Sign-On session which will give you access to all other applications registered to your IdP server without having to re log-in. |