Globalyzer Server SSO Installation - Revision history

MaryH: /* Configure GzserverConfig.groovy */

2023-08-31T22:19:05Z

Configure GzserverConfig.groovy

← Older revision		Revision as of 22:19, 31 August 2023
Line 111:		Line 111:

	// idp configuration		// idp configuration
	grails.plugin.springsecurity.saml.metadata.defaultIdp = 'entity id found in idp.xml'		grails.plugin.springsecurity.saml.metadata.defaultIdp = '<entity id found in idp.xml>'
	grails.plugin.springsecurity.saml.metadata.idp.file = 'file:/path/to/idp.xml'		grails.plugin.springsecurity.saml.metadata.idp.file = 'file:/path/to/idp.xml'
	grails.plugin.springsecurity.saml.metadata.providers = ['<your-saml-key>':'file:/path/to/idp.xml']		grails.plugin.springsecurity.saml.metadata.providers = ['<your-saml-key>':'file:/path/to/idp.xml']
Line 117:		Line 117:
	// sp configuration		// sp configuration
	grails.plugin.springsecurity.saml.metadata.sp.file = "/path/to/sp.xml"		grails.plugin.springsecurity.saml.metadata.sp.file = "/path/to/sp.xml"
	grails.plugin.springsecurity.saml.metadata.sp.alias = "entity id found in sp.xml file"		grails.plugin.springsecurity.saml.metadata.sp.alias = "<entity id found in sp.xml file>"
	grails.plugin.springsecurity.saml.metadata.sp.defaults.alias = 'entity id found in sp.xml file';		grails.plugin.springsecurity.saml.metadata.sp.defaults.alias = '<entity id found in sp.xml file>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = 'entity id found in sp.xml file'		grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = '<entity id found in sp.xml file>'

	// true if want token to auto renew when user logs into server		// true if want token to auto renew when user logs into server

MaryH: /* Extra Configuration for Https */

2023-08-24T18:13:12Z

Extra Configuration for Https

← Older revision		Revision as of 18:13, 24 August 2023
Line 152:		Line 152:
	scheme="https"		scheme="https"
	/>		/>

			Or you can configure your reverse proxy to preserve https in the request header. In apache, it would look like this:
			RequestHeader add X-Forwarded-Proto https

	== Trouble-Shooting your SSO Configuration ==		== Trouble-Shooting your SSO Configuration ==

MaryH: /* Extra Configuration for Https */

2023-03-07T18:45:00Z

Extra Configuration for Https

← Older revision		Revision as of 18:45, 7 March 2023
Line 145:		Line 145:

	== Extra Configuration for Https ==		== Extra Configuration for Https ==
	If your server is running under https, in the tomcat server.xml file, you must set the scheme for the Connector.		If your server is running under https, in the tomcat server.xml file, you must set the scheme for the Connector to https.
	For example:		For example:
	<Connector port="8080"		<Connector port="8080"

MaryH at 18:44, 7 March 2023

2023-03-07T18:44:27Z

← Older revision		Revision as of 18:44, 7 March 2023
Line 143:		Line 143:
	grails.plugin.springsecurity.saml.keyManager.storePass = 'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)'		grails.plugin.springsecurity.saml.keyManager.storePass = 'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)'
	grails.plugin.springsecurity.saml.passwords = [<your-saml-key>:'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)']		grails.plugin.springsecurity.saml.passwords = [<your-saml-key>:'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)']

			== Extra Configuration for Https ==
			If your server is running under https, in the tomcat server.xml file, you must set the scheme for the Connector.
			For example:
			<Connector port="8080"
			protocol="HTTP/1.1"
			...
			scheme="https"
			/>

	== Trouble-Shooting your SSO Configuration ==		== Trouble-Shooting your SSO Configuration ==

MaryH: /* Encrypting SSO Passwords */

2023-03-07T18:21:15Z

Encrypting SSO Passwords

← Older revision		Revision as of 18:21, 7 March 2023
Line 142:		Line 142:
	Then place the generated password in the GzserverConfig.groovy file within ENC():		Then place the generated password in the GzserverConfig.groovy file within ENC():
	grails.plugin.springsecurity.saml.keyManager.storePass = 'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)'		grails.plugin.springsecurity.saml.keyManager.storePass = 'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)'
	grails.plugin.springsecurity.saml.passwords = [~~samlkey~~:'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)']		grails.plugin.springsecurity.saml.passwords = [<your-saml-key>:'ENC(CLCjzYV02uZaWDTDkcvK65BndTfUlH5leL00vsgWkmY=)']

	== Trouble-Shooting your SSO Configuration ==		== Trouble-Shooting your SSO Configuration ==

MaryH: /* Configure GzserverConfig.groovy */

2023-03-07T18:20:44Z

Configure GzserverConfig.groovy

MaryH: /* Generate Keys and Keystore */

2023-03-07T18:17:12Z

Generate Keys and Keystore

← Older revision		Revision as of 18:17, 7 March 2023
Line 48:		Line 48:
	== Generate Keys and Keystore ==		== Generate Keys and Keystore ==
	* Generate key and keystore:		* Generate key and keystore:
	keytool -genkey -alias <your-saml-key> -keyalg RSA -keystore ~~saml~~-~~keystore~~.jks		keytool -genkey -alias <your-saml-key> -keyalg RSA -keystore <your-key-store.jks>
	* Accept Identity Provider Certficate		* Accept Identity Provider Certficate
	keytool -import -alias okta -keystore ~~saml~~-~~keystore~~.~~jsk~~ -file <certificate you downloaded from okta>		keytool -import -alias okta -keystore <your-key-store.jks> -file <certificate you downloaded from okta>

	== Generate sp.xml ==		== Generate sp.xml ==

MaryH: /* Configure GzserverConfig.groovy */

2023-03-07T18:16:01Z

Configure GzserverConfig.groovy

MaryH: /* Generate sp.xml */

2023-03-07T17:53:36Z

Generate sp.xml

MaryH: /* Generate sp.xml */

2023-03-07T16:22:05Z

Generate sp.xml

← Older revision		Revision as of 16:22, 7 March 2023
Line 80:		Line 80:
	</md:EntityDescriptor>		</md:EntityDescriptor>

	* Modify <b>entityId</b> to match what you specified as <b>Audience</b> in your Okta app		* Modify <b>entityId</b> to match what you specified as <b>Audience</b> in your Okta app, relacing gzkey with the key you created above.
	* Replace the two <b>CERTIFICATEs</b> with the certificate you downloaded from Okta. Open the file and grab the lines between BEGIN CERTIFICATE and END CERTIFICATE in the downloaded file.		* Replace the two <b>CERTIFICATEs</b> with the certificate you downloaded from Okta. Open the file and grab the lines between BEGIN CERTIFICATE and END CERTIFICATE in the downloaded file.
	* Update the various <b>Locations</b> to be the machine your Globalyzer Server is running on ... keeping the /gzserver/login/saml2/sso/<your-saml-key> or /gzserver/saml/SingleLogout endings		* Update the various <b>Locations</b> to be the machine your Globalyzer Server is running on ... keeping the /gzserver/login/saml2/sso/<your-saml-key> or /gzserver/saml/SingleLogout endings

← Older revision		Revision as of 18:20, 7 March 2023
Line 86:		Line 86:
	== Configure GzserverConfig.groovy ==		== Configure GzserverConfig.groovy ==

	* Copy ~~saml~~-~~keystore~~.jks, sp.xml, and idp.xml files to a specific location on the machine running the Globalyzer Server.		* Copy <your-key-store.jks>, sp.xml, and idp.xml files to a specific location on the machine running the Globalyzer Server.
	* Add and configure the following lines to GzserverConfig.groovy:		* Add and configure the following lines to GzserverConfig.groovy:

Line 97:		Line 97:
	// keystore configuration		// keystore configuration
	// assuming you created a keystore named saml-keystore.jks and a key named samlkey ...		// assuming you created a keystore named saml-keystore.jks and a key named samlkey ...
	grails.plugin.springsecurity.saml.keyManager.storeFile = "file:/path/to/~~saml~~-~~keystore~~.jks"		grails.plugin.springsecurity.saml.keyManager.storeFile = "file:/path/to/<your-key-store.jks>"
	grails.plugin.springsecurity.saml.keyManager.storePass = '~~saml.~~keystore.pw'		grails.plugin.springsecurity.saml.keyManager.storePass = '<your-keystore-pw>'
	grails.plugin.springsecurity.saml.keyManager.passwords = [<your-saml-key>:'~~saml.~~keystore.pw']		grails.plugin.springsecurity.saml.keyManager.passwords = [<your-saml-key>:'<your-keystore-pw>']
	grails.plugin.springsecurity.saml.keyManager.defaultKey = '<your-saml-key>'		grails.plugin.springsecurity.saml.keyManager.defaultKey = '<your-saml-key>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.signingKey = '~~samlkey~~'		grails.plugin.springsecurity.saml.metadata.sp.defaults.signingKey = '<your-saml-key>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.encryptionKey = '<your-saml-key>'		grails.plugin.springsecurity.saml.metadata.sp.defaults.encryptionKey = '<your-saml-key>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.tlsKey = '<your-saml-key>'		grails.plugin.springsecurity.saml.metadata.sp.defaults.tlsKey = '<your-saml-key>'
Line 120:		Line 120:
	grails.plugin.springsecurity.saml.metadata.sp.defaults.alias = 'entity id found in sp.xml file';		grails.plugin.springsecurity.saml.metadata.sp.defaults.alias = 'entity id found in sp.xml file';
	grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = 'entity id found in sp.xml file'		grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = 'entity id found in sp.xml file'

	~~// if https, configure the following~~
	~~grails.plugin.springsecurity.saml.scheme = "https"~~
	~~grails.plugin.springsecurity.saml.serverName = "saml.lingoport.net"~~

	// true if want token to auto renew when user logs into server		// true if want token to auto renew when user logs into server

← Older revision		Revision as of 18:16, 7 March 2023
Line 93:		Line 93:
	grails.plugin.springsecurity.saml.active = true		grails.plugin.springsecurity.saml.active = true
	grails.plugin.springsecurity.providerNames = ['samlAuthenticationProvider','anonymousAuthenticationProvider']		grails.plugin.springsecurity.providerNames = ['samlAuthenticationProvider','anonymousAuthenticationProvider']
			grails.plugin.springsecurity.saml.loginFormUrl = '/saml2/authenticate/<your-saml-key>'

	// keystore configuration		// keystore configuration
Line 98:		Line 99:
	grails.plugin.springsecurity.saml.keyManager.storeFile = "file:/path/to/saml-keystore.jks"		grails.plugin.springsecurity.saml.keyManager.storeFile = "file:/path/to/saml-keystore.jks"
	grails.plugin.springsecurity.saml.keyManager.storePass = 'saml.keystore.pw'		grails.plugin.springsecurity.saml.keyManager.storePass = 'saml.keystore.pw'
	grails.plugin.springsecurity.saml.keyManager.passwords = [~~samlkey~~:'saml.keystore.pw']		grails.plugin.springsecurity.saml.keyManager.passwords = [<your-saml-key>:'saml.keystore.pw']
	grails.plugin.springsecurity.saml.keyManager.defaultKey = '~~samlkey~~'		grails.plugin.springsecurity.saml.keyManager.defaultKey = '<your-saml-key>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.signingKey = 'samlkey';		grails.plugin.springsecurity.saml.metadata.sp.defaults.signingKey = 'samlkey'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.encryptionKey = '~~samlkey~~';		grails.plugin.springsecurity.saml.metadata.sp.defaults.encryptionKey = '<your-saml-key>'
	grails.plugin.springsecurity.saml.metadata.sp.defaults.tlsKey = '~~samlkey~~';		grails.plugin.springsecurity.saml.metadata.sp.defaults.tlsKey = '<your-saml-key>'

	// leave as is if created okta app as specified above		// leave as is if created okta app as specified above
Line 111:		Line 112:
	// idp configuration		// idp configuration
	grails.plugin.springsecurity.saml.metadata.defaultIdp = 'entity id found in idp.xml'		grails.plugin.springsecurity.saml.metadata.defaultIdp = 'entity id found in idp.xml'
	grails.plugin.springsecurity.saml.metadata.idp.file = '/path/to/idp.xml'		grails.plugin.springsecurity.saml.metadata.idp.file = 'file:/path/to/idp.xml'
	grails.plugin.springsecurity.saml.metadata.providers = ['~~samlkey~~':'/path/to/idp.xml']		grails.plugin.springsecurity.saml.metadata.providers = ['<your-saml-key>':'file:/path/to/idp.xml']

	// sp configuration		// sp configuration
Line 120:		Line 121:
	grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = 'entity id found in sp.xml file'		grails.plugin.springsecurity.saml.metadata.sp.defaults.entityId = 'entity id found in sp.xml file'

	// ~~http or~~ https ~~along with your machine name~~		// if https, configure the following
	grails.plugin.springsecurity.saml.scheme = "https"		grails.plugin.springsecurity.saml.scheme = "https"
	grails.plugin.springsecurity.saml.serverName = "saml.lingoport.net"		grails.plugin.springsecurity.saml.serverName = "saml.lingoport.net"

← Older revision		Revision as of 17:53, 7 March 2023
Line 55:		Line 55:
	* Create a file named sp.xml with the following contents		* Create a file named sp.xml with the following contents
	<?xml version="1.0" encoding="UTF-8"?>		<?xml version="1.0" encoding="UTF-8"?>
	<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" <b>entityID</b>="https://saml.lingoport.net/gzserver/saml2/service-provider-metadata/~~gzkey~~">		<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" <b>entityID</b>="https://saml.lingoport.net/gzserver/saml2/service-provider-metadata/<your-saml-key>">
	<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">		<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
	<md:Extensions><idpdisco:DiscoveryResponse xmlns:idpdisco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" <b>Location</b>="https://saml.lingoport.net/gzserver/login/auth?disco=true"/>		<md:Extensions><idpdisco:DiscoveryResponse xmlns:idpdisco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" <b>Location</b>="https://saml.lingoport.net/gzserver/login/auth?disco=true"/>
Line 74:		Line 74:
	<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>		<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
	<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>		<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
	<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/~~gzkey~~" index="0" isDefault="true"/>		<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/<your-saml-key>" index="0" isDefault="true"/>
	<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/~~gzkey~~" index="1" isDefault="false"/>		<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/<your-saml-key>" index="1" isDefault="false"/>
	<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/~~gzkey~~" index="2" isDefault="false"/>		<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" <b>Location</b>="https://saml.lingoport.net/gzserver/login/saml2/sso/<your-saml-key>" index="2" isDefault="false"/>
	</md:SPSSODescriptor>		</md:SPSSODescriptor>
	</md:EntityDescriptor>		</md:EntityDescriptor>

	* Modify <b>entityId</b> to match what you specified as <b>Audience</b> in your Okta app~~, relacing gzkey with the key you created above~~.		* Modify <b>entityId</b> to match what you specified as <b>Audience</b> in your Okta app.
	* Replace the two <b>CERTIFICATEs</b> with the certificate you downloaded from Okta. Open the file and grab the lines between BEGIN CERTIFICATE and END CERTIFICATE in the downloaded file.		* Replace the two <b>CERTIFICATEs</b> with the certificate you downloaded from Okta. Open the file and grab the lines between BEGIN CERTIFICATE and END CERTIFICATE in the downloaded file.
	* Update the various <b>Locations</b> to be the machine your Globalyzer Server is running on ... keeping the /gzserver/login/saml2/sso/<your-saml-key> or /gzserver/saml/SingleLogout endings		* Update the various <b>Locations</b> to be the machine your Globalyzer Server is running on ... keeping the /gzserver/login/saml2/sso/<your-saml-key> or /gzserver/saml/SingleLogout endings