The configuration steps are as follows:
- Install the PHP LDAP module on your Ubersmith instance.
- Add a SAML authorization module to Ubersmith.
- Configure PingOne (below).
- Configure Ubersmith (below).
Configuring PingOne
From PingOne, add a SAML-enabled application using the configurations below. See PingOne’s guide for more information.
Complete Basic Information
- For Protocol Version, enter SAML v 2.0.
- For Assertion Consumer Service (ACS), enter https://[YOUR UBERSMITH DOMAIN]/.
- For Entity ID, enter https://[YOUR UBERSMITH DOMAIN].
- For Application URL, enter https://[YOUR UBERSMITH DOMAIN]/.
- For Single Logout Endpoint, enter https://[YOUR UBERSMITH DOMAIN]/logout.php.
- For Single Logout Response Endpoint, enter https://[YOUR UBERSMITH DOMAIN]/.
- For Single Logout Binding Type, enter Post.
- For Verification Certificate, enter the following at a webroot command line and then upload the generated saml_sp.crt.
$ openssl dsaparam -out saml_sp_dsa_param.pem 4096
$ openssl gendsa -out saml_sp.pem saml_sp_dsa_param.pem
$ openssl req -new -x509 -key saml_sp.pem -out saml_sp.crt
Complete SSO Attributes
- For first, enter First Name.
- For last, enter Last Name.
- For email, enter Email.
- For access, enter memberOf.
- For user, click Advanced.
For IDP Attribute Name or Literal Value, enter SAML_SUBJECT.
For Function, enter GetLocalPartFromEmail?.
Configuring Ubersmith
Access the User Authentication page.
Complete the Details Tab
- In the Enabled field, select Yes to enable a specific authentication module.
- In the Module field, select SAML.
- In the Priority field, enter the order of priority in which server to use to authenticate users.
- Select the Create User on Login field to create a new user upon their first login attempt.
Complete the Config Tab
- Click the Config tab.
- In the ID Provider (IdP) field, enter https://sso.connect.pingidentity.com/.
- In the IdP Name field, enter Ping.
- In the IdP Icon field, enter https://admin.pingone.com/web-portal/assets/theme/img/logo-pingidentity-sm.png.
- In the IdP Signon URL field, enter https://sso.connect.pingidentity.com/sso/[your iDP ID given to you]/SSO.saml2?.
- In the IdP Logout URL field, enter https://sso.connect.pingidentity.com/sso/SLO.saml2.
- In the IdP x509 Certificate field, paste your PingOne account origination certificate, copied from PingOne at Setup - Certificates - PingOne Account Origination Certificate.
- In the Ubersmith “Login Name” Attribute Name field, enter user.
- In the First Name Attribute Name field, enter first.
- In the Last Name Attribute Name field, enter last.
- In the Email Address Attribute Name field, enter email.
- In the Permission Group Attribute Name field, enter access.
- In the Service Provider (SP) Entity ID field, enter https://[YOUR UBERSMITH DOMAIN].
- In the SP x509 Certificate field, copy and paste the certificate you previously generated in the Complete Basic Information section above.
- In the SP x509 Private Key field, copy and paste the private key you previously generated in the Complete Basic Information section above.
You can map permission groups from the PingOne to Ubersmith. See Editing Access for Authentication Modules. |
On this page: |