Federated Authentication in QPR UI - Revision history

Justuun: /* Common configuration entries */

2020-06-24T14:59:57Z

Common configuration entries

Ollvihe: /* QPR UI as SAML 2.0 Service Provider */

2019-12-16T16:29:32Z

QPR UI as SAML 2.0 Service Provider

Ollvihe: /* Common configuration entries */

2019-05-28T15:09:59Z

Common configuration entries

Ollvihe: /* Setup When Using Metadata */

2019-05-28T14:57:13Z

Setup When Using Metadata

Ollvihe: /* Setup When Using Public Key */

2019-05-16T07:21:54Z

Setup When Using Public Key

Ollvihe: /* QPR UI as SAML 2.0 Service Provider */

2019-04-07T16:08:19Z

QPR UI as SAML 2.0 Service Provider

Ollvihe: /* Common configuration entries */

2019-04-04T08:45:41Z

Common configuration entries

Ollvihe: /* Configuring QPR UI as SAML 2.0 Service Provider */

2018-12-13T13:53:42Z

Configuring QPR UI as SAML 2.0 Service Provider

Ollvihe at 13:51, 13 December 2018

2018-12-13T13:51:44Z

Ollvihe: /* QPR UI as SAML 2.0 Service Provider */

2018-12-13T13:49:49Z

QPR UI as SAML 2.0 Service Provider

@@ Line 98: / Line 98: @@
 |Attribute name in SAML2 assertion that is mapped to user description in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements (the '''Name''' attribute in the '''saml:Attribute''' element is used for matching).
 |-
+|SAML_REQUEST_SIGNING_KEY
 |}

@@ Line 10: / Line 10: @@
 * For the federated authentication to work, the [[Common QPR Authentication]] must also be configured. This is because the federated authentication authenticates user to QPR UI, and to further authenticate user to QPR Suite or QPR ProcessAnalyzer, the common QPR authentication needs to be functional.
 * When QPR UI has been configured to use an identity provider, QPR UI will fully trust information coming from the identity provider.
 * Currently the logout request to IdP is not supported by QPR UI.
 * SAML AuthnRequests are not signed (by QPR UI), and SAML Assertions must be signed (by the IdP) to be accepted by QPR UI

@@ Line 85: / Line 85: @@
 |SAML_USER_FULLNAME_ATTRIBUTE
+|
-|Attribute name in SAML2 assertion that is mapped to user full name in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements.
+|Attribute name in SAML2 assertion that is mapped to user full name in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements (the '''Name''' attribute in the '''saml:Attribute''' element is used for matching).
 |-
 |SAML_USER_EMAIL_ATTRIBUTE
+|
-|Attribute name in SAML2 assertion that is mapped to user email address in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements.
+|Attribute name in SAML2 assertion that is mapped to user email address in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements (the '''Name''' attribute in the '''saml:Attribute''' element is used for matching).
 |-
 |SAML_USER_GROUPS_ATTRIBUTE
+|
-|Attribute name in SAML2 assertion that is mapped to user groups name in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped and users are not added to or removed from any groups. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements.
+|Attribute name in SAML2 assertion that is mapped to user groups name in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped and users are not added to or removed from any groups. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements (the '''Name''' attribute in the '''saml:Attribute''' element is used for matching).
 |-
 |SAML_USER_DESCRIPTION_ATTRIBUTE
+|
-|Attribute name in SAML2 assertion that is mapped to user description in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements.
+|Attribute name in SAML2 assertion that is mapped to user description in QPR user management. If this setting doesn't exist in the database, the attribute is not mapped. Note that this setting must not be NULL or an empty string. In the SAML2 assertion, attributes are in the '''saml:Assertion''' > '''saml:AttributeStatement''' > '''saml:Attribute''' elements (the '''Name''' attribute in the '''saml:Attribute''' element is used for matching).
 |-

@@ Line 38: / Line 38: @@
 |SAML_SERVER_ENTITY_IDENTIFIER
 |Server entity identifier
-|Use this field to define the identity provider entity ID, if the federation metadata contains multiple identity providers. This field is not mandatory, if the metadata contains only one identity provider. In the federation metadata, a single '''EntityDescriptor''' tag represents one identity provider, so you can check the number of available identity providers by checking the federation metadata contents.
+|Use this field to define the identity provider entity ID, if the federation metadata contains multiple identity providers. This field is not mandatory, if the metadata contains only one identity provider. In the federation metadata, a single '''EntityDescriptor''' tag represents one identity provider, so you can check the number of available identity providers by checking the federation metadata contents ('''entityID''' attribute).
 |}

@@ Line 52: / Line 52: @@
 |SAML_REDIRECT_URL
 |Federated authentication provider's redirect URL
-|The redirect URL of the identity provider. QPR MobileDashdoard redirects user to this url when user needs to be authenticated, e.g. '''<nowiki>https://your.federated.identity.provider.com/saml/http-post/sso</nowiki>'''. This setting is mandatotory, when using public key method.
+|The redirect URL of the identity provider. QPR UI redirects user to this url when user needs to be authenticated, e.g. '''<nowiki>https://your.federated.identity.provider.com/saml/http-post/sso</nowiki>'''. This setting is mandatotory, when using public key method.
 |-
 |SAML_SIGNING_CERTIFICATE

@@ Line 12: / Line 12: @@
 * It's not possible prohibit successfully federatedly authenticated users to login to QPR UI. Still, user permissions to data located in QPR Suite and/or QPR ProcessAnalyzer, can be managed by QPR Suite and/or QPR ProcessAnalyzer permissions.
 * Currently the logout request to IdP is not supported by QPR UI.
 When using federated authentication, QPR UI can also be used to provide authentication to QPR Suite. This requires to configure [[Common QPR Authentication|common authentication]]. After the federated authentication to QPR UI, users can open QPR Suite portal by clicking a link in a QPR UI view (the link contains the '''xsession''' parameter for the common QPR authentication).

@@ Line 17: / Line 17: @@
 ==Configuring QPR UI as SAML 2.0 Service Provider==
-There are two configuration scenarios available for the federated authentication: using metadata or using a public key. Both scenarios have their own settings defined in below tables. There are also common settings defined in the last table that are used in the both authentication scenarios.
+There are two configuration scenarios available for the federated authentication: using metadata or a public key. Both scenarios have their own settings defined in the tables below. The last table contains common settings that are valid for the both authentication scenarios.
 The configuration entries listed in the tables below, can be defined either
-* using the QPR UI installer during the QPR UI installation
+* using the QPR UI installer during the QPR UI installation (only part of the settings)
 * after the QPR UI installation by adding to the '''CONFIGURATIONENTITY''' table in the QPR UI database.

@@ Line 23: / Line 23: @@
 * after the QPR UI installation by adding to the '''CONFIGURATIONENTITY''' table in the QPR UI database.
-===Configuration entries when using metadata===
+=== Setup When Using Metadata ===
 Federated authentication can be configured to use SAML2 metadata if it's available as an XML document through HTTP.
@@ Line 40: / Line 40: @@
 |}
-===Configuration entries when using a public key===
+=== Setup When Using Public Key ===
 The following settings SAML_REDIRECT_URL and SAML_SIGNING_CERTIFICATE are only used when SAML_METADATA_URL is not configured. This is because if metadata url is provided, QPR UI reads the redirect url and signing sertificate from the metadata.

@@ Line 4: / Line 4: @@
 When QPR UI is configured as a SAML 2.0 service provider ('''SP'''), users can authenticate to QPR UI via the configured SAML 2.0 identity provider ('''IdP''') by clicking '''Log in Using SSO''' button in the login screen. This redirects users to the identity provider for authentication. When the authentication is done, users are redirected back to QPR UI and where user is then logged in. Alternatively, QPR UI can be configured automatically to redirect to the identity provider, so that users won't see the QPR UI's login screen.
-When a user logs in to QPR UI using federated authentication, the user information is updated or a new user is created automatically to QPR UI, QPR Suite, and/or QPR ProcessAnalyzer. In addition, the user's group memberships are updated in QPR Suite and/or QPR ProcessAnalyzer if matching group(s) are found between the SAML 2.0 service and QPR Suite /  QPR ProcessAnalyzer. When a new user is created to QPR Suite, '''Inherit licences from groups''' and '''Inherit permissions from groups''' settings are automatically set, so that user permissions come from the groups. User accounts and groups are always matched between the systems using the usernames and group names. For instructions to define which groups and user information is updated, see the [[#Configuring QPR UI as SAML 2.0 Service Provider|Configuring QPR UI as SAML 2.0 Service Provider]] section below.
+When a user logs in to QPR UI using federated authentication, the user information is updated or a new user is created automatically to QPR UI, QPR Suite, and/or QPR ProcessAnalyzer. In addition, the user's group memberships are updated in QPR Suite and/or QPR ProcessAnalyzer if matching group(s) are found between the SAML 2.0 service and QPR Suite /  QPR ProcessAnalyzer. When a new user is created to QPR Suite, '''Inherit licences from groups''' and '''Inherit permissions from groups''' settings are automatically set, so that user permissions come from the groups. For instructions to define which groups and user information is updated, see the [[#Configuring QPR UI as SAML 2.0 Service Provider|Configuring QPR UI as SAML 2.0 Service Provider]] section below.
 Further notes regarding the federated authentication:
 * For the federated authentication to work, the [[Common QPR Authentication]] must also be configured. This is because the federated authentication authenticates user to QPR UI, and to further authenticate user to QPR Suite or QPR ProcessAnalyzer, the common QPR authentication needs to be functional.
 * When QPR UI has been configured to use an identity provider, QPR UI will fully trust information coming from the identity provider.