View source for SAML 2.0 Federated Authentication

QPR ProcessAnalyzer supports authenticating users with federated authentication using the SAML 2.0 protocol. QPR ProcessAnalyzer works as a '''service provider (SP)''' and uses an external '''identity providers (IdP)''' to provide user identity (i.e. authenticating users). Commonly used identity providers are Azure AD and Microsoft Active Directory Federation Services (ADFS).

== Introduction ==
When QPR ProcessAnalyzer is configured as a SAML 2.0 service provider (SP), users can authenticate to QPR ProcessAnalyzer via the configured SAML 2.0 identity provider (IdP). When accessing QPR ProcessAnalyzer, users are automatically redirected to the identity provider for authentication. When the authentication is done, users are redirected back to QPR ProcessAnalyzer where user is then automatically logged in. When using federated authentication, users don't normally see the QPR ProcessAnalyzer login page. The login page can be accessed (e.g. when login using QPR ProcessAnalyzer user management credentials) by adding '''forceLogin=1''' parameter to the url, e.g. <nowiki>https://customer.onqpr.com/QPRPA/ui/#/login?forceLogin=1</nowiki>. 

QPR ProcessAnalyzer can also automatically redirect users to the identity provider from the url '''/qprpa/api/saml''', e.g. <nowiki>https://customer.onqpr.com/qprpa/api/saml</nowiki>. Redirection to this url can be configured to IIS, when users access QPR ProcessAnalyzer with the server name only, e.g. <nowiki>https://customer.onqpr.com</nowiki>. The advantage of using this url is that the QPR ProcessAnalyzer web application is not loaded before the authentication, making the authentication flow faster. When going to the identity provider using a url starting with <nowiki>https://customer.onqpr.com/QPRPA/ui/</nowiki>, the QPR ProcessAnalyzer web application is loaded before going to the identity provider.

When a user logs in to QPR ProcessAnalyzer for the first time, user account is created to QPR ProcessAnalyzer user management. This account can only log in using the federated authentication, because the user account doesn't have a password in QPR ProcessAnalyzer. User accounts are matched between QPR ProcessAnalyzer and the identity provider using usernames.

Additional notes for the federated authentication:
* QPR ProcessAnalyzer needs to use https when SAML 2.0 authentication is used.
* QPR ProcessAnalyzer only supports setup using SAML metadata (e.g. setup using a identity provide public key is not supported).
* QPR ProcessAnalyzer only supports SAML POST binding (e.g. SAML redirect binding is not supported).
* Logout request to identity provider is not supported by QPR ProcessAnalyzer.
* ''SAML AuthnRequests'' are self-signed using a certificate that is embedded to QPR ProcessAnalyzer. The certificate metadata and public key are available from QPR CustomerCare (customercare@qpr.com).
* ''SAML Assertions'' must be signed (by the identity provider) to be accepted by QPR ProcessAnalyzer.
* If user clicks the logout button, user is redirected to the QPR ProcessAnalyzer login page. There user can click the '''Log in using SSO''' button to relogin.
* If the QPR ProcessAnalyzer session expires, user is redirected back to the identity provider for relogin.

==Configuring SAML to QPR ProcessAnalyzer==

To configure the SAML 2.0 authentication, follow these steps:
# Define settings '''SAMLMetadataUrl''', '''ServiceProviderLocation''' and optionally '''SAMLUserIdAttribute''' in the [[PA_Configuration_database_table#SAML_2.0_Federated_Authentication_Settings|QPR ProcessAnalyzer configuration table]]. QPR ProcessAnalyzer needs to be restarted for the settings to take effect.
# Configure a redirection from the root path of the QPR ProcessAnalyzer server to '''/QPRPA/api/saml''', so that users are automatically redirected to the identity provider for authentication.
# The identity provider configuration depends on which identity provide is used. See below for help how to configure [[#Using Azure AD as Identity Provider|Azure AD]] and [[#Using ADFS as Identity Provider|ADFS]] as the identity provider.

If there are any issues with the authentication, please check the [[QPR_ProcessAnalyzer_Logs|QPR ProcessAnalyzer logs]].

==Using Azure AD as Identity Provider==
Azure Active Directory (AAD) can be used as an identity provider to login to QPR ProcessAnalyzer. Following configurations are needed:
# Login to https://portal.azure.com, click '''Azure Active Directory''', click '''App registrations''' and click '''New application registration'''.
# Define '''Name''' for the application, e.g., "QPR ProcessAnalyzer". Select '''Application type''' to be '''Web app / API'''. Define '''Sign-on URL''' to be '''<nowiki>https://SERVERNAME/api/samlsignin</nowiki>''' (where SERVERNAME is the name of your QPR ProcessAnalyzer server).
# When the Azure application has been created, from the applications settings click '''Properties'''.
# Click '''Azure Active Directory''', click '''App registrations''' and click '''Endpoints'''. Copy the contents of the '''Federation Metadata Document''' field, and configure it to the QPR ProcessAnalyzer SAML_METADATA_URL setting (discussed above).

More information about Azure Active Directory: https://docs.microsoft.com/en-us/azure/active-directory/

==Using ADFS as Identity Provider==
ADFS (Active Directory Federation Services) can be used as an identity provider to login to QPR ProcessAnalyzer. For ADFS setup, follow the ADFS configuration guide in https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust with the following notes:
* Step 4: Select option '''Enter data about the relying party manually''' as metadata is not available.
* Step 5: Name can be chosen freely.
* Step 7: Disable option '''Enable support for the WS-Federation Passive protocol'''. Select option '''Enable support for the SAML 2.0 WebSSO protocol''' and define url '''<nowiki>https://SERVERNAME/api/samlsignin</nowiki>''' where SERVERNAME is the QPR ProcessAnalyzer server hostname.
* Step 8: Define url '''<nowiki>https://SERVERNAME/api/samlsignin</nowiki>''' where SERVERNAME is the QPR ProcessAnalyzer server hostname.
* Step 11: Select option '''Configure claims issuance policy for this application'''.

Example:
<pre>
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/claims/CommonName", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "http://schemas.xmlsoap.org/claims/Group"), query = ";userPrincipalName,displayName,mail,tokenGroups;{0}", param = c.Value);
</pre>

== SAML 2.0 Authentication API ==
QPR ProcessAnalyzer has [[Web_API:_Samlsignin|/api/samlsignin]] endpoint which accepts a SAML assertion from the IdP and returns a HTTP redirection to QPR ProcessAnalyzer Web UI. The url contains a ''sys:samlHash'' parameter which is used by the Web UI to login the user using the [[Web_API:_Token|/token]] endpoint (to get a session token to use in the interactions with the Web API).

==References==
* General information about federated authentication: https://en.wikipedia.org/wiki/Federated_identity
* General information about SAML 2.0: https://en.wikipedia.org/wiki/SAML_2.0
* SAML 2.0 in Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol
* General information about ADFS: https://en.wikipedia.org/wiki/Active_Directory_Federation_Services
* ADFS documentation: https://msdn.microsoft.com/en-us/library/bb897402.aspx

[[Category: QPR ProcessAnalyzer]]