SAML 2.0 Federated Authentication

QPR ProcessAnalyzer can supports using federated authentication with the SAML 2.0 protocol. When using the federated authentication, QPR ProcessAnalyzer works as a service provider (SP), and uses compatible external identity providers (IdP) to provide user identity (i.e. authenticating users). Commonly used identity providers are Azure AD and Microsoft Active Directory Federation Services (ADFS).

General

When QPR ProcessAnalyzer is configured as a SAML 2.0 service provider (SP), users can authenticate to QPR ProcessAnalyzer via the configured SAML 2.0 identity provider (IdP). When accessing QPR ProcessAnalyzer, users are automatically redirected to the identity provider for authentication. When the authentication is done, users are redirected back to QPR ProcessAnalyzer where user is then automatically logged in. When using federated authentication, users don't normally see the QPR ProcessAnalyzer login screen. In exceptional cases, the login screen can be accessed (e.g. when login using QPR ProcessAnalyzer user management credentials) by adding forceLogin=1 parameter to the url, e.g. https://customer.onqpr.com/QPRPA/ui/#/login?forceLogin=1.

QPR ProcessAnalyzer can also automatically redirect users to the identity provider from the url /qprpa/api/saml, e.g. https://customer.onqpr.com/qprpa/api/saml. Redirection to this url can be configured to IIS, when users access QPR ProcessAnalyzer with the server name only, e.g. https://customer.onqpr.com. The advantage of using this url is that the QPR ProcessAnalyzer web application is not loaded before the authentication, making the authentication process faster. When going to the identity provider using a url staring with https://customer.onqpr.com/QPRPA/ui/, the QPR ProcessAnalyzer web application is loaded before going to the identity provider.

When a user logs in to QPR ProcessAnalyzer for the first time, user account is created to QPR ProcessAnalyzer user management. This account can only log in using the federated authentication, because the user account doesn't have a password in QPR ProcessAnalyzer. User accounts are matched between QPR ProcessAnalyzer and the identity provider using usernames.

Additional notes for the federated authentication:

• QPR ProcessAnalyzer needs to use https when SAML authentication is used.
• QPR ProcessAnalyzer only supports setup using SAML metadata (e.g. setup using a public key is not supported).
• QPR ProcessAnalyzer only supports SAML POST binding (e.g. SAML redirect binding is not supported).
• Currently the logout request to IdP is not supported by QPR ProcessAnalyzer.
• SAML AuthnRequests are not signed (by QPR ProcessAnalyzer) and SAML Assertions must be signed (by the IdP) to be accepted by QPR ProcessAnalyzer.
• If user clicks the logout button, user is redirected to the QPR ProcessAnalyzer login page. There user can click the Log in using SSO button to relogin.
• If the QPR ProcessAnalyzer session expires, user is redirected back to the identity provider for relogin.
• When QPR ProcessAnalyzer has been configured to use an identity provider, QPR ProcessAnalyzer will fully trust information coming from the identity provider.

Configuring SAML to QPR ProcessAnalyzer

To configure the SAML authentication, follow these steps:

1. QPR ProcessAnalyzer is configured by defining settings SAMLMetadataUrl, ServiceProviderLocation and optionally SAMLUserIdAttribute in the QPR ProcessAnalyzer configuration table. QPR ProcessAnalyzer needs to be restarted for the settings to take effect.
2. Configure a redirection from the root path of the QPR ProcessAnalyzer server to /QPRPA/api/saml, so that users are automatically redirected to the identity provider for authentication.
3. The identity provider configuration depends on which identity provide is used. See the chapters below for help how to configure Azure AD and ADFS as the identity provider.

If there are issues with the functioning of the authentication, please check the QPR ProcessAnalyzer logs.

Using Azure AD as Identity Provider

Azure Active Directory (AD) can be used as an identity provider to login to QPR ProcessAnalyzer. Configuration scenario (discussed above) for Azure AD is to use metadata. Following configurations are needed:

1. Login to https://portal.azure.com, click Azure Active Directory, click App registrations and click New application registration.
2. Define Name for the application, such as "QPR ProcessAnalyzer". Select Application type to be Web app / API. Define Sign-on URL to be https://SERVERNAME/api/samlsignin (where SERVERNAME is the name of your QPR ProcessAnalyzer server).
3. When the Azure application has been created, from the applications settings click Properties.
4. Click Azure Active Directory, click App registrations and click Endpoints. Copy the contents of the Federation Metadata Document field, and configure it to the QPR ProcessAnalyzer SAML_METADATA_URL setting (discussed above).

More information about Azure Active Directory: https://docs.microsoft.com/en-us/azure/active-directory/

Using ADFS as Identity Provider

ADFS (Active Directory Federation Services) can be used as an identity provider to login to QPR ProcessAnalyzer. For ADFS setup, follow the ADFS configuration guide in https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust with the following notes:

• Step 4: Select option Enter data about the relying party manually as metadata is not available.
• Step 5: Name can be chosen freely.
• Step 7: Disable option Enable support for the WS-Federation Passive protocol. Select option Enable support for the SAML 2.0 WebSSO protocol and define url https://SERVERNAME/api/samlsignin where SERVERNAME is the QPR ProcessAnalyzer server hostname.
• Step 8: Define url https://SERVERNAME/api/samlsignin where SERVERNAME is the QPR ProcessAnalyzer server hostname.
• Step 11: Select option Configure claims issuance policy for this application.

Example:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/claims/CommonName", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "http://schemas.xmlsoap.org/claims/Group"), query = ";userPrincipalName,displayName,mail,tokenGroups;{0}", param = c.Value);

References

• General information about federated authentication: https://en.wikipedia.org/wiki/Federated_identity
• General information about SAML 2.0: https://en.wikipedia.org/wiki/SAML_2.0
• General information about Shibboleth: https://en.wikipedia.org/wiki/Shibboleth_(Internet2)
• Shibboleth documentation: https://wiki.shibboleth.net/confluence/display/SHIB2/Home
• General information about ADFS: https://msdn.microsoft.com/en-us/library/bb897402.aspx
• ADFS documentation: https://en.wikipedia.org/wiki/Active_Directory_Federation_Services