Home

Enabling SAML authentication for Unravel Web UI

To use SAML you must configure both your Unravel Host and SAML server.

Configure Unravel host

  1. Stop Unravel

    <Unravel installation directory>/unravel/manager stop

  2. Set the following properties:

    <Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.mode saml 
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.saml.config </path/to/saml.json>

    Note

    For more SAML Authentication properties, see SAML properties.

  3. Apply the changes.

    <Unravel installation directory>/unravel/manager config apply

  4. Edit saml.json file. Following is a sample of saml.json file

    {
  "entryPoint":"http://myHost.unraveldata.com:9080/simplesaml/saml2/idp/SSOService.php",

  "issuer":"localhost",

  "logoutUrl":"http://myHost.unraveldata.com:9080/simplesaml/saml2/idp/SingleLogoutService.php",

  // generated by saml host
"cert":"MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdAcQf2CGAaVfwTTfSlzNLsF2lW/ly7yapFzlYSJLGoVE+OHEu8g5SlNACUEfkXw+5Eghh+KzlIN7R6Q7r2ixWNFBC/jWf7NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG99CJ25RkAcSobWNF5zD0O6lgOo3cEdB/ksCq3hmtlC/DlLZ/D8CJ+7VuZnS1rR2naQ==",
"privateCert":"-----BEGIN PRIVATE // generated by unravel node
       KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEt4Ma2k4DUkoW\nG9QDHUBnY7S/iS/+u2BjPZqUG2JktzYZl30J05zA6i642i2VDn8eUIPHqt2Hw249\nZ3nHKL4YnBVqa3yTfEkdMB/6GSAkoCbnufaD3IsGcFJnlW5raDiT/GZMy+1WnDfJ\npB0/.......vD8kRkcmEi9t3KLmKVy3SO15/YHAhLxP9oTnTFGkPnIqZLRM0Y55UfwbRSZDlgH/\ny9GGmsV5IaIwhepuALJMdkHp\n-----END PRIVATE KEY-----\n",

  "unravel_mapping":
   {
     "username":"userid",
       "groups":"ds_groups"
   }
}

    Property

    Description

    Req

    Example Values

    entryPoint

    Identity provider entry point, Ping IdP address (SSO URL).

    Note: Identity provider entry point is required to be spec-compliant when the request is signed.

    Yes

    "http://myHost:9080/simplesaml/saml2/idp/SSOService.php"

    issuer

    Name of app that will connect to the saml server.

    Issuer string to supply to identify provider (Environment name). Should match the name configured in Idp.

    Yes

    "unravel-myHost”

    cert

    IDP's public cert to validate auth response signature.

    Note: You retrieve this from saml host.

    Yes

    Idp Cert String

    logoutUrl

    Base address to call with logout requests.

    Default: entryPoint

    No

    "http://myHost:9080/simplesaml/saml2/idp/SingleLogoutService.php"

    logoutEnabled

    If true logs you out from every app.

    No

    false

    unravel_mapping

    Mapping saml auth response attributes to Unravel attributes.

    Yes

    {

    "username":"userid",

    "groups":"ds_groups"

    }

    privateCert

    Unravel private cert string to sign Auth requests.

    No

    Unravel cert string

    For Ping, the IdP certificate can be obtained as follows:

    1. In the Server Configuration section, select Certificate Management and Digital Signing & XML Decryption Keys & Certificates.

    2. Click Export for the IdP certificate that you require.

    3. Select Certificate Only and click Next.

    4. Click Export, and save the file.

  5. Start Unravel

    <Unravel installation directory>/unravel/manager start
Configure SAML server

Configure the following properties on the SAML server. Replace UNRAVEL_HOST with the fully qualified path or IP address of your Unravel host.

Property

Description

Req

PingFederate Specific configuration

AssertionConsumerService /

ACS Url

http(s)://UNRAVEL_HOST:3000/saml/consume

Yes

Edit a SAML Application

Setting Assertion Consumer Service URLs

Entity Identifier

unravel-Congo24

Yes

Should be the same as the issuer in saml.json.

Single Logout Endpoint

http://UNRAVEL_HOST:3000/

Specifying Single Logout Service URL

Single Logout Response Endpoint

http://UNRAVEL_HOST:3000/

No

Note

To use SAML with RBAC see Configure LDAP or SAML RBAC Properties.

SAML properties
SAML

These properties are required when com.unraveldata.login.mode=saml.

In this section: