Page Comparison

Abiquo provides an

...

Configure enterprise and role binding

The first time a user logs in with SAML SSO login is successful, the Abiquo API will need to create a user create the user’s account in the platform. This user requires an Before the user can log in, the administrator must create an Abiquo enterprise and a role, so do these steps to configure enterprise and role for the user and define their SAML attributes. Then the API can get the user’s SAML attributes, select the correct role, and assign it to the user. This is called enterprise and role binding.

...

In Abiquo create enterprises with Names or enterprise property Keys that will match the values of SAML attributes.

...

Here are some examples of how Abiquo can match SAML attributes for enterprises:

• abiquo.saml.attributes.enterprise.claims

...

In Abiquo create roles and set the External roles value to match the value of one or more SAML attributes. One Abiquo role can match multiple external roles, but each external role should only match one Abiquo role.

...

On the Abiquo Server, set the abiquo.saml.attributes.role.claim property to specify the SAML attribute to match the roles

Matching examples

• abiquo.saml.attributes.enterprise.claims = example

  the API will get the value of the attribute example

  = example

  • The API will get the value of the example attribute from the SAML Response. It will try to find an Abiquo enterprise with the same name. If it can't find an enterprise, it will look for an enterprise with an enterprise property key called example that has a property value that matches the SAML Response example attribute value.

• abiquo.saml.attributes.enterprise.claims = organization,acc_id:account

  • The API will get the value of the organization and acc_id attributes from the SAML Response. It will try to find an Abiquo enterprise with the same namea name that matches one of these values. If it can't find an enterprise, it will look for an enterprise with a property key called "example" that has a property value that matches the SAML Response value.search the enterprise properties. It will return the enterprise that has the property organization with the value from the SAML Response and acc_id property with the value of account from the SAML Response.

To configure the enterprise and role binding do these steps:

1. In Abiquo create enterprises for your users and assign Names or enterprise property Keys that will match the values of SAML attributes.

2. On the Abiquo Server, set the abiquo.saml.attributes.enterprise.claims

...

1.  property to specify the SAML attributes to match. Abiquo will get the values of these attributes and search for an enterprise name or enterprise property with this key to match the SAML values.

2. In Abiquo create roles and set the External roles value to match the value of one or more SAML attributes. One Abiquo role can match multiple external roles, but each external role should only match one Abiquo role.

3. On the Abiquo Server, set the abiquo.saml.attributes.role.claim property to specify the SAML attribute to match the roles

...

Enable SAML authentication mode

...

To enable Abiquo to identify and trust the SAML SSO Server (aka Identity Provider or , which is the identity provider (IdP):

1. Get the IdP metadata and save it on the Abiquo Server

2. On the Abiquo Server, set the following property pointing to this file:
   abiquo.saml.metadata.identityprovider.path=/opt/abiquo/config/saml/identityprovider_metadata.xml

3. On the Abiquo Server, you must set the default IdP with the following property:
   abiquo.saml.metadata.identityprovider.default.id
   If you do not add this property, the Abiquo API will not start

...

To configure Abiquo to act as a SAML Service Provider service provider (SP) that can sign and encrypt SAML requests:

...

Generate the service provider metadata

If you do not have an a service provider (SP) metadata XML file, you can generate one using the Abiquo API.

1. Configure the SP properties as described in the above steps.

2. On the Abiquo Server, set the following properties with these values

   1. abiquo.saml.metadata.mode=generated

   2. abiquo.saml.metadata.serviceprovider.path= # can be left empty because it is not used

   3. abiquo.saml.mode=multi

3. Start the Abiquo API

4. Log in as an administrator user (with the PHYS_DC_MANAGE the Manage datacenter privilege) 

5. Perform an authenticated request to the path /api/saml/metadata

6. Save the metadata response in a file

...

  "login.error.SAMLERROR2": "Login failed!",

For details of more customizations, see Customize UI login errors.

...

Configure a SAML enterprise pool

...

Table of Abiquo configuration properties for SAML