Page Comparison

abiquo.auth.module

Sets the authentication module to use in the Abiquo Platform.
Accepts: abiquo, saml, openid, ldap

Yes

abiquo.login.samesite 

Control the value of the SameSite flag of the login cookie.
See Abiquo configuration properties#samesite

No
Default: strict

abiquo.saml.redirectauthentication.endpoint

URI redirect for a successful Abiquo login using SAML SSO.
Accepts: any valid URI
Example: https://your.env.com/ui

Yes

maxage

New in Abiquo 6.0.0

Maximum time in seconds the system allows users to use SAML single sign-on after their initial authentication with the IDP.

Required to start SAML
Default: 2073600

abiquo.saml.redirect.error.endpointURI redirect for an unsuccessful Abiquo login using SAML SSO. This has to be set to a query parameter, "?error", or a valid URI like the one from the examplemode

Indicates the SAML mode to use.
Accepts: any valid URIExample: https://your.env.com/ui/?error=ERROR_CODE
See Configure UI login errors

No
Default: 
?error

• single: only SAML is allowed to authenticate users

• multiple: SAML and Basic Auth are allowed to authenticate users.

No
Default: single

abiquo.saml.metadataredirect.mode = providedIndicates if the SP metadata is provided or must be generated by the APIendpoint

URI redirect for a successful Abiquo login using SAML SSO.
Accepts: any valid URI

• provided: use existing metadata defined with the following property: abiquo.saml.metadata.serviceprovider.path

• generated: the API should generate the metadata. Requires the Abiquo Server to have an SP configuration

No
Default: generated

Example: https://your.env.com/ui

Yes

abiquo.saml.metadataredirect.serviceprovidererror.path

Indicates the location of the SP metadata to load.
Accepts: Any location path of the file to read

Only if abiquo.saml.metadata.mode
is set to provided

abiquo.saml.metadata.identityprovider.path

Indicates the location of the IdP metadata to load.
Accepts: Any location path of the file to read. For multiple identity providers, use a comma separated list

Yesendpoint

URI redirect for an unsuccessful Abiquo login using SAML SSO. This has to be set to a query parameter, "?error", or a valid URI like the one from the example.
Accepts: any valid URI
Example: https://your.env.com/ui/?error=ERROR_CODE
See Configure UI login errors

No
Default: 
?error

abiquo.saml.metadata.generator.bindingSSOIf abiquo.saml.metadata.mode is set to generated, this property will indicate which binding must be allowed.
Accepts: A comma-separated list with the binding namesmode = provided

Indicates if the SP metadata is provided or must be generated by the API.
Accepts:

• provided: use existing metadata defined with the following property: abiquo.saml.metadata.serviceprovider.path

• generated: the API should generate the metadata. Requires the Abiquo Server to have an SP configuration

No
Default: POST, Artifactgenerated

abiquo.saml.keysmetadata.keystoreserviceprovider.path

Indicates the location of the Java keystore from which to extract the keys to sign and/or encrypt the SAML requestsSP metadata to load.
Accepts: Any location path of the file to read

YesOnly if abiquo.saml.metadata.mode
is set to provided

abiquo.saml.keysmetadata.keystoreidentityprovider.passwordThe password to unlock the Java keystore from location indicated by abiquo.saml.keys.keystore.path property.path

Indicates the location of the IdP metadata to load.
Accepts: Any location path of the file to read. For multiple identity providers, use a comma separated list

Yes

abiquo.saml.keysmetadata.signinggenerator.alias

The alias of the key to use for signing SAML Requests
Accepts: any string

Yes

bindingSSO

If abiquo.saml.keys.signing.password

The password of the key to use for signing SAML Requests
Accepts: any string

Yesmetadata.mode is set to generated, this property will indicate which binding must be allowed.
Accepts: A comma-separated list with the binding names

No
Default: POST, Artifact

abiquo.saml.keys.encryptionkeystore.aliasThe alias path

Indicates the location of the key to use for encryption of SAML Requests
Accepts: any stringJava keystore from which to extract the keys to sign and/or encrypt the SAML requests.
Accepts: Any location path of the file to read

Yes

abiquo.saml.keys.encryptionkeystore.password

The password of the key to use for encryption of SAML Requeststo unlock the Java keystore from location indicated by abiquo.saml.keys.keystore.path property.

Yes

abiquo.saml.keys.metadatasigning.signIndicates if the SAML Requests must be signed.alias

The alias of the key to use for signing SAML Requests
Accepts: a booleanany string

NoYesDefault: false

abiquo.saml.keys.signing.bindingpassword

Indicates the binding profile to allow.
Accepts: the SAML binding profile's URNThe password of the key to use for signing SAML Requests
Accepts: any string

Yes

abiquo.saml.attributeskeys.user.id.claimIndicates which SAML Response attribute must identify a unique user; if not set up, the principal will be used.encryption.alias

The alias of the key to use for encryption of SAML Requests
Accepts: any string

NoYes

abiquo.saml.attributeskeys.roleencryption.claimIndicates which SAML Response attribute must be read to find the role to assign to the user during a successful login.
Accepts: any stringpassword

The password of the key to use for encryption of SAML Requests

Yes

abiquo.saml.attributeskeys.enterprisemetadata.claimssign

Indicates which if the SAML Response attributes must be read to find the enterprise to assign to the user during a successful login. Matches an enterprise name or an enterprise property key.
Accepts: a comma-separated list of the claim attributes, with an optional enterprise property key separated by a colon.
Pattern: <saml-attr1>:<ent-prop1>,<saml-attr2>:<ent-prop2>Requests must be signed.
Accepts: a boolean

No
Default: false

abiquo.saml.binding

Indicates the binding profile to allow.
Accepts: the SAML binding profile's URN

Yes

abiquo.saml.attributes.user.firstnameid.claim

Indicates which SAML Response attribute must be read to find the user nameidentify a unique user; if not set up, the principal will be used.
Accepts: any string

NoDefault: FirstName

abiquo.saml.attributes.user.lastnamerole.claim

Indicates which SAML Response attribute must be read to find the user last namerole to assign to the user during a successful login.
Accepts: any string

No
Default: LastNameYes

abiquo.saml.attributes.userenterprise.email.claimclaims

Indicates which attribute SAML Response attributes must be read in order to find the user emailenterprise to assign to the user during a successful login. Matches an enterprise name or an enterprise property key.
Accepts: any stringNo
Default: EmailAddressa comma-separated list of the claim attributes, with an optional enterprise property key separated by a colon.
Pattern: <saml-attr1>:<ent-prop1>,<saml-attr2>:<ent-prop2>

Yes

abiquo.saml.loginattributes.allowuser.enterprisefirstname.poolAllow the use of multiple enterprises with the same enterprise claim property as a pool. Will assign the user to the first enterprise match. Only valid for SAML mode, not for SAML + user (multiple IDPs)claim

Indicates which attribute must be read to find the user name.
Accepts: booleanany string

No
Default: false FirstName

abiquo.saml.metadataattributes.identityprovideruser.defaultlastname.id

Sets the default SAML IdP
Accepts: The entityID attribute of the default IdP from its metadata

Yesclaim

Indicates which attribute must be read to find the user last name.
Accepts: any string

No
Default: LastName

abiquo.saml.metadataattributes.identityprovideruser.userdomainemail.map

For multiple IdPs, map the user domains to the IdPs
Accepts: Comma separated list of email address domains and IdPs

Yes, for multiple IdPsclaim

Indicates which attribute must be read in order to find the user email.
Accepts: any string

No
Default: EmailAddress

abiquo.saml.login.allow.enterprise.pool

Allow the use of multiple enterprises with the same enterprise claim property as a pool. Will assign the user to the first enterprise match. Only valid for SAML mode, not for SAML + user (multiple IDPs).
Accepts: boolean

No
Default: false

abiquo.saml.metadata.identityprovider.default.id

Sets the default SAML IdP
Accepts: The entityID attribute of the default IdP from its metadata

Yes

abiquo.saml.metadata.identityprovider.userdomain.map

For multiple IdPs, map the user domains to the IdPs
Accepts: Comma separated list of email address domains and IdPs

Yes, for multiple IdPs

client.login.modules

Configure Abiquo modules to log in with Basic Auth (default), Open ID, SAML, or SAML + user.

• For the initial SAML configuration, use SAML

• When you add multiple IdPs, use SAML + user

You can copy the options from client-config-default.json

client.skip.login.view

By default, when in OpenID or SAML mode, Abiquo displays an initial screen with a link to the Authentication portal.
If this property is set to true, then Abiquo will not display the initial screen and will redirect users directly to the Authentication portal.