{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"f850b779-01c7-46cd-8e10-c9af72520f89"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"6663f8d9-54e2-46d3-a4b4-4e26e1d392d8"}},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This document describes how to configure the SAML integration to log in the platform with SAML SSO using SAML 2.0. ","type":"text"},{"type":"hardBreak"},{"text":"Please read ","type":"text"},{"text":"all","type":"text","marks":[{"type":"em"}]},{"text":" of this documentation before you start to configure your environment.","type":"text"}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":586,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":690,"alt":"SAML authentication and login flow for Abiquo","id":"8146766e-f44b-42ab-aad4-b9e7218a9587","collection":"contentId-652335272","type":"file","height":366}},{"type":"caption","content":[{"text":"SAML authentication and login flow for Abiquo","type":"text"}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure your SAML identity provider","type":"text"}]},{"type":"paragraph","content":[{"text":"We assume that you are already using SAML and that you already have your own IdP configuration. ","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"We provide some basic instructions to illustrate our example with IdP claims and to give a better picture of our SAML configuration.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do not use these instructions to configure your production environment","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"We do not maintain these instructions","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"To configure Azure Active Directory as an IdP for Abiquo testing:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to Azure portal (","type":"text"},{"text":"https://portal.azure.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://portal.azure.com"}}]},{"text":") ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an Azure Active Directory","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the ","type":"text"},{"text":"Organization","type":"text","marks":[{"type":"strong"}]},{"text":" use ","type":"text"},{"text":"Default Directory","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the ","type":"text"},{"text":"Domain","type":"text","marks":[{"type":"strong"}]},{"text":" use ","type":"text"},{"text":"MY_ORG.onmicrosoft.com","type":"text","marks":[{"type":"code"}]},{"text":" and replace MY_ORG with your organization name","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Switch to the directory and create an Application","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Enterprise applications","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create your own application","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the ","type":"text"},{"text":"Integrate any other application you don't find in the gallery (Non-gallery)","type":"text","marks":[{"type":"strong"}]},{"text":" option","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the Name enter ","type":"text"},{"text":"samlidp","type":"text","marks":[{"type":"code"}]},{"text":" and click ","type":"text"},{"text":"Create","type":"text","marks":[{"type":"strong"}]},{"text":". Then wait for it to complete.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Single sign-on","type":"text","marks":[{"type":"strong"}]},{"text":", for the ","type":"text"},{"text":"Authentication method","type":"text","marks":[{"type":"strong"}]},{"text":", select ","type":"text"},{"text":"SAML,","type":"text","marks":[{"type":"strong"}]},{"text":" and set the following values.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Basic SAML Configuration: add Abiquo URLs to authorize it as a client that can use this SAML IDP.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Identifier (Entity ID): ","type":"text"},{"text":"https://ABIQUO_FQDN:443/api/saml/metadata","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Replace ","type":"text"},{"text":"ABIQUO_FQDN","type":"text","marks":[{"type":"code"}]},{"text":" with the domain name of your Abiquo server","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reply URL","type":"text","marks":[{"type":"strong"}]},{"text":" (Assertion Consumer Service or ACS URL):\t","type":"text"},{"text":"https://ABIQUO_FQDN:443/api/saml/SSO","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Replace ","type":"text"},{"text":"ABIQUO_FQDN","type":"text","marks":[{"type":"code"}]},{"text":" with the domain name of your Abiquo server","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sign on URL","type":"text","marks":[{"type":"strong"}]},{"text":": Set an empty value","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML Claims","type":"text","marks":[{"type":"strong"}]},{"text":": create and set the claims you want to retrieve from AAD users in Abiquo. ","type":"text"},{"type":"hardBreak"},{"text":"For example:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"abq-enterprise","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"user.department","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"abq-role","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"user.jobtitle","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"user.userprincipalname","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"user.givenname","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"user.surname","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"user.mail","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the AAD organization main page and create SAML users. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name:","type":"text","marks":[{"type":"strong"}]},{"text":" This will set the username in Abiquo","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"First Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Last Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Job title","type":"text","marks":[{"type":"strong"}]},{"text":": This will set the user role in Abiquo, e.g., ","type":"text"},{"text":"CLOUD_ADMIN_EXTERNAL","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Department","type":"text","marks":[{"type":"strong"}]},{"text":": This will set the enterprise in Abiquo, e.g., ","type":"text"},{"text":"Abiquo","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the users to the SAML IDP application we created before in order to authorize it to log in with SAML.","type":"text"}]}]}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create enterprises and roles for SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"The first time a user logs in with SAML SSO, the Abiquo API will create the user’s account in the platform. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Before the user can log in, the administrator must create an Abiquo ","type":"text"},{"text":"enterprise","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"role","type":"text","marks":[{"type":"em"}]},{"text":" for the user and define their SAML attributes. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in to Abiquo as cloud admin","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Users","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create enterprises with ","type":"text"},{"text":"Names","type":"text","marks":[{"type":"strong"}]},{"text":" or ","type":"text"},{"text":"Properties","type":"text","marks":[{"type":"strong"}]},{"text":" to match the value of a SAML attribute. From our example above, we will match the SAML ","type":"text"},{"text":"Department","type":"text","marks":[{"type":"strong"}]},{"text":" attribute","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enterprise ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"Abiquo","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OR","type":"text","marks":[{"type":"em"}]},{"text":" if your enterprise names do not match SAML attributes, create or edit an enterprise, go to ","type":"text"},{"text":"Properties","type":"text","marks":[{"type":"strong"}]},{"text":" and create a property to match.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit an enterprise (for example, ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":" = ","type":"text"},{"text":"My favorite enterprise","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create an Enterprise property ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key: ","type":"text","marks":[{"type":"strong"}]},{"text":"department","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"Abiquo","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"}]}]}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Roles","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create roles with ","type":"text"},{"text":"External roles","type":"text","marks":[{"type":"strong"}]},{"text":" to match the value of a SAML attribute. From our example above, we will match ","type":"text"},{"text":"Job title","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Role ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"CLOUD_ADMIN_EXTERNAL","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"External roles","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"CLOUD_ADMIN_EXTERNAL","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure SAML on Abiquo server","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure SAML on the Abiquo server:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in to the Abiquo server as the system administrator","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a folder to store the configuration","type":"text"}]},{"type":"codeBlock","content":[{"text":"mkdir /opt/abiquo/config/saml","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download the federation metadata XML file for your configuration. This may be from a link like:","type":"text"},{"type":"hardBreak"},{"text":"https://login.microsoftonline.com//FederationMetadata/2007-06/FederationMetadata.xml","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"See ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://learn.microsoft.com/en-us/azure/active-directory/azuread-dev/azure-ad-federation-metadata#federation-metadata-endpoints"}},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a metadata file for the identity provider, for example, at ","type":"text"},{"text":"/opt/abiquo/config/saml/idp_metadata.xml","type":"text","marks":[{"type":"code"}]},{"text":" and edit this file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the metadata XML file, and copy the ","type":"text"},{"text":"EntityDescriptor","type":"text","marks":[{"type":"code"}]},{"text":" bracket with only the ","type":"text"},{"text":"IDPSSODescriptor","type":"text","marks":[{"type":"code"}]},{"text":" bracket inside it. Paste it in your metadata file for the entity provider.","type":"text"},{"type":"hardBreak"},{"text":"It should look something like this but with different values for your identity provider.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n\n \n ...\n \n","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"entityID","type":"text","marks":[{"type":"code"}]},{"text":" should be the value from your file. It may be something like this: ","type":"text"},{"text":"https://sts.windows.net/d12345678-123e-49321-1234-1234abcd567890/","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"EntityDescriptor ID","type":"text","marks":[{"type":"code"}]},{"text":" should also be the value from your file.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit ","type":"text"},{"text":"/var/www/html/ui/config/client-config-custom.json","type":"text","marks":[{"type":"code"}]},{"text":" and add the following configuration to allow SAML login.","type":"text"}]},{"type":"codeBlock","content":[{"text":" \"client.login.modules\": [\n {\n \"label\": \"Basic Auth\",\n \"description\": \"Basic Auth login\",\n \"templateUrl\": \"modules/login/authenticationmodules/basicauthentication/partials/basicauthenticationloginview.html\",\n \"cookieName\": \"\"\n },\n {\n \"label\": \"SAML\",\n \"description\": \"SAML login\",\n \"templateUrl\": \"modules/login/authenticationmodules/saml/partials/samlloginview.html\",\n \"cookieName\": \"ABQSAMLTOKENS\"\n }\n ]","type":"text"}]},{"type":"paragraph"}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit ","type":"text"},{"text":"/opt/abiquo/config/abiquo.properties","type":"text","marks":[{"type":"code"}]},{"text":" and configure the following properties.","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"abiquo.auth.module = saml\nabiquo.saml.mode = multi\n\nabiquo.login.samesite = strict\n\n# Mandatory property to control the maximum time in seconds that users can use \n# SAML single sign-on after their initial authentication with the IDP. \n# The default represents 24 days.\nabiquo.saml.authentication.maxage = 2073600\n\nabiquo.saml.redirect.endpoint = https://ABIQUO_FQDN/ui\nabiquo.saml.redirect.error.endpoint = https://ABQIUO_FQDN/ui/?error\nabiquo.saml.keys.keystore.path = /opt/abiquo/config/saml/MY_SAML_KEYSTORE\nabiquo.saml.keys.keystore.password = MY_SAML_KEYSTORE_PASSWORD\nabiquo.saml.keys.signing.alias = MY_SAML_APP_NAME\nabiquo.saml.keys.signing.password = MY_SAML_KEY_PASSWORD\nabiquo.saml.keys.encryption.alias = MY_SAML_APP\nabiquo.saml.keys.encryption.password = MY_SAML_KEY_PASSWORD\nabiquo.saml.keys.metadata.sign = false\nabiquo.saml.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\nabiquo.saml.metadata.mode = generated\n#abiquo.saml.metadata.serviceprovider.path = /opt/abiquo/config/saml/sp_metadata.xml\nabiquo.saml.metadata.identityprovider.default.id = MY_ENTITY_ID\n# For >1 IDPs, add commas between XML paths\nabiquo.saml.metadata.identityprovider.path = /opt/abiquo/config/saml/idp_metadata.xml\n# For >1 IDPs, add commas between pairs of values\nabiquo.saml.metadata.identityprovider.userdomain.map = myorg.onmicrosoft.com=MY_ENTITY_ID\n \n\n# Set the claim names we have set up before in Azure AD\nabiquo.saml.attributes.role.claim = abq-role\nabiquo.saml.attributes.enterprise.claims = abq-enterprise\nabiquo.saml.attributes.user.id.claim = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\nabiquo.saml.attributes.user.firstname.claim = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\nabiquo.saml.attributes.user.lastname.claim = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\nabiquo.saml.attributes.user.email.claim = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\n","type":"text"}]},{"type":"paragraph"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"#abiquo.saml.metadata.serviceprovider.path","type":"text","marks":[{"type":"code"}]},{"text":" property should be commented out because first you can generate the metadata and later provide it with the file saved at this path","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the following values with the values for your environment:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ABIQUO_FQDN","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_KEYSTORE","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_KEYSTORE_PASSWORD","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_APP_NAME","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_KEY_PASSWORD","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_APP","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_SAML_KEY_PASSWORD","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"MY_ENTITY_ID","type":"text","marks":[{"type":"code"}]},{"text":": you can get this from the Azure federation XML. It may be something like ","type":"text"},{"text":"https://sts.windows.net/d12345678-123e-49321-1234-1234abcd567890/ ","type":"text","marks":[{"type":"code"}]}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a keystore with the above keystore values.","type":"text"}]},{"type":"codeBlock","content":[{"text":"cd /opt/abiquo/config/saml\nkeytool -genkey -v -keystore MY_SAML_KEYSTORE -storepass MY_SAML_KEYSTORE_PASSWORD -alias MY_SAML_APP_NAME -keypass MY_SAML_KEY_PASSWORD -keyalg RSA -keysize 2048 -validity 10000","type":"text"}]},{"type":"paragraph","content":[{"text":"(In our test system we are used the one value for the signing and encryption password as ","type":"text"},{"text":"MY_SAML_KEY_PASSWORD)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the Abiquo API","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check that the API works and has started successfully by logging in to Abiquo with basic auth as ","type":"text"},{"text":"admin","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure Abiquo as the service provider","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure Abiquo as a service provider, obtain the metadata, save it to a file, and then enable the use of provided data.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log in the Abiquo API server as an administrator","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate the SP metadata:","type":"text"}]},{"type":"codeBlock","content":[{"text":"curl -k -u ADMIN_USER:ADMIN_PASSWORD https://ABIQUO_FQDN:443/api/saml/metadata \\\n> /tmp/curl_sp_metadata.xml","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"ADMIN_USER","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"ADMIN_PASSWORD","type":"text","marks":[{"type":"code"}]},{"text":", and ","type":"text"},{"text":"ABIQUO_FQDN","type":"text","marks":[{"type":"code"}]},{"text":" with values for your environment","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save it to your SAML configuration folder","type":"text"}]},{"type":"codeBlock","content":[{"text":"xmllint --format /tmp/curl_sp_metadata.xml > /opt/abiquo/config/saml/sp_metadata.xml","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the ","type":"text"},{"text":"abiquo.properties","type":"text","marks":[{"type":"code"}]},{"text":" file and set the values as follows","type":"text"}]},{"type":"codeBlock","content":[{"text":"abiquo.saml.metadata.mode = provided\nabiquo.saml.metadata.serviceprovider.path = /opt/abiquo/config/saml/sp_metadata.xml","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart the Abiquo API","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check that the API works and has started successfully by logging in with SAML","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Username: ","type":"text"},{"text":"USER_NAME@MY_ORG.onmicrosoft.com","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Additional configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"We recommend that you do these additional steps","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the metadata XML file to the IdP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Disable basic authentication. To do this, set the ","type":"text"},{"text":"abiquo.saml.mode","type":"text","marks":[{"type":"code"}]},{"text":" property to ","type":"text"},{"text":"single","type":"text","marks":[{"type":"code"}]},{"text":" (or just delete it because ","type":"text"},{"text":"single","type":"text","marks":[{"type":"code"}]},{"text":" is the default value).","type":"text"}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure custom login error messages for SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, when there is a login error, the UI displays a generic error view and the user can return to the main login screen.","type":"text"}]},{"type":"paragraph","content":[{"text":"Optionally, to display custom error messages, configure the redirect to add an error parameter.","type":"text"}]},{"type":"paragraph","content":[{"text":"On the Abiquo API Server, set the ","type":"text"},{"text":"abiquo.saml.redirect.error.endpoint","type":"text","marks":[{"type":"code"}]},{"text":" to point to your UI server and add an error code as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"abiquo.saml.redirect.error.endpoint = https://your.env.com/ui/?error=ERROR_CODE","type":"text"}]},{"type":"paragraph","content":[{"text":"Then for each error code, create a UI label with the error message text. For example, for US English, in ","type":"text"},{"text":"lang_en_US_custom.json","type":"text","marks":[{"type":"code"}]},{"text":", you could create a label as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":" \"login.error.SAMLERROR2\": \"Login failed!\",","type":"text"}]},{"type":"paragraph","content":[{"text":"For details of more customizations, see ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://abiquo.atlassian.net/wiki/spaces/ABI61/pages/652337603"}},{"text":".","type":"text"}]},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure a SAML enterprise pool","type":"text"}]},{"type":"paragraph","content":[{"text":"Optionally, if you will only be using a single identity provider, you can enable users to log in to an enterprise pool of enterprises with the same enterprise claim value.","type":"text"}]},{"type":"paragraph","content":[{"text":"The login process will select the first matching enterprise from the pool.","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure this option, set the following property.","type":"text"}]},{"type":"codeBlock","content":[{"text":"abiquo.saml.login.allow.enterprise.pool = true","type":"text"}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Add multiple identity providers for SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"You can configure more than one identity provider for SAML. With the configuration, when the user enters their email address to log in, Abiquo will select the IdP based on its domain name, or it will use the default IdP. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Abiquo still uses the same ","type":"text"},{"text":"IdP configuration","type":"text","marks":[{"type":"em"}]},{"text":" for all providers, for example, it will search for the same ","type":"text"},{"text":"abq-role","type":"text","marks":[{"type":"code"}]},{"text":" attribute to match an Abiquo role.","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure an existing SAML integration with more IdPs, do these steps on the Abiquo Server:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the metadata for the new IdPs, as for the first IdP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the default IdP, edit the metadata and set the Default attribute","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the ","type":"text"},{"text":"abiquo.properties","type":"text","marks":[{"type":"code"}]},{"text":" file to make these changes:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the paths to the metadata of the new IdPs as a comma separated list to the ","type":"text"},{"text":"abiquo.saml.metadata.identityprovider.path","type":"text","marks":[{"type":"code"}]},{"text":" property","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To set the default IdP, add the new ","type":"text"},{"text":"abiquo.saml.metadata.identityprovider.default.id","type":"text","marks":[{"type":"code"}]},{"text":" property","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To map the user email domains to IdPs, set the new ","type":"text"},{"text":"abiquo.saml.metadata.identityprovider.userdomain.map","type":"text","marks":[{"type":"code"}]},{"text":" property with a comma separated list of keys and values. For example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"abiquo.saml.metadata.identityprovider.userdomain.map = example.com=https://sts.example.com/ffff2108-833e-4940-87e6-3d39ce9adb70/,abiquo.com=https://idp.example.com","type":"text"}]},{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-warning","text":":warning:","shortName":":warning:"}},{"text":" Do not use a comma ","type":"text"},{"text":",","type":"text","marks":[{"type":"code"}]},{"text":" in a key or a value","type":"text"},{"type":"hardBreak"},{"type":"emoji","attrs":{"id":"atlassian-warning","text":":warning:","shortName":":warning:"}},{"text":" Do not use use an equals sign ","type":"text"},{"text":"=","type":"text","marks":[{"type":"code"}]},{"text":" in the key","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Share the Abiquo SP data with the new IdPs","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On the UI server, edit the ","type":"text"},{"text":"client-config-custom.json","type":"text","marks":[{"type":"code"}]},{"text":" file and change the ","type":"text"},{"text":"client.login.module","type":"text","marks":[{"type":"code"}]},{"text":" property from ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"code"}]},{"text":" to ","type":"text"},{"text":"SAML + user","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"For more details, see the examples in client-config-default.json file.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For this feature, there is a new ","type":"text"},{"text":"/saml/idp","type":"text","marks":[{"type":"code"}]},{"text":" endpoint in the Abiquo API where the UI will send a GET request with the user domain. This endpoint will return a redirect to the usual ","type":"text"},{"text":"/saml/login","type":"text","marks":[{"type":"code"}]},{"text":" endpoint with the appropriate IdP. Then the login will continue as for a single IdP.","type":"text"}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"When you enable this feature, Abiquo will change the XML security metadata of the Abiquo application. Abiquo will add the beans for new IdPs and mark the default IdP in the metadata configuration of ","type":"text"},{"text":"security-saml-generated-beans.xml","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"security-saml-provided-beans.xml","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Before you upgrade Abiquo, you must back up the security beans configuration.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"After you upgrade Abiquo, when there is a new version of the security beans files, you must add the default IdP and the IdP beans again","type":"text"}]}]}]}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"About enterprise and role binding","type":"text"}]},{"type":"paragraph","content":[{"text":"The Abiquo API can get the user’s SAML attributes, select the correct role, and assign it to the user. This is called enterprise and role binding.","type":"text"}]},{"type":"paragraph","content":[{"text":"Here are some examples of how Abiquo can match SAML attributes for enterprises:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.enterprise.claims = example","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The API will get the value of the ","type":"text"},{"text":"example","type":"text","marks":[{"type":"code"}]},{"text":" attribute from the SAML Response. It will try to find an Abiquo enterprise with the same name. If it can't find an enterprise, it will look for an enterprise with an enterprise property key called ","type":"text"},{"text":"example","type":"text","marks":[{"type":"code"}]},{"text":" that has a property value that matches the SAML Response ","type":"text"},{"text":"example","type":"text","marks":[{"type":"code"}]},{"text":" attribute value.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.enterprise.claims = organization,acc_id:account","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The API will get the value of the ","type":"text"},{"text":"organization","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"acc_id","type":"text","marks":[{"type":"code"}]},{"text":" attributes from the SAML Response. It will try to find an enterprise with a name that matches one of these values. If it can't find an enterprise, it will search the enterprise properties. It will return the enterprise that has the property ","type":"text"},{"text":"organization","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"with the value from the SAML Response and ","type":"text"},{"text":"acc_id","type":"text","marks":[{"type":"code"}]},{"text":" property with the value of ","type":"text"},{"text":"account","type":"text","marks":[{"type":"code"}]},{"text":" from the SAML Response. ","type":"text"}]}]}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Table of Abiquo configuration properties for SAML","type":"text"}]},{"type":"paragraph"},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"62149085-f12b-4304-9ded-deb0580d9d0b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"Key","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Required","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"text":"Role","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.auth.module","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Sets the authentication module to use in the Abiquo Platform.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: ","type":"text"},{"text":"abiquo","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"saml","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"openid","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"ldap","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"1b8a07d7-8bc4-40ff-86fe-c3153b1cf8a1"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.login.samesite","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Control the value of the SameSite flag of the login cookie.","type":"text"},{"type":"hardBreak"},{"text":"See ","type":"text"},{"text":"Abiquo configuration properties#samesite","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/ABI61/pages/652339271#Abiquoconfigurationproperties-samesite"}}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: strict","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"9a5a0990-4211-4bb1-b0cd-2bdcb0f4f51d"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"type":"emoji","attrs":{"id":"atlassian-warning","text":":warning:","shortName":":warning:"}},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"abiquo.saml.authentication.maxage","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Required to start SAML and Abiquo","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Maximum time in seconds the system allows users to use SAML single sign-on after their initial authentication with the IDP.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Required to start SAML","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"2073600","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"5f29a9b3-8f1a-434d-9313-24e7168a259d"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.mode","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates the SAML mode to use.","type":"text"},{"type":"hardBreak"},{"text":"Accepts:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"single","type":"text","marks":[{"type":"code"}]},{"text":": only SAML is allowed to authenticate users","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"multiple","type":"text","marks":[{"type":"code"}]},{"text":": SAML and Basic Auth are allowed to authenticate users.","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"single","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"ea3b0157-0ad0-45c4-91e5-5b5eeeaac417"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.redirect.endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"URI redirect for a successful Abiquo login using SAML SSO.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any valid URI","type":"text"},{"type":"hardBreak"},{"text":"Example: ","type":"text"},{"text":"https://your.env.com/ui","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"c9dea7d2-d234-4248-bb65-efe4d860a12e"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.redirect.error.endpoint","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"URI redirect for an unsuccessful Abiquo login using SAML SSO. This has to be set to a query parameter, \"","type":"text"},{"text":"?error","type":"text","marks":[{"type":"code"}]},{"text":"\", or a valid URI like the one from the example.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any valid URI","type":"text"},{"type":"hardBreak"},{"text":"Example: ","type":"text"},{"text":"https://your.env.com/ui/?error=ERROR_CODE","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"See ","type":"text"},{"text":"Configure UI login errors","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/ABI61/pages/652337603"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"type":"hardBreak"},{"text":"?error","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"19184bd7-0350-4e95-953f-8dc93925b6be"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.mode = provided","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates if the SP metadata is provided or must be generated by the API.","type":"text"},{"type":"hardBreak"},{"text":"Accepts:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"provided","type":"text","marks":[{"type":"code"}]},{"text":": use existing metadata defined with the following property: ","type":"text"},{"text":"abiquo.saml.metadata.serviceprovider.path","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"generated","type":"text","marks":[{"type":"code"}]},{"text":": the API should generate the metadata. Requires the Abiquo Server to have an SP configuration","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: generated","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"9d096677-19e3-4569-8de0-c36a076747c2"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.serviceprovider.path","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates the location of the SP metadata to load.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: Any location path of the file to read","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Only if ","type":"text"},{"text":"abiquo.saml.metadata.mode","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"type":"hardBreak"},{"text":"is set to ","type":"text"},{"text":"provided","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"14b7004f-2b8f-4de7-8de0-5ad80e2ab9d3"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.identityprovider.path","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates the location of the IdP metadata to load.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: Any location path of the file to read. For multiple identity providers, use a comma separated list","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"cb999e50-fd27-4830-8070-aaa5d72bad64"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.generator.bindingSSO","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"If ","type":"text"},{"text":"abiquo.saml.metadata.mode","type":"text","marks":[{"type":"code"}]},{"text":" is set to ","type":"text"},{"text":"generated,","type":"text","marks":[{"type":"em"}]},{"text":" this property will indicate which binding must be allowed.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: A comma-separated list with the binding names","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"POST, Artifact","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"f5a5b049-d7bf-4e38-9e97-51941a9044a2"}},{"type":"hardBreak"},{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"733f0480-ab15-45fc-af7a-963d5cdc19f5"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":" abiquo.saml.keys.keystore.path","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates the location of the Java keystore from which to extract the keys to sign and/or encrypt the SAML requests.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: Any location path of the file to read","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"3168f8f1-c06e-46e5-bfa8-a8ca80226f50"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.keystore.password","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"The password to unlock the Java keystore from location indicated by ","type":"text"},{"text":"abiquo.saml.keys.keystore.path","type":"text","marks":[{"type":"code"}]},{"text":" property.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"5368e143-8f1c-4ad9-b135-89e0d32d78b8"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.signing.alias","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"The alias of the key to use for signing SAML Requests","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"d494e80e-dc0b-40a7-bf2a-866339978d8f"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.signing.password","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"The password of the key to use for signing SAML Requests","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"e9160ec0-a5cf-48de-85a6-2128515dd46f"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.encryption.alias","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"The alias of the key to use for encryption of SAML Requests","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"32eca95c-7802-4cef-8d8b-9a3c2e6adb8a"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.encryption.password","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"The password of the key to use for encryption of SAML Requests","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"8fd0c8c6-5c34-4ad3-9f97-88ec0adae5ea"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.keys.metadata.sign","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates if the SAML Requests must be signed.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: a boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"admin","localId":"e6440574-b52e-4128-8ba5-ee407281e587"}},{"type":"hardBreak"},{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"de82905c-2ff7-4bd5-9102-82ce91b2b07e"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.binding","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates the binding profile to allow.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: the SAML binding profile's URN","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"b1719f76-0e6f-407d-8bb3-3d4951c7972f"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.user.id.claim","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which SAML Response attribute must identify a unique user; if not set up, the principal will be used.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"f3440b3c-9907-4593-b942-e1451ab05532"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.role.claim","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which SAML Response attribute must be read to find the role to assign to the user during a successful login.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"c6868e27-a828-4a5c-888f-c983658b9d7e"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.enterprise.claims","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which SAML Response attributes must be read to find the enterprise to assign to the user during a successful login. Matches an enterprise name or an enterprise property key.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: a comma-separated list of the claim attributes, with an optional enterprise property key separated by a colon.","type":"text"},{"type":"hardBreak"},{"text":"Pattern: ","type":"text"},{"text":":,:","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"e5b1b1aa-aa73-4fd9-b8aa-e506b58ae383"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.user.firstname.claim","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which attribute must be read to find the user name.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"FirstName","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"48c7560e-3452-4df9-892b-dea36a442a3a"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.user.lastname.claim","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which attribute must be read to find the user last name.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"LastName","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"5214a711-9461-4713-b66c-7efb17e291bd"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.attributes.user.email.claim","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Indicates which attribute must be read in order to find the user email.","type":"text"},{"type":"hardBreak"},{"text":"Accepts: any string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"EmailAddress","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"ac015920-d543-4a41-9ba7-85db378e472a"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.login.allow.enterprise.pool","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Allow the use of multiple enterprises with the same enterprise claim property as a pool. Will assign the user to the first enterprise match. Only valid for ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"code"}]},{"text":" mode, not for ","type":"text"},{"text":"SAML + user","type":"text","marks":[{"type":"code"}]},{"text":" (multiple IDPs).","type":"text"},{"type":"hardBreak"},{"text":"Accepts: boolean","type":"text","marks":[{"type":"em"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"No","type":"text"},{"type":"hardBreak"},{"text":"Default: ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"saml admin","localId":"7dc870e3-2eef-4994-be34-202f94064d6e"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.identityprovider.default.id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"Sets the default SAML IdP","type":"text"},{"type":"hardBreak"},{"text":"Accepts: The entityID attribute of the default IdP from its metadata","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"abiquo admin","localId":"2400ca91-8d13-4001-ac81-2d30f9131845"}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[469.0]},"content":[{"type":"paragraph","content":[{"text":"abiquo.saml.metadata.identityprovider.userdomain.map","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[578.0]},"content":[{"type":"paragraph","content":[{"text":"For multiple IdPs, map the user domains to the IdPs","type":"text"},{"type":"hardBreak"},{"text":"Accepts: Comma separated list of email address domains and IdPs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[294.0]},"content":[{"type":"paragraph","content":[{"text":"Yes, for multiple IdPs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[308.0]},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"abiquo admin","localId":"40881a58-1b36-4d70-afd0-4003b56905ad"}}]}]}]}]},{"type":"paragraph"},{"type":"rule"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Table of UI properties for SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"For SAML, you can configure the following UI configuration properties in ","type":"text"},{"text":"client-config-custom.json","type":"text","marks":[{"type":"code"}]},{"text":". See ","type":"text"},{"text":"Configure Abiquo UI","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/ABI61/pages/652336510"}}]},{"text":" for more details. ","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"060a3498-fec6-4339-943c-b5f9c63ad724"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[663.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"client.login.modules","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[663.0]},"content":[{"type":"paragraph","content":[{"text":"Configure Abiquo modules to log in with ","type":"text"},{"text":"Basic Auth (default),","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"Open ID","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"code"}]},{"text":", or ","type":"text"},{"text":"SAML + user","type":"text","marks":[{"type":"code"}]},{"text":". ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the initial SAML configuration, use ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"When you add multiple IdPs, use ","type":"text"},{"text":"SAML + user","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"You can copy the options from ","type":"text"},{"text":"client-config-default.json","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"client.skip.login.view","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[663.0]},"content":[{"type":"paragraph","content":[{"text":"By default, when in ","type":"text"},{"text":"OpenID","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"code"}]},{"text":" mode, Abiquo displays an initial screen with a link to the Authentication portal. ","type":"text"},{"type":"hardBreak"},{"text":"If this property is set to ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text","marks":[{"type":"strong"}]},{"text":"then Abiquo will not display the initial screen and will redirect users directly to the Authentication portal.","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported