Abiquo 5.2.1 introduces multiple identity providers (IdPs) for the SAML integration.
When the user enters their email address to log in, Abiquo will select the IdP based on its domain name, or it will use the default IdP.
In this version, Abiquo will use the same IdP configuration for all providers, for example, it will search for the same abq-role
attribute to match an Abiquo role.
To configure an existing SAML integration with more IdPs, do these steps on the Abiquo Server:
Save the metadata for the new IdPs, as for the first IdP
For the default IdP, edit the metadata and set the Default attribute
Edit the
abiquo.properties
file to make these changes:Add the paths to the metadata of the new IdPs as a comma separated list to the abiquo.saml.metadata.identityprovider.path property
To set the default IdP, add the new abiquo.saml.metadata.identityprovider.default.id property
To map the user email domains to IdPs, set the new abiquo.saml.metadata.identityprovider.userdomain.map property with a comma separated list of keys and values. For example:
abiquo.saml.metadata.identityprovider.userdomain.map = example.com=https://sts.example.com/ffff2108-833e-4940-87e6-3d39ce9adb70/,abiquo.com=https://idp.example.com
Do not use a comma
,
in a key or a value
Do not use use an equals sign=
in the key
Share the Abiquo SP data with the new IdPs
On the UI server, edit the
client-config-custom.json
file and change the client.login.module property fromSAML
toSAML + user
.
For more details, see the examples in client-config-default.json file.
For this feature, there is a new /saml/idp
endpoint in the Abiquo API where the UI will send a GET request with the user domain. This endpoint will return a redirect to the usual /saml/login
endpoint with the appropriate IdP. Then the login will continue as for a single IdP.
When you enable this feature, Abiquo will change the XML security metadata of the Abiquo application
It will add the beans for new IdPs and mark the default IdP in the metadata configuration of
security-saml-generated-beans.xml
andsecurity-saml-provided-beans.xml
.Before the administrator upgrades Abiquo, they must back up the security beans configuration.
After an upgrade, when there is a new version of the security beans files, they must add the default IdP and the IdP beans again