Configure Cora SeQuence for SAML 2.0 Authentication

Overview

SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, named an Identity Provider, and a SAML consumer, named a Service Provider. SAML 2.0 enables web-based, cross-domain single sign-on (SSO), which helps reduce the administrative overhead of distributing multiple authentication tokens to the user.

When you use SAML authentication, Cora SeQuence supports single identity provider and service provider initiated sign in and sign out only.

Prerequisites

• Name of identity provider
• Name of service provider
• SingleSignOnServiceUrl
• SingleSignOutServiceUrl
• Binding (POST or Redirect)
• Copy of the idp signing and encryption public certificate
• Claim type that uniquely identifies users (for claims configuration)
• Is the identity provider response signed?
• is the identity provider assertion signed?
• Does the service provider sign the request?
• Publicly signed certificate (if necessary)

For Bindings:

• You can send Authentication Requests using HTTP-REDIRECT or HTTP-POST.
• Consumer Assertion Service endpoint only supports HTTP-POST binding.
• HTTP-Artifact is not supported.

Identity provider and Token-related configuration

• To configure the identity provider for the SAML integration, you can share with the IT team an SAML metadata file from Cora SeQuence. To get the metadata file, browse to  https://[siteurl]/authservices in the Cora SeQuence environment and save the result.
• Configure the Consumer Assertion Service endpoint by appending to it with a question mark (?)
  binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST (i.e. https://administration.pnmsoft.com/authservices/acs?binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST )
• The token <subject> element must contain a <NameID> element.

IIS configuration

• Enable only Anonymous Authentication for the Administration site and Flowtime site.
• Enable claims-based authentication in the web.config file.

Add Configuration Sections to the web.config File

Add the following section under the <configuration><configSections> elements.

<configSections>
... 
 <sectionGroup name="sequence.engine" type="PNMsoft.Sequence.Configuration.WorkflowEngineConfigurationSectionGroup, PNMsoft.Sequence, Version=8.0.0.0, Culture=neutral, PublicKeyToken=0a1a1b90c1c5dca1">
 ... 
 <sectionGroup name="identity" type="PNMsoft.Sequence.Configuration.IdentityConfiguration,PNMsoft.Sequence.IdentityModel.v8, Version=8.0.0.0, Culture=neutral, PublicKeyToken=0a1a1b90c1c5dca1">
   <section name="saml" type="PNMsoft.Sequence.IdentityModel.Configuration.SamlConfigurationSection, PNMsoft.Sequence.IdentityModel.Saml2, Version=8.0.0.0, Culture=neutral, PublicKeyToken=0a1a1b90c1c5dca1"/>
 </sectionGroup>
 ... 
 </sectionGroup>
... 
 <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
 <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
...
</configSections>

Add HttpModules to the web.config file

Add the following section under the <system.webServer> <modules> elements. Make sure these modules are list in the list.

<system.webServer>
... 
  <modules>
    <!-- Other modules already configured in web.config should be here -->
    <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
    <add name="SamlAuthenticationModule" type="PNMsoft.Sequence.IdentityModel.Services.SamlAuthenticationModule, PNMsoft.Sequence.IdentityModel.Saml2, Version=8.0.0.0, Culture=neutral, PublicKeyToken=0a1a1b90c1c5dca1" preCondition="managedHandler" />
  </modules>
...
</system.webServer>

Add SAML 2.0 configurations to the web.config file

Add the following section under the <configuration><sequence.engine> elements.

<identity>
     <saml>
       <serviceProvider name="https://mydomain.com/myapplication"
             description="Sequence Service Provider"
             assertionConsumerServiceUrl="/AuthServices/acs"/>
       <partnerIdentityProviders>
         <add name="https://sts.windows.net/1eb2d3db-45bd-67a8-91a2-3456ab78be9f/"
             description="Azure"
             singleSignOnServiceUrl="https://login.microsoftonline.com/1eb2d3db-45bd-67a8-91a2-3456ab78be9f/saml2"
             singleLogoutServiceUrl="https://login.microsoftonline.com/1eb2d3db-45bd-67a8-91a2-3456ab78be9f/saml2"
             singleSignOnServiceBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
       </partnerIdentityProviders>
     </saml>
</identity>

SAML Configuration Attributes

serviceProvider Configuration Attributes

partnerIdentityProviders Configuration Attributes

Supported Bindings

• urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
• urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

Secondary and Tertiary Certificates

For Partner Identity Providers, you can use secondary and tertiary certificates.

For example:

• SecondaryLocalCertificateFile
• TertiaryLocalCertificateFile

Configure IdentityModel Audience

In the web.config file, add the following section under <configuration>.

<system.identityModel>
  <identityConfiguration>
    <audienceUris>
      <add value="https://mydomain.com/application" />
    </audienceUris>
  </identityConfiguration>
</system.identityModel>

Configure the Cora SeQuence Authentication Provider

Add claims authentication under the <configuration> <sequence.engine> <authentication> sections.

<claims enabled="true" signoutFromSts="false" loginUrl="~/AuthServices/signin" logoutUrl="~/AuthServices/logout" accessDeniedUrl="~/AccessDenied.aspx">
  <IdentityClaims>
    <add claimType="<claim type>" originalIssuer="<token issuer>" authenticationType="<sequence authentication type" />
  </IdentityClaims>
</claims>