Skip to main content

Identity Provider

Description

An identity provider (abbreviated IdP or IDP) is a system entity that creates, maintains, and manages identity information for principals and also provides authentication services to relying applications within a federation or distributed network.

An Identity Provider is responsible for identifying users. Also, it is responsible for giving service providers information regarding the identifed use.

Soffid allows you to configure different identity providers, you could choose the best option for you by selectecting the IdP type:

  • Soffid IdP: identifies the identity provider implemented by Soffid. Soffid IdP implements both OpenID-Connect and SAML.
  • External SAML IdP: is used to identity providers not implemented by Soffid. For instance, it could be an ADFS (Active Directory Federation Services) or Shibboleth identity provider.
  • OpenID-Connect: is used for third-party identity providers, like ADFS.
  • Facebook: if you select that option, Oauth2 will be used to identify Facebook users. You will need to register Soffid as a Facebook application to use it.
  • Google: if you select that option OpenID-Connect will be used to identify Google users. You will need to register Soffid as a Google application to use it.
  • Linkedin: if you select that option, Oauth2 will be used to identify Linkedin users. You will need to register Soffid as a Linkedin application to use it.

To create an identity provider, it is advisable to install a dedicated sync server. It can be configured as a proxy sync server as it does not need direct access to the Soffid database. Instead, it will connect to main sync server to get users and federation information.

For more information about how to config a dedicated sync server you can visit the Install Sync server page.

Standard attributes

The fields for each IdP type are detailed below:

Soffid IdP

Identification
  • publicID: unique name to identify the identity provider. The name has to be the same that the Public ID of the Soffid Identity Provider agent.
  • Name: friendly user name.
  • Organization: company name of the external IdP.
  • Contact: email address of the external IdP.
Service Configuration
  • Metadata: the Metadata for an Identity Provider defines how this Identity Provider delivers its service:
    • Which security algorithms does it support.
    • The public portion of it's signing and encrypting keys.
    • The SAML protocols does it support.
    • The URL of each SAML protocol endpoint.
    • Contact information.

Leave it blank as Soffid IdP will fulfill it for you.

Restart the sync server will be necessary to fulfill the Metadata.

Network
  • Host name: public host name that will be used by users and service providers. A full qualified name should be used.
  • Standard port: TCP port number used by the identity provider. By default, TLS will be used (default 1443). 
  • Disable SSL: check it, selected value Yes, if you want to use plain TCP connections. In other case, it will be needed to comply additional fields:
    • Certificate login port: secondary TPC/IP port. It will be able to use when users can be authenticated by digital certificates. It is an optional feature (default 2443).
    • TLS PublicKey:  there are three available options
      • Leave in blank and Soffid IdP will generate a self-signed certificate.
      • Clicking on the Generates public/private key button, a new private key pair will be generated. Once the private key pair is generated, you could generate a certificate request file, also known as PKCS#10 or CSR file. The certificate authority will be able to create a certificate for you using this certificate request. Once you have created the public/private key, you could run other new functions:
        • Change public/private key: allows you to change the public/private key generated previously.
        • Delete public/private key: allows you to delete the public/private key generated previously.
        • Generate PKCS10: generates a PKCS10 file (Certification request standard).
      • Clicking on the Upload PKCS12 file button it will be able to upload a PKCS#12 file. That file must contain the private an public keys and the server certificate as well. Mind that PKCS#12 file use to be protected by a PIN.
    • TLS Certificate chain: text certificate chain created with one of the previous options.

Server certificate management: there are two options for certificate management. You can visit the Server certificate management page for more information.

SAML Security
  • PublicKey:   
    • Leave in blank and Soffid IdP will generate a self signed certificate. You must restart the sync server to fulfill the public / private key chain
    • Clicking on the Generates public / private key button, a new private key pair will be generated. Once the private key pair is generated, you could generate a certificate request file, also known as PKC#10 or CSR file. The certificate authority will be able to create a certificate for you using this certificate request. Once you have created the public/private key, you could run other new functions:
      • Change public/private key: allows you to change the public/private key generated previously.
      • Delete public/private key: allows you to delete the public/private key generated previously.
      • Generate PKCS10: generates a PKCS10 file (Certification request standard).
    • Clicking on the Upload PKCS12 file button it will be able to upload a PKCS#12 file. That file must to contain the private an public keys and the server certificate as well. Mind that PKCS#12 file use to be protected by a PIN.
  • Certificate chain: text certificate chain created with one of the previous options.

Restart the sync server will be necessary to fulfill the public/private key if you leave it in blank.

Session management
  • Session timeout (secs): time in seconds that will take the session. If the user has been authenticated, and later is requested to authenticate again, the user will be authenticated without any intervention as long as the timeout has not been elapsed.
  • oAuth Session timeout (secs): time in seconds that will take the oAuth session. The oAuth has its own life cycle, regardless the session timeout.
  • SSO Cookie name: name of the cookie that will keep the session id, you can change the name. This SSO cookie is not really needed, as the identity provider will store a session cookie to track the SSO session. This SSO cookie is needed in two circumstances:
    • When the identity provider is restarted, the session cookie is lost. This SSO Cookie allows the identity provider to restart the lost session.
    • When you have more than one identity provider instance, this cookie allows all the identity providers to handle the session as if only was one identity provider. The SSO cookie can be allocated by any identity provider, and it will be accepted by any other one.
  • SSO Cookie domain: is needed when you have more than one identity provider instance and they are using different host names. If all the identity providers are serving the same virtual host name, the SSO Cookie domain will be needed.
Authentication
  • Authentication methods: matrix to define the authentication methods that will be required to successfully authenticate the user. Each row indicates the first authentication method, and each column indicates the second factor to use.
  • Adaptive authentication: that option allows you to add additional authentication matrix which will be run when the condition defined was comply.
    • Description: rule description to identify it.
    • Condition: script to enable that rule. The result of the rule must be true or false. There are some available vars to create the condition. You can visit the Condition for Adaptive authentication page for more information and some examples. 
    • Matrix: to define the authentication methods that will be required to successfully authenticate the user. Each row indicates the first authentication method, and each column indicates the second factor to use.
  • Kerberos domain: allows you to pick up a file to configure the kerberos authentication method. For more information you can visit the How to enable Kerberos authentication page.
Advances Authentication
  • Allow user to recover password: if it is checked (selected value is Yes), and the password recovery addon is installed, the user will be allowed to execute the password recovery mechanism.
  • Allow user to self-register: if it is checked (selected value is Yes), the user will be allowed to register itself. This option sends an email to the user to verify the email address is correct, and then lets the user to enter a new password.
    • User Type: identifies the password policy that is to be applied. More information on this link User Type.
    • Primary Group: select which organization unit this user belongs to.
  • Register identities identified by external IdPs: allows Soffid IdP to automatically register a new identity when a user authenticates with a third-party IdP, and this identity does not exist yet in Soffid database. Furthermore, at the third party IdP configuration page, one can tune how this identity is going to be created.
Profiles

A profile is a protocol or subset of protocols implemented by the Identity Provider. There are some accepted protocols, those allows a custom config dependent on the selected profile.

You can visit the Profiles chapter for more information about each one.

External SAML IdP

Identification
  • publicID: unique name to identify the identity provider.
  • Name: friendly user name.
  • Organization: company name of the external IdP.
  • Contact: email address of the external IdP.
Service Configuration
  • Metadata: the Metadata for an Identity Provider defines how this Identity Provider delivers its service:
    • Which security algorithms does it support.
    • The public portion of it's signing and encrypting keys.
    • The SAML protocols does it support.
    • The URL of each SAML protocol endpoint.
    • Contact information.

Leave it blank as Soffid IdP will fulfill it for you.

&&TODO&& Qué hay que hacer para que soffid genere los metadatos? he reiniciado el sync server y no lo hace

Login Rules
  • User regular expression: regular expression to detect users of this identity provider.
  • Login hint script: script to help to login. Return the text to help.
  • Identity provisioning script: script to bind or register a new identity. Return the user name of the owner identity for the authenticated account.

OpenID-Connect

Service Configuration
  • Metadata: there are some required parameters:
    • authorization_endpoint: contains the oAuth endpoint to forward the user to get the authorization token.
    • token_endpoint: contains the oAuth endpoint to get the access token, based on the authorization token got at previous step.
    • userinfo_endpoint: if remote IdP is OpenID-connect compliant, the token endpoint should have sent an access token along a JWT OpenID token containing user claims. If this is not the case, Soffid will use this user_info endpoint to fetch user claims. This mechanism is needed for oAuth2 servers.
    • scopes_sopported: The list of scopes specified here will be used at first step, when redirecting the user to the authorization endpoint.
  
{
    "authorization_endpoint": "https://server/oauth2/auth",
    "token_endpoint": "https://server/oauth2/token",
    "userinfo_endpoint": "https://server/oauth2/userinfo",
    "scopes_supported": [ "openid","email","profile"]
}
  
  • oAuth key: is the identificator token generated by the oAuth server.
  • oAuth secret: is the secret generated by the oAuth server.
Login rules
  • User regular expression: regular expression to detect users of this identity provider.
  • Login hint script: script to help to login. Return the text to help.
  • Identity provisioning script: script to bind or register a new identity. Return the user name of the owner identity for the authenticated account.
  
sn = attributes{"screen_name"};
i = sn.indexOf(" ");
if (i> 0) {
	user.firstName = sn.substring(0, i);
	user.lastName = sn.substring(i+1);
} else {
	user.firstName = "?";
  	user.lastName = sn;
}
return attributes{"name"};
  

Facebook

Identification
  • publicID: unique name to identify the identity provider. Soffid will fulfill wint the Facebook URL.
  • Name: friendly user name.
  • Organization: company name of the external IdP.
  • Contact: email address of the external IdP.
Service Configuration
  • Click here to obtain a client id and client secret: allows you to get the oAuth key and secret.
  • oAuth key: is the identificator token generated by the oAuth server.
  • oAuth secret: is the secret generated by the oAuth server.
Login rules
  • User regular expression: regular expression to detect users of this identity provider.
  • Login hint script: script to help to login. Return the text to help.
  • Identity provisioning script: script to bind or register a new identity. Return the user name of the owner identity for the authenticated account.

Google

Identification
  • publicID: unique name to identify the identity provider. Soffid will fulfill wint the Google URL.
  • Name: friendly user name.
  • Organization: company name of the external IdP.
  • Contact: email address of the external IdP.
Service Configuration
  • Click here to obtain a client id and client secret: allows you to get the oAuth key and secret.
  • oAuth key: is the identificator token generated by the oAuth server.
  • oAuth secret: is the secret generated by the oAuth server.
Login rules
  • User regular expression: regular expression to detect users of this identity provider.
  • Login hint script: script to help to login. Return the text to help.
  • Identity provisioning script: script to bind or register a new identity. Return the user name of the owner identity for the authenticated account.

Linkedin

Identification
  • publicID: unique name to identify the identity provider. Soffid will fulfill wint the Linkedin URL.
  • Name: friendly user name.
  • Organization: company name of the external IdP.
  • Contact: email address of the external IdP.
Service Configuration
  • Click here to obtain a client id and client secret: allows you to get the oAuth key and secret.
  • oAuth key: is the identificator token generated by the oAuth server.
  • oAuth secret: is the secret generated by the oAuth server.
Login rules
  • User regular expression: regular expression to detect users of this identity provider.
  • Login hint script: script to help to login. Return the text to help.
  • Identity provisioning script: script to bind or register a new identity. Return the user name of the owner identity for the authenticated account.
Back to top