Skip to main content

Authentication

Definition

Soffid could use different kinds of external authentication sources. These mechanisms could be selectively enabled or disabled.

Screen overview

image-1640001073061.png

Standard attributes

Username and password

Internal

  • Enabled: the only enabled by default in the installation of Soffid, it is the internal username and password authentication mechanism. Therefore, the authentication is made with the username and password of the soffid account.

External

  • Forward authentication requests to trusted target systems: is to use external username and password sources. Therefore, the authentication is made with the username and password of an account of an external system.

Not all the external systems are included, only the ones they have marked the check "Trust password" on the agent. For more information about agents please visit the Agents page.

Once an agent is configured, Soffid will still use its internal tables to authenticate usernames and passwords.

If the password entered by the user does not match, the Soffid core will issue a "ValidatePassword" task for each trusted target system. If any of the trusted target systems accepts the password, it will be hashed and stored in Soffid tables and login will be accepted.

External SAML identity provider 

It should be noted this feature does not depend on the federation addon. That is a feature included by default in the Soffid smart engine to allow you to include in the authentication flow a mechanism to use third party SAML system.

  • Enable: check it (select value Yes) to use an external SAML Identity Provider.
  • Soffid Server host name: the URL that will be used by external IdP. This URL will be resolved by end user's browser in order to send the SAML assertion.
  • SAML federation metadata: the URL where federation information can be found. If the Soffid console can fetch federation metadata, the Identity provider drop-down will be filled in with any identity provider found in federation metadata URL.
  • Cache limit (seconds): how often the federation information will be refreshed. By default, 10 minutes will be taken.
  • Identity provider: Identity Provider to use for authentication.

Finally, download the Soffid Console and load it into your SAML Identity Provider federation.

If SAML Identity Provider is enabled, as well as username and password, the user will have the chance to select the preferred authentication method. Otherwise, if only SAML is enabled, the user will be automatically redirected to SAML Identity Provider

Enable LinOTP integration

Soffid could be configured to request the user to authenticate using a second factor authentication to perform certain actions.

YouSoffid allows you to user LinOTP, that you can visitconfigure Twoas factorfollow, authenticationor (2FA)use chapter.the Soffid OTP.

  • Enabled: check it (select value Yes) to use an external SAML Identity Provider.
  • LinOTP server URL:  URL of your LINOTP service.
  • LinOTP admin username: username of the admin account used by Soffid.
  • LinOTP admin password: password of the admin account used by Soffid.
  • LinOTP users domain: the user's domain for LinOTP authentication. The selected user domain will guess the LinOTP username for any Soffid identity. It is extremely important when LinOTP users do not match Soffid usernames. Please visit the Account naming rules page for more information

If you want to configure the Soffid OTP you could  visit Two factor authentication (2FA) chapter.

Second Factor Authentication configuration

This section requires to have the LinOTP integration enabled (previous section)

  • Pages that optionally require OTP authentication for users with an enabled token: (Optional) you should include the list of pages to include the two factors only to the users with the token. Therefore, if a URL optionally requires OTP authentication, and the user does not have any LinOTP token (or LinOTP service is down), the access will be granted. Otherwise, if the user has a LinOTP token, the OTP value will be required, and no access will be allowed until the user provides the right token value.
  • Pages that require OTP authentication to any user: (Mandatory) you should include the list of pages to always include the second factor to the users with the token. Therefore, if a URL extrictly requires OTP authentication, users with no token won't be allowed to use them.
  • Second factor authentication period: number of seconds after that, a new OTP value will be required.

In both configurations, if OTP is required by the user, a popup requesting the token value is raised to write the OTP value.

Actions

Download metada

Allows you to download a XML file with metadata to load it into your SAML Identity Provider federation when you use External SAML identity provider
Confirm changes Allows you to save the changes made in the Authentication setup.

 

Back to top