Configuration > Web SSO (addon federation)

Configuration > Web SSO (addon federation)

Attribute definition (addon federation)

Description

The attribute definition page displays all the auto-generated user attributes. Those attributes will be the attributes to deliver from the identity providers to the service providers depending on the defined rules.

Soffid has a default implementation for common attributes like FullName or uid, but you can modify it by creating a custom script.

Please note that this screen is available in the federation addon.

Screen overview

image.png

Standard attributes

Actions

Table actions

Download CSV file Allows you to download a csv file with the data included in the table.

Import

Allows you to upload a CSV file with the attribute list to add or update them.

First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the content to be loaded, it is allowed to choose if you want or not to load a specific attribute. And finally, you need to select the mappings for each column of the CSV file to import the data correctly and to click the Import button.

Add new

Allows you to add a new attribute. To add a new attribute it will be mandatory to fill in the required fields.

Delete attribute

Allows you to delete one or more attributes by selecting one or more records and next clicking this button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

Detail actions

Apply changes (disk button)

Allows you to save the data of a new attribute or to update the data of a specific attribute. To save the data it will be mandatory to fill in the required fields.

Delete parameter

Allows you to delete a specific Soffid parameter. To delete a parameter you can click on the "three points" icon and then click the delete parameter button.

Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes.

Apply changes

Allows you to save the data of a new attribute or to update the data of a specific attribute. Once you apply changes, the plugin details page will be closed.

Examples

Scripts

Soffid IdP has a default implementation for common attributes like FullName or uid, but you can modify it by creating a custom script. You can use the custom script to define the value of an attribute.

Examples to define the value of an attribute.

Example 1

Return full name in upper case:

return fullName.toUpperCase();

Example 2

Send one value if an attribute is blank. Otherwise, its value:

return
    attributes{"company"} == null ||
    attributes{"company"}.isEmpty() ?
        "Soffid" :
        attributes{"company"}

Example 3

Use serverService to fech the OU attribute of the account owned by the user in the Active Directory (AD) system:

for (account: serverService.getUserAccounts(id, "ad")) {
    return account{"attributes"}{"ou"};
}
return null;

Example 4

Return the secondary groups of the user.

var groups = serviceLocator.getGroupService().findUsersGroupByUserName(userName);
var list = "";
for (var i=0; i<groups.size(); i++) {
  group = groups.get(i);
  if (list.length()>1)
    list = list+",";
  list = list+group.group;
}
return list;

Example 5

Retrive custom attributes of a holdergroup

if (holderGroup!=null) {
  ug = serviceLocator.getGroupService().findUserGroupByUserNameAndGroupName(userName, holderGroup);
  if (ug!=null && ug.attributes!=null && ug.attributes{"customAttribute"}!=null)
    return ug.attributes{"customAttribute"};
}
return null;

 

 

Attribute sharing policies (addon federation)

Description

Soffid allows you to define security rules as policies that apply to any attribute that should be delivered from identity providers to service providers.

Please note that at least one policy must be created to return attributes to service providers. If there is no policy, or none is met, no attributes will be sent.

When logging in with a service provider, all policies are validated and more than one may be applied. In this case, the sum of all attributes contained in those policies will be returned.

Please note that this screen is available in the federation addon.

Screen overview

image.png

image.png

Standard attributes

Table attributes

Policy attributes

Condition attributes

It is a boolean expression to be evaluated. The condition will be evaluatuated when the Allow value was yes. You can use the conditions to configure the conditions policy and to configure the shared attributes.

Type: the boolean operator are the follow:

Actions

Table actions

Add new

Allows you to add a new policy in the system. To add a new it is necessary to fill in the required fields.
Delete policy

Allows you to remove one or more policies by selecting one or more records and next clicking this button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

Policy actions

Delete policy Allows you to save the data of a new Attribute sharing policy or to update the data of a specific Attribute sharing policy. To save the data it will be mandatory to fill in the required fields.
Add new Allows you to add a new shared attribute in the policy. To add a new it is necessary to fill in the required fields.
Delete attribute Allows you to remove one or more shared attribute by selecting one or more records and next clicking this button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
Undo Allows you to quit without applying any changes made.
Apply changes Allows you to save the data of a new Metada object or to update the data of a specific Metadata object. To save the data it will be mandatory to fill in the required fields.

Attributes actions

Close Allows you to close the popup window. Please note that the changes have not been saved, you must click Apply changes button.

Examples

Examples for defining conditions in an attribute sharing policy.

Example 1

Return a list of attributes for any trusted service provider.

image.png

Example 2

Rule that applies to all the service providers belonging to the "SOFFID" entity group.

image.png

Example 3

Rule that only applies to the service provider ‘TestSP’.

image.png


Identity providers (addon federation)

Description

This screen allows you to define the most important components of a federation, which are none other than the identity providers. An identity provider is responsible for performing the appropriate authentication for each service provider and user type according to their accounts, permissions, authorisations, and attributes.

The main supported standard is SAML. SAML allows to completely detach the identification process from web applications,  known as Service Providers. With SAML, identification is performed by specialized servers known as Identity Providers.  Additionaly, some other, less secure, but some times convenient protocols like OAuth (Open Authorization) and OpenID-Connect protocols are supported. Elder protocols like Openid (do not confuse with OpenID-Connect) are deprecated and no  longer supported.

Remember that after validating the user's login, the identity provider will send a set of attributes to the service provider that will have been previously defined in Soffid in the attribute definition page and shared attribute policy screens.

You can visit the Introduction page to find more information about the federation.

Please note that this screen is available in the federation addon.

Entity group

An entity group is just like a folder that allows you to manage different kinds of federation members. One of the most common ways to group federation members is by trust level.

When you create an entity group, identity provider records will be displayed.

Entity groups can be created on this screen or on the service provider screen, and they will be displayed on both screens.

Identity provider

An identity provider (abbreviated IdP or IDP) is a system entity that creates, maintains, and manages identity information for principals and also provides authentication services to relying applications within a federation or distributed network.

An Identity Provider is responsible for identifying users. Also, it is responsible for giving service providers information regarding the identified user.

Soffid allows you to configure different identity providers, you can choose the best option for you by selecting the IdP type:

To create an identity provider, it is advisable to install a dedicated sync server. It can be configured as a proxy sync server as it does not need direct access to the Soffid database. Instead, it will connect to the main sync server to get users and federation information.

For more information about how to configure a dedicated sync server, you can visit the Install Sync server page.

Virtual identity provider

A single identity provider usually offers different profiles or service levels to diffeferent service provider. To be able to define this behavior, any Identity Provider can be split into many virtual identity providers. Those identity providers will be served by the same actual identity provider, but they will have different profile configurations.

When creating a new virtual identity provider, you will need to specify the service providers for which you will be responsible.

Screen overview

image.png

image.png

Standard attributes

Entity group

Identity provider

Soffid IdP

Identification

It will be mandatory to create an Agent (Soffid Identity Provider) linking the idP with the identifier attribute.

Service Configuration

The Metadata is the information that any application needs to use the IdP. That is an XML file that contains the public encryption keys and the services provided

Leave it blank as Soffid IdP will fulfill it for you.

The metadata will be created when the network data and SAML Security data are specified. Restarting the sync server will be necessary to fill in the Metadata.

Network
💻 Image

image.png

Server certificate management: there are two options for certificate management. You can visit the Server certificate management page for more information.

SAML Security
Session management
Authentication
Image

image.png

Image

image.png

image.png

Advanced Authentication
Profiles

A profile is a protocol or subset of protocols implemented by the Identity Provider. There are some accepted protocols, those allows a custom config dependent on the selected profile.

You can visit the Profiles chapter for more information about each one.

Look and feel

Soffid allows you to personalize your login page by adding some style elements, as well as header and footer elements.

Restarting the syncserver will be necessary to apply the look and feel changes.

Image

image.png

image.png

External SAML IdP

Identification
Service Configuration

The Metadata is the information that any application need to use the IdP. That is an XML file that contains the public encryption keys and the services provided

Login Rules
SAML Security

OpenID-Connect

Identification
Service Configuration
{
    "authorization_endpoint": "https://server/oauth2/auth",
    "token_endpoint": "https://server/oauth2/token",
    "userinfo_endpoint": "https://server/oauth2/userinfo",
    "scopes_supported": [ "openid","email","profile"]
}

The Metadata is the information that any application need to use the IdP. That is an XML file that contains the public encryption keys and the services provided.

Login rules

 
sn = attributes{"screen_name"};
i = sn.indexOf(" ");
if (i> 0) {
	user.firstName = sn.substring(0, i);
	user.lastName = sn.substring(i+1);
} else {
	user.firstName = "?";
  	user.lastName = sn;
}
return attributes{"name"};

Facebook

Identification
Service Configuration
Login rules

Google

Identification
Service Configuration
Login rules

Linkedin

Identification
Service Configuration
Login rules

Virtual identity provider

Identification

Service configuration

Leave it blank as Soffid IdP will fulfill it for you.

SAML Security

Authentication
Image

image.png

Image

image.png

image.png

Advanced Authentication

Profiles

A profile is a protocol implemented by the Identity Provider. There are some accepted protocols, those allows a custom config dependent on the selected profile

You can visit the Profiles chapter for more information about each one.

Look and feel

Soffid allows you to personalize your login page by adding some style elements, as well as header and footer elements.

Restarting the syncserver will be necessary to apply the look and feel changes.

Image

image.png

image.png

Service Providers

It will be necessary to bind any service provider to the virtual identity provider. When no such bind exists for a service provider, the actual identity provider profile configuration applies. 

Actions

Federation tree

Add group

Allows you to create a new entity group. You can choose that option by clicking on the "Add group" button in the tree, then Soffid will display a new window with the fields to fullfil. To add a new entity group it will be mandatory to fill in the required fields and save or apply changes.

Add identity provider

Allows you to add a new identity Provider. You must click the "Add identity provider" button, under the proper entity group, then Soffid will display a new window with the data to fulfill for the new identity provider. To add a new identity provider it will be mandatory to fill in the required fields and save or apply changes.

Add virtual identity provider

Allows you to add a virtual identity provider. You must click the "Add virtual identity provider" button, under the proper identity provider, which has to be a Soffid IdP, then Soffid will display a new window with the data to fulfill for the new virtual identity provider. To add a new virtual identity provider it will be mandatory to fill in the required fields and save or apply changes.

Entity group detail

Apply changes (disk button)

Allows you to save the data of a new entity group or to update the data of a specific entity group. To save the data it will be mandatory to fill in the required fields.

Delete

Allows you to remove the entity group. You can find this option in the "three points" menu by clicking on the "Delete" button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes.

Apply changes

Allows you to save the data of a new entity group or to update the data of a specific entity group. Once you apply changes, the plugin details page will be closed.

Identity provider detail

Save

 

Allows you to save the data of a new identity provider or to update the data of a specific identity provider. To save the data it will be mandatory to fill in the required fields.

Delete identity provider

Allows you to delete the identity provider. To delete an identity provider you can click on the "three points" icon and then click the delete button. Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes made.

Apply changes

Allows you to save the data of a new identity provider or to update the data of a specific identity provider and quit. To save the data it will be mandatory to fill in the required fields.

Virtual identity provider detail

Save

Allows you to save the data of a new virtual identity provider or to update the data of a specific virtual identity provider. To save the data it will be mandatory to fill in the required fields.

Delete identity provider

Allows you to delete the virtual identity provider. To delete a virtual identity provider you can click on the "three points" icon and then click the delete button. Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes made.

Apply changes

Allows you to save the data of a new virtual identity provider or to update the data of a specific virtual identity provider and quit. To save the data it will be mandatory to fill in the required fields.

Examples

Look and feel customisation

In this example, we are going to use all styles except the header, so we can take advantage of the language change and use the manually uploaded logo.

This is the result.

image.png

This is the configuration.

image.png

CSS Style:

body {
   color: white;
   background-image: url("https://www.soffid.com/wp-content/uploads/2025/05/Depositphotos_795124038_XL-1-scaled.jpg");
}

#language a {
   text-decoration: none;
   font-weight: bold;
   color: #0B4768;
}

p.biglogo img{
   margin-top: 50px;
   width: 150px;
}

p.header {
   color: #0B4768;
   padding-bottom: 10px;
   font-size: larger;
}

.logintype {
   background-color: #F95D38;
   border: 1px solid #0B4768;
   color: white;
   font-size: large;
   padding: 20px;
}

.nologintype {
   color: #0B4768;
   font-size: large;
   padding: 20px;
}

input {
   padding: 4px 8px 4px 8px;
   border-radius: 4px;
   border-color: #0B4768;
   border-width: 1px;
   cursor: pointer;
}

input[type=submit] {
   background-color: #0B4768;
   color: white;
}

Html footer:

<p style="text-align:center;color: #F95D38;font-size: xx-large;margin-top:100px;">demo@soffid.com</p>

If you use the header, the language change options disappear and the logo is not displayed either. You can add the logo yourself using HTML/CSS.

<div style="text-align: center;margin-top: 50px;">
  <img src="https://media.licdn.com/dms/image/v2/D4D0BAQEQlaVONhPqHw/company-logo_200_200/B4DZeJJh1kH4AI-/0/1750352666329/soffid_logo?e=2147483647&v=beta&t=yCxIGdOteGHza9p2s1jLNogbO0YKpDS-bHzzHMuQwok" style="display: block; margin: 0 auto; width: 150px;">
</div>

Service Providers (addon federation)

Description

This screen allows you to define the applications that will belong to the federation. These applications are named service providers and must be configured correctly to delegate the user authentication to the identity provider that is responsible for them by configuration.

The main supported standard is SAML. SAML allows to completely detach the identification process from web applications,  known as Service Providers. With SAML, identification is performed by specialized servers known as Identity Providers.  Additionaly, some other, less secure, but some times convenient protocols like OAuth (Open Authorization) and OpenID-Connect protocols are supported. Elder protocols like Openid (do not confuse with OpenID-Connect) are deprecated and no  longer supported.

Remember that after validating the user's login, the identity provider will send a set of attributes to the service provider that will have been previously defined in Soffid in the attribute definition page and shared attribute policy screens.

You can visit the Introduction page to find more information about the federation.

Please note that this screen is available in the federation addon.

Screen overview

image.png

image.png

Standard attributes

SAML

Identification

Service configuration

To publish the federation members' metadata, the main sync server exports the member's metadata at the path /SAML/metadata.xml. Thus, if your sync server is listening at soffid1.your.domain, you can get the whole federation metadata document from:

https://soffid1.your.domain:760/SAML/metadata.xml

After some seconds, up to five minutes, every federation member will notice any change.

Login rules

You can visit the Openid-connect to SAML interoperability page for more detailed information.

SAML API client

Identification

Service configuration

Leave it blank as Soffid IdP will fulfill it for you.

The metadata will be created when the network data and SAML Security data.

Login rules

You can visit the Openid-connect to SAML interoperability page for more detailed information.

Network

SAML Security

OpenID Connect

Identification

Login rules

Image

image.png

You can visit the Openid-connect to SAML interoperability page for more detailed information.

OpenID authorization flow

OpenID Dynamic Register

Identification

Login rules

OpenID authorization flow

Registration token

Radius client

Identification

Login rules

Radius configuration

CAS client

Identification

Login rules

CAS configuration

Tacacs+

Identification

Login rules

Tacacs+ configuration

WS-Federation

Identification

Login rules

WS-Federation

Actions

Federation tree

Add group

Allows you to create a new entity group. You can choose that option by clicking on the "Add group" button in the tree, then Soffid will display a new window with the fields to fullfil. To add a new entity group it will be mandatory to fill in the required fields and save or apply changes.

Add service provider

Allows you to add a new service provider. You must click the "Add service provider" button, under the proper Entity Group and "Identity Provider" label, then Soffid will display a new window with the data to fulfill for new service Provider. To add a new service provider it will be mandatory to fill in the required fields and save or apply changes.

Entity group detail

Apply changes (disk button)

Allows you to save the data of a new entity group or to update the data of a specific entity group. To save the data it will be mandatory to fill in the required fields.

Delete

Allows you to remove the entity group. You can find this option in the "three points" menu by clicking on the "Delete" button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes.

Apply changes

Allows you to save the data of a new entity group or to update the data of a specific entity group. Once you apply changes, the plugin details page will be closed.

Service provider detail

Save

Allows you to save the data of a new service provider or to update the data of a specific service provider. To save the data it will be mandatory to fill in the required fields.

Delete service provider

Allows you to delete the service provider. To delete a service provider you can click on the "three points" icon and then click the delete button. Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.

Undo

Allows you to quit without applying any changes made.

Apply changes

Allows you to save the data of a new service provider or to update the data of a specific service provider and quit. To save the data it will be mandatory to fill in the required fields.

Shared signals & events members (addon federation)

Description

Shared signals framework is a standard that enables the communication between applications. Soffid allows you to register applications that can subscribe to this service.

For more information, please refer to our section on the Shared signals framework.

Please note that this screen is available in the federation addon.

Screen overview

image.png

image.png

Standard attributes

General attributes

Security attributes

Subject naming

Stream attributes

Actions

Table actions

Add new

Allows you to add a new shared signals framework members object in the system. To add a new one it is necessary to fill in the required fields.
Delete shared signals & events members Allows you to delete one or more shared signals framework members object by selecting one or more records and next clicking this button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

Download CSV file

Allows you to download a CSV file with the basic information of all shared signals & events members. 

View

Allows you to show and hide columns in the table.

You can also set the order in which the columns will be displayed.

Detail actions

Apply changes (disk button)

Allows you to save the data of a new shared signals framework members object or to update the data of a specific shared signals framework members object. To save the data it will be mandatory to fill in the required fields.

Delete

  
Collapse all Hide all attributes of the different blocks.
"Types of views" Change the view type: Classic view, Modern view, Compact design.

Undo

Allows you to quit without applying any changes.

Apply changes

Allows you to save the data of a new shared signals framework members object or to update the data of a specific shared signals framework members object. Once you apply changes, the plugin details page will be closed.