Advanced Search
Search Results
63 total results found
Federation
Web SSO
Attribute definition
Description The attribute definition page displays all the auto-generated user attributes. Those attributes will be the attributes to deliver from the identity providers to the service providers depending on the defined rules. Soffid has a default implementa...
Openid-connect to SAML interoperability
Introduction OpenID-Connect has a clear design suitable for both frontend and backend. SAML has a clear design for the frontend, but the backend usage is harder as the security in SAML cannot be placed at transport layer. Instead, in must be placed at docume...
Connecting your custom applications
Introduction SAML 2.0 is a complex and not easy to implement standard. There are some libraries that can help somewhat, but a correct implementation needs a deep knowledge of SAML protocol, and is always hard to test and debug. To make it easier, Soffid prov...
Connecting Soffid console
Introduction Soffid console has a built-in SAML client, so it can act as a service provider in Soffid federation. It is interesting to use this configuration, as it allows you to enforce the use of two factors authentication to log into the Soffid console. R...
Connecting a SAML service
Introduction To connect a SAML service provider, the service provider must offer you its SAML metadata. The SAML metadata contains information about its public id, the services that implements and the service endpoints. Register a SAML service provider 1. O...
Connecting an OpenID Connect service
Introduction There are three basic OpenID flows, depending whether the service name must be authenticated using its client secret or not: OpenID flow Implicit flow The Service Provider sends the user to the IdP. The IdP authenticates the user. The ...
How to enable Kerberos authentication
Step-by-step To enable the kerberos authentication method, the identity provider must have a keytab file that enables it to authenticate users. The steps to get it are described below: 1. First of all, you need to create a net user. You can use the old-fashi...
Change Password URL
There is a service point to allow users change their passwords. Simply redirect the user to: https://servername:port/protected/changePassword The user will be required to enter identify itself and enter a new password. Optionally, you can enter a web page ...
How to deploy the identity & service provider
Step-by-step 1. To deploy the identity provider is advisable to install a dedicated sync server. It can be configured as a proxy sync server as it does not need direct access to Soffid database. Instead, it will connect to main sync servers to get users and f...
Condition for Adaptive authentication
Introduction When the authentication is being defined, Soffid allows you to add some adaptive authentications in addition to the Authentication methods. Those adaptive authentications will be evaluated, and when the result of the condition will be true, the r...
SAML1ArtifactResolutionProfile
Definition Based on SAML version 1 standard. This profile is used when the Service Provider wants to resolve or check a received assertion. Screen overview Standard attributes Class: class name (readOnly field). Enabled: if it is checked (selected opt...
OpenIDProfile
Definition The Identity Provider will serve the OpenID-Connect protocol. It is possible to accept the default endpoints or modify them. You can check the server features visiting https://<YOUR-IdP>/.well-known/openid-configuration. That JSON gives you inform...
Identity & Service providers
Description Soffid Identity Federation addon helps administrators to manage an Identity Federation. With Soffid you can manage the whole federation security configuration, increasing the security while reducing the federation management costs. Soffid can also...
Attribute sharing policies
Description After defining the attributes to publish, it’s required to write a policy that defines which attributes will be allowed to share with each service provider. Soffid allows you to define security rules that apply to any attribute that should be del...
⏰ Getting started
Introduction To configure the Web SSO you must complete the next steps 1. Attribute definition: add the necessary attributes if they are not in the list. 2. Attribute sharing policies: define the proper attribute sharing policies to determine which attrib...
SAML
OpenID-Connect
Introduction OpenID is an open standard and decentralized authentication protocol. It allows users to be authenticated by cooperating sites (known as relying parties, or RP) using a third-party service, eliminating the need for webmasters to provide their ...
SAML (Security Assertion Markup Language)
Introduction Security Assertion Markup Language is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. It is an identity federation protocol, born in 2...
Virtual Identity Provider
Definition A single identity provider usually offers different profiles or service levels to diffeferent service provider. To be able to define this behavior, any Identity Provider can be split into many virtual identity providers. Those identity providers wi...
Entity Group
Description An entity group is just like a folder that allows you to manage different kinds of federation members. One of the most common ways to group federation members is by trust level. When you create an entity group, the Identity Providers and the Serv...
CAS
How to deploy the identity & service provider
Identity Broker
Web services reference
Connecting Service Providers
Profiles
Federation members
Web SSO
OpenID-Connect
validate-domain
Definition This operation allows to validate the user domain and return the IDP ower of the user. URL <console-domain>/webservice/federation/rest/validate-domain Method POST Headers Accept = “application/json” Content-Type = “application/...