SAML authentication backend

Since LemonLDAP::NG 1.0

Presentation

LemonLDAP::NG can used SAML2 authentication to get user identity and grab some attributes defined in user profile on its Identity Provider (IDP). In this case, LemonLDAP::NG acts like an SAML2 Service Provider (SP).

Several IDPs are allowed, in this case the user will choose the IDP he wants. You can preselect IDP with an IDP resolution rule.

For each IDP, you can configure attributes that are asked. Some can be mandatory, so if they are not givn by IDP, the session will not open.

Technical requirements

Lasso

SAML2 implementation is based on Lasso. You will need a very recent version of Lasso (>= 2.2.91).

For lucky Debian users, there are packages available here: http://deb.entrouvert.org/.

You will only need to install liblasso3-perl package:
$ sudo apt-get install liblasso3-perl

Apache rewrite rules



Be sure that mod_rewrite is installed and that SAML2 rewrite rules are activated in etc/portal-apache2.conf:
<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteRule ^/saml/metadata /metadata.pl
        RewriteRule ^/saml/.* /index.pl
</IfModule>

SAML2 IDP

Of course you need an SAML2 IDP. If you don't have one, you can check:

Public/private key

Since SAML2 use a lot a signature and encoding, you need to generate a public/private key pair.

You can do this with openssl:
$ openssl genrsa -out private_key.pem 1024
$ openssl rsa -pubout -in private_key.pem -out public_key.pem

LemonLDAP::NG configuration

All configuration can be done with LemonLDAP::NG Manager. Connect to it first (by default http://manager.example.com).

Authentication and UserDB

In General Parameters > Authentication, set: As passwords will not be managed by LL::NG, you can also go in General Parameters > Portal :

SAML2 Service

This is where you configure SAML2 settings for LemonLDAP::NG service. These settings will be used to build metadata that will be shared with identity providers.
Node SAML 2 Service
Node Organization
Node Service Provider
Node SingleLogout

For each binding you can set:
Node Assertion Consumer

For each binding you can set:
Node NameID Format

For each NameID Format, you can activate and deactivate it in metadata. The first will be chosen by default if no NameID Format is set in authentication request.
Node Identity Provider

Not used here.

Identity Provider registration

Now you have to register partner IDP. For that, select node Identity Providers and click on New metadatas.

The IDP name is asked, enter it and click OK.
Metadata XML

You must register IDP metadata here. You can do it either by uploading the file, or with IDP metadata URL.
Node Exported attributes

For each attribute, you can set:
Node Options

Partner IDP configuration

You have to give LemonLDAP::NG metadata to your partner. After previous steps, metadata can be viewed at Entity Identifier URL (by default http://auth.example.com/saml/metadata/)