...
The Circulation Manager occupies the Service Provider (SP) role in the SAML Protocol and authenticates a patron against an Identity Provider (IdP).
Identity Providers (IdP) may use a number of services such as Shibboleth, CAS and EZ Proxy to protect resources. The following workflows describe the communications between the respective systems and the Circulation Manager (SP)
Wokflows
Anchor SAML SAML
SAML
| SAML | |
| SAML |
SAML-based authentication workflow for patrons is depicted on the picture below:
...
Both the Circulation Manager and IdP should have their metadata registered with each other. In the simplest case it can be a Shibboleth environment where SP’s metadata is added to IdP’s configuration and vice versa. However, the better solution would be to register the Circulation Manager in InCommon Federation which would allow to use of any IdPs in the federation.
Anchor SAML EZProxy SAML EZProxy
SAML with EZ Proxy
| SAML EZProxy | |
| SAML EZProxy |
The picture below shows how the workflow looks like in the case when the content is protected by a SAML authentication mechanism: either via SAML proxy or EZProxy with SAML authentication turned on.
Image II. SAML Authentication Workflow in Circulation Manager
(content provider uses a SAML proxy or EZProxy with turned on SAML authentication)
Anchor SAML with EZ Proxy CAS SAML with EZ Proxy CAS
SAML with CAS and EZ Proxy
| SAML with EZ Proxy CAS | |
| SAML with EZ Proxy CAS |
An alternate configuration may include a Authentication delegated to another application such as a CAS Server.
...
- User authenticates to the Circulation Manager. It works in exactly the same way as in the previous case: users will have to authenticate themselves against IdP either by entering credentials on the IdP’s form or using other mechanisms setup in the IdP’s settings.
- User authenticates to SAML proxy/EZProxy. This should not require users to authenticate themselves against IdP. However, they may be shown a consent screen asking them to confirm using their credentials with a different SP (either SAML proxy or EZProxy).
Configuration
You can find information about SAML Authentication Provider's configuration in SAML-based authentication for patrons requires certain configuration to be set up to work correctly. Configuration parameters are described in the table I.
Table I. Circulation Manager SP’s Configuration
...
Parameter Name
...
Mandatory
...
Description
...
Service Provider’s XML metadata
...
Yes
...
SAML metadata of the Circulation Manager\'s Service Provider in an XML format. MUST contain exactly one SPSSODescriptor tag with at least one AssertionConsumerService tag with Binding attribute set to urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST.
You can use OneLogin SAML Tools to build SP metadata
...
Service Provider’s private key
...
No
...
Private key used for encrypting and signing SAML requests
...
Identity Provider’s XML metadata
...
Yes
...
SAML metadata of Identity Providers in an XML format.
MAY contain multiple IDPSSODescriptor tags but each of them MUST contain at least one SingleSignOnService tag with Binding attribute set to urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect.
You can use OneLogin SAML Tools to build IdP metadata
...
Internal signing secret for OAuth and SAML bearer tokens
...
No
...
Secret used for signing Bearer tokens issued by SAML authentication provider and used by client applications to confirm their authentication status
Setting up a SAML authentication provider in Circulation Manager
To set up a new SAML authentication provider in Circulation Manager you need to create a new authentication provider and set its type to SAML 2.0 Web SSO. After that you need to fill in mandatory parameters described above and show on the picture below:
- Name
- Service Provider’s XML Metadata
- Identity Provider’s XML Metadata
If you want SAML assertions to be encrypted you need to set up an SP’s private key in Optional Fields group:
After you filled in all the parameters, you can link this provider to a library using Libraries group and then click on Submit to finish article.
Testing
You can find information about testing in SAML Testbed article.
...