Page Comparison

...

Steps to create JKS file and self-signed certificate.

• Create a folder under the INSIGHTS_APP_ROOT folder with the name saml_certificates.

• Run the following commands to create a new JKS inside that folder:

keytool -genkey -keyalg RSA -alias <YOUR_DOMAIN>.com -keystore "insights_app_sso.jks" -storepass <PASSWORD> -ext san=dns:<YOUR_DOMAIN>.com -validity 1000 -keysize 2048

-storetype JKS

keytool -list -v -keystore "insights_app_sso.jks"

keytool -certreq -alias <YOUR_DOMAIN>.com -keystore insights_app_sso.jks -storepass <PASSWORD> -file CertCA.crt

...

Steps to Import SAML provider (Azure AD ) certs cert to JKS keystore.

• Here Insights_SAML_SSO.cer is provider cert and

...

• downloaded from Azure AD portal.

• Place the provider cert inside the saml_certificates folder.

• Run the following commands to import the provider cert into the keyStore and generate the privateKey:

keytool -importcert -file Insights_SAML_SSO.cer -keystore insights_app_sso.jks -alias insights_app_sso_28Apr_imported

keytool -importkeystore -srckeystore insights_app_sso.jks -destkeystore insights_app_sso.p12 -deststoretype PKCS12

openssl pkcs12 -in insights_app_sso.p12 -nokeys -out insights_app_sso.crt

openssl pkcs12 -in insights_app_sso.p12 -nocerts -nodes -out insights_app_sso.key

openssl pkcs8 -topk8 -in insights_app_sso.key -out insights_private.key -nocrypt

#insights

• insights_private.key

...

• will

...

• be

...

• the

...

• privateKey used

...

• for

...

• SSO

...

• configuration

• Specify the path of the keyStore and privateKey generated inside this saml_certificates folder in the singleSignOnConfig section of the server-config.json file.
  

Enable SSO

1. In server-config.json, change "autheticationProtocol": “SAML”.

2. In uiConfig.json, change "autheticationProtocol": “SAML”.

3. In the configDesc.json update “SAML” property with the following value:
   

   Code Block
   "SAML": { "loginURL": "/PlatformService/saml2/authenticate/insights_saml2_sso", "logoutURL": "/PlatformService/saml/logout" },

4. Open Grafana defaults.ini file and enable following [auth.proxy] section, do not change other property
   

   Code Block
   [auth.proxy] enabled = true header_name = X-WEBAUTH-USER header_property = username auto_sign_up = true sync_ttl = 60 whitelist = headers = headers_encoded = true enable_login_token = false

5. Add following in Apache Httpd vhost file Apache24\conf\extra\httpd-vhosts.conf.
   

   Code Block
   SetEnvIf Cookie "(^|;\ *)username=([^;\ ]+)" MyCookieValue=$2 <If "%{env:MyCookieValue} != ''"> RequestHeader set X-WEBAUTH-USER "%{MyCookieValue}e" </If>

6. Restart Apache httpd server and Grafana.

7. Add your SAML or SSO provider detail in server.config.json under “singleSignOnConfig” section.

8. We can configure either metadataUrl or the metadataFilePath.

9. Add “insights_saml2_sso” as value for the “registrationId” property.

10. Add application host name in insightsServiceURL in server-config.json.

11. Add host information in  trustedHosts in server-config.json.

12. Restart PlatformService and UI.

13. Call URL https://<HostOrDomainName>/insights.

14.   Login with your organization credential.

...