Page Comparison

SAML SSO Integration with Insights – Microsoft Azure AD

Introduction

Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications. The service authenticates the end user for all the applications the user has rights to and eliminates further prompts when the user switches applications during the same session. On the back end, SSO is helpful for logging user activities as well as monitoring user accounts.

Prerequisite

• Server should implement https protocol with Apache Httpd.

• The SSO integration implemented using the SAML protocol.

• Client should have relevant SSO IDP details and configure SSO in SSO provider portal.

• We might also need SSO provider jks file to import it in our file and a Private Key.

Set up Microsoft Azure Portal

Create Saml Enteriprise Account

https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso

Refer the below link to setup Microsoft AD using Azure Portal for SAML authentication:

 https://dummybot.medium.com/saml-integration-with-spring-boot-spring-security-microsoft-azure-ad-b9610bdb78b9

Steps to create JKS file and self-signed certificate.

• Create a folder under the INSIGHTS_APP_ROOT folder with the name saml_certificates.

• Run the following commands to create a new JKS inside that folder:

keytool -genkey -keyalg RSA -alias <YOUR_DOMAIN>.com -keystore "insights_app_sso.jks" -storepass <PASSWORD> -ext san=dns:<YOUR_DOMAIN>.com -validity 1000 -keysize 2048 -storetype JKS

keytool -list -v -keystore "insights_app_sso.jks"

keytool -certreq -alias <YOUR_DOMAIN>.com -keystore insights_app_sso.jks -storepass <PASSWORD> -file CertCA.crt

Steps to Import SAML provider (Azure AD ) cert to JKS keystore.

• Here Insights_SAML_SSO.cer is provider cert and downloaded from Azure AD portal.

• Place the provider cert inside the saml_certificates folder.

• Run the following commands to import the provider cert into the keyStore and generate the privateKey:

keytool -importcert -file Insights_SAML_SSO.cer -keystore insights_app_sso.jks -alias insights_app_sso_28Apr_imported

keytool -importkeystore -srckeystore insights_app_sso.jks -destkeystore insights_app_sso.p12 -deststoretype PKCS12

openssl pkcs12 -in insights_app_sso.p12 -nokeys -out insights_app_sso.crt

openssl pkcs12 -in insights_app_sso.p12 -nocerts -nodes -out insights_app_sso.key

openssl pkcs8 -topk8 -in insights_app_sso.key -out insights_private.key -nocrypt

• insights_private.key will be the privateKey used for SSO configuration

• Specify the path of the keyStore and privateKey generated inside this saml_certificates folder in the singleSignOnConfig section of the server-config.json file.
  

Enable SSO

1. In server-config.json, change "autheticationProtocol":

...

1. “SAML”.

2. In uiConfig.json, change "autheticationProtocol": “SAML”.

3. In the configDesc.json update “SAML” property with the following value:
   

   Code Block
   "

...

1. SAML": { "loginURL": "/PlatformService/saml2/authenticate/insights_saml2_sso", "logoutURL": "/PlatformService/saml/logout" },

2. Open Grafana defaults.ini file and enable following [auth.proxy] section, do not change other property
   

   Code Block
   [auth.proxy]

...

1. enabled = true

...

1. header_name = X-WEBAUTH-USER

...

1. header_property = username

...

1. auto_sign_up = true

...

1. sync_ttl = 60

...

1. whitelist = headers =

...

1. headers_encoded =

...

1. true enable_login_token = false

2. Add following in Apache Httpd vhost file Apache24\conf\extra\httpd-vhosts.conf.
   

   Code Block
   SetEnvIf Cookie "(^|;\ *)username=([^;\ ]+)" MyCookieValue=$2

...

1. <If "%{env:MyCookieValue} != ''">

...

1. RequestHeader set X-WEBAUTH-USER "%{MyCookieValue}e"

...

1. </If>

...

1. Restart Apache httpd server and Grafana.

...

1. Add your SAML or SSO provider detail in server.config.json under “singleSignOnConfig” section

...

1. .

2. We can configure either metadataUrl or the metadataFilePath.

3. Add “insights_saml2_sso” as value for the “registrationId” property.

4. Add application host name in insightsServiceURL in server-config.json.

5. Add host information in  trustedHosts in server-config.json.

6. Restart PlatformService and UI.

7. Call URL https://<HostOrDomainName>/insights.

8.   Login with your organization credential.

Sample Configuration:

...

Definitions:

...

7. We need to download SAML Signing Certificate from sso provider site and import it in your application ssl   certificate file using following command

keytool -importcert -file certificate.cer -keystore keystore.jks -alias "Alias"

Where certificate.cer file received from sso provider and keystore.jks is Insights certificate file

8. Add application host name in insightsServiceURL in server-config.json

9. Add host information in  trustedHosts in server-config.json

10. Restart Apache Tomcat and

11. Call URL https://<HostOrDomainName>//app

Disable SSO

1. Mark "autheticationProtocol":"NativeGrafana" in server-config.json

2. Mark "autheticationProtocol":"NativeGrafana" in uiConfig.json

3. Open grafana defaults.ini file and disable in [auth.proxy] section and make sure that [auth.basic] enabled 

4. Remove following in Apache Httpd vhost file Apache24\conf\extra\httpd-vhosts.conf.

   Code Block
   SetEnvIf Cookie "(^|;\ *)username=([^;\ ]+)" MyCookieValue=$2

...

1. <If "%{env:MyCookieValue} != ''">

...

1. RequestHeader set X-WEBAUTH-USER "%{MyCookieValue}e"

...

1. </If>

...

1. Restart Apache httpd server and Grafana

...

1. Restart PlatformService and UI.