SAML SSO Configuration

SAML SSO Integration with Insights – Microsoft Azure AD

Introduction

Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications. The service authenticates the end user for all the applications the user has rights to and eliminates further prompts when the user switches applications during the same session. On the back end, SSO is helpful for logging user activities as well as monitoring user accounts.

Prerequisite

• Server should implement https protocol with Apache Httpd.

• The SSO integration implemented using the SAML protocol.

• Client should have relevant SSO IDP details and configure SSO in SSO provider portal.

• We need SSO provider jks file to import it in our file and a Private Key.

Set up Microsoft Azure Portal

Create Saml Enteriprise Account

https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso

Refer the below link to setup Microsoft AD using Azure Portal for SAML authentication:

 https://dummybot.medium.com/saml-integration-with-spring-boot-spring-security-microsoft-azure-ad-b9610bdb78b9

Steps to create JKS file and self-signed certificate.

keytool -genkey -keyalg RSA -alias <YOUR_DOMAIN>.com -keystore "insights_app_sso.jks" -storepass <PASSWORD> -ext san=dns:<YOUR_DOMAIN>.com -validity 1000 -keysize 2048

-storetype JKS

keytool -list -v -keystore "insights_app_sso.jks"

keytool -certreq -alias <YOUR_DOMAIN>.com -keystore insights_app_sso.jks -storepass <PASSWORD> -file CertCA.crt

Steps to Import SAML provider (Azure AD ) certs to JKS keystore. Insights_SAML_SSO.cer is provider cert and download from Azure AD portal

keytool -importcert -file Insights_SAML_SSO.cer -keystore insights_app_sso.jks -alias insights_app_sso_28Apr_imported

keytool -importkeystore -srckeystore insights_app_sso.jks -destkeystore insights_app_sso.p12 -deststoretype PKCS12

openssl pkcs12 -in insights_app_sso.p12 -nokeys -out insights_app_sso.crt

openssl pkcs12 -in insights_app_sso.p12 -nocerts -nodes -out insights_app_sso.key

openssl pkcs8 -topk8 -in insights_app_sso.key -out insights_private.key -nocrypt

#insights_private.key will be the private key used for SSO configuration

Enable SSO

1. In server-config.json, change "autheticationProtocol": “SAML”.

2. In uiConfig.json, change "autheticationProtocol": “SAML”.

3. In the configDesc.json update “SAML” property with the following value:
   

   "SAML": {
   		"loginURL": "/PlatformService/saml2/authenticate/insights_saml2_sso",
           "logoutURL": "/PlatformService/saml/logout"
   },

4. Open Grafana defaults.ini file and enable following [auth.proxy] section, do not change other property
   

   [auth.proxy]
   enabled = true
   header_name = X-WEBAUTH-USER
   header_property = username
   auto_sign_up = true
   sync_ttl = 60
   whitelist =
   headers =
   headers_encoded = true
   enable_login_token = false

5. Add following in Apache Httpd vhost file Apache24\conf\extra\httpd-vhosts.conf.
   

   SetEnvIf Cookie "(^|;\ *)username=([^;\ ]+)" MyCookieValue=$2
   <If "%{env:MyCookieValue} != ''">
   	  RequestHeader set X-WEBAUTH-USER "%{MyCookieValue}e"
   </If>

6. Restart Apache httpd server and Grafana.

7. Add your SAML or SSO provider detail in server.config.json under “singleSignOnConfig” section.

8. We can configure either metadataUrl or the metadataFilePath.

9. Add “insights_saml2_sso” as value for the “registrationId” property.

10. Add application host name in insightsServiceURL in server-config.json.

11. Add host information in  trustedHosts in server-config.json.

12. Restart PlatformService and UI.

13. Call URL https://<HostOrDomainName>/insights.

14.   Login with your organization credential.

Sample Configuration:

Definitions:

Disable SSO

1. Mark "autheticationProtocol":"NativeGrafana" in server-config.json

2. Mark "autheticationProtocol":"NativeGrafana" in uiConfig.json

3. Open grafana defaults.ini file and disable in [auth.proxy] section and make sure that [auth.basic] enabled 

4. Remove following in Apache Httpd vhost file Apache24\conf\extra\httpd-vhosts.conf.

   SetEnvIf Cookie "(^|;\ *)username=([^;\ ]+)" MyCookieValue=$2
   <If "%{env:MyCookieValue} != ''">
         RequestHeader set X-WEBAUTH-USER "%{MyCookieValue}e"
   </If>

5. Restart Apache httpd server and Grafana

6. Restart PlatformService and UI.