{"type":"doc","content":[{"type":"paragraph","content":[{"text":"SAML SSO Integration with Insights – Microsoft Azure AD","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Introduction","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications. The service authenticates the end user for all the applications the user has rights to and eliminates further prompts when the user switches applications during the same session. On the back end, SSO is helpful for logging user activities as well as monitoring user accounts.","type":"text"}]},{"type":"paragraph","content":[{"text":"Prerequisite","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Server should implement https protocol with Apache Httpd.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The SSO integration implemented using the SAML protocol.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Client should have relevant SSO IDP details and configure SSO in SSO provider portal.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"We need SSO provider jks file to import it in our file and a Private Key.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Set up Microsoft Azure Portal","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Create Saml Enteriprise Account ","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso"}},{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Refer the below link to setup Microsoft AD using Azure Portal for SAML authentication:","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://dummybot.medium.com/saml-integration-with-spring-boot-spring-security-microsoft-azure-ad-b9610bdb78b9"}},{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Steps to create JKS file and self-signed certificate.","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a folder under the INSIGHTS_APP_ROOT folder with the name ","type":"text"},{"text":"saml_certificates","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the following commands to create a new JKS inside that folder:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"keytool -genkey -keyalg RSA -alias .com -keystore \"insights_app_sso.jks\" -storepass -ext san=dns:.com -validity 1000 -keysize 2048 -storetype JKS\n\nkeytool -list -v -keystore \"insights_app_sso.jks\"\n\nkeytool -certreq -alias .com -keystore insights_app_sso.jks -storepass -file CertCA.crt","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Steps to Import SAML provider (Azure AD ) cert to JKS keystore. ","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Here ","type":"text"},{"text":"Insights_SAML_SSO.cer","type":"text","marks":[{"type":"strong"}]},{"text":" is provider cert and downloaded from Azure AD portal.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Place the provider cert inside the ","type":"text"},{"text":"saml_certificates","type":"text","marks":[{"type":"strong"}]},{"text":" folder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the following commands to import the provider cert into the ","type":"text"},{"text":"keyStore ","type":"text","marks":[{"type":"strong"}]},{"text":"and generate the ","type":"text"},{"text":"privateKey","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"keytool -importcert -file Insights_SAML_SSO.cer -keystore insights_app_sso.jks -alias insights_app_sso_28Apr_imported\n\nkeytool -importkeystore -srckeystore insights_app_sso.jks -destkeystore insights_app_sso.p12 -deststoretype PKCS12\n\nopenssl pkcs12 -in insights_app_sso.p12 -nokeys -out insights_app_sso.crt\n\nopenssl pkcs12 -in insights_app_sso.p12 -nocerts -nodes -out insights_app_sso.key\n\nopenssl pkcs8 -topk8 -in insights_app_sso.key -out insights_private.key -nocrypt","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"insights_private.key","type":"text","marks":[{"type":"strong"}]},{"text":" will be the ","type":"text"},{"text":"privateKey ","type":"text","marks":[{"type":"strong"}]},{"text":"used for SSO configuration","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Specify the path of the ","type":"text"},{"text":"keyStore","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"privateKey ","type":"text","marks":[{"type":"strong"}]},{"text":"generated inside this ","type":"text"},{"text":"saml_certificates ","type":"text","marks":[{"type":"strong"}]},{"text":"folder in the singleSignOnConfig section of the server-config.json file.","type":"text"},{"type":"hardBreak"}]}]}]},{"type":"paragraph","content":[{"text":"Enable SSO","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In server-config.json, change \"autheticationProtocol\": “SAML”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In uiConfig.json, change \"autheticationProtocol\": “SAML”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the configDesc.json update “SAML” property with the following value:","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"\"SAML\": {\n\t\t\"loginURL\": \"/PlatformService/saml2/authenticate/insights_saml2_sso\",\n \"logoutURL\": \"/PlatformService/saml/logout\"\n},","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open Grafana defaults.ini file and enable following ","type":"text"},{"text":"[auth.proxy] ","type":"text","marks":[{"type":"strong"}]},{"text":"section, do not change other property","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"[auth.proxy]\nenabled = true\nheader_name = X-WEBAUTH-USER\nheader_property = username\nauto_sign_up = true\nsync_ttl = 60\nwhitelist =\nheaders =\nheaders_encoded = true\nenable_login_token = false","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add following in Apache Httpd vhost file Apache24\\conf\\extra\\httpd-vhosts.conf.","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"SetEnvIf Cookie \"(^|;\\ *)username=([^;\\ ]+)\" MyCookieValue=$2\n\n\t RequestHeader set X-WEBAUTH-USER \"%{MyCookieValue}e\"\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart Apache httpd server and Grafana.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add your SAML or SSO provider detail in server.config.json under “singleSignOnConfig” section.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"We can configure either metadataUrl or the metadataFilePath.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add “insights_saml2_sso” as value for the “registrationId” property.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add application host name in insightsServiceURL in server-config.json.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add host information in trustedHosts in server-config.json.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart PlatformService and UI.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Call URL ","type":"text"},{"text":"https:///insights","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" Login with your organization credential.","type":"text"}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Sample Configuration:","type":"text","marks":[{"type":"strong"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":100.0},"content":[{"type":"media","attrs":{"width":468,"id":"2161ec4b-27ce-49f1-8621-3d39f69c34ae","collection":"contentId-821788673","type":"file","height":221}}]},{"type":"paragraph","content":[{"text":"Definitions:","type":"text","marks":[{"type":"strong"}]}]},{"type":"table","attrs":{"layout":"default","isNumberColumnEnabled":true,"width":760.0,"localId":"1410e959-e086-404e-aed6-c10aa39c9206"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"Key","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"entityId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Identifier (Entity ID) for your SMAL configuration","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"appId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"copy app id from App Federation Metadata Url","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"metadataUrl","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"App Federation Metadata Url","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"metdataFilePath","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Download SAML Signing Certificate from sso provider site and store it in INSIGHTS_HOME","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"keyStoreFilePath","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"path of certificae like saml-keystore.jks, Download this certificate from your sso provider URL","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"keyAlia","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"saml-keystore.jks username","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"keyPass","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"saml-keystore.jks password","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"keyStorePass","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"saml-keystore.jks password","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"appBaseUrl","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Application service Host URL, Example https:///PlatformService","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"relayStateUrl","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SSO login UI page URL, Example https:///app/#/ssologin","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"defaultTargetUrl","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Application user authenticate url, Example https:///user/authenticate","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"postLogoutURL :","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML or SSO provider logout URL, Example value: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0 ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"tokenSigningKey:","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"This is use as secrete key to sign JWT token,It should be 128 character ,Example value:\"insights_IDP_CogDevops_SSO_Token_string\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"registrationId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"A unique identifer for this configuration mapping. This identifier may be used in URI paths, so care should be taken that no URI encoding is required.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"singleSignOnServiceLocation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"The singleSignOnService location.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[361.0]},"content":[{"type":"paragraph","content":[{"text":"privatekeyLocation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"path of the generated Private key.","type":"text"}]}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Disable SSO","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mark \"autheticationProtocol\":\"NativeGrafana\" in server-config.json","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mark \"autheticationProtocol\":\"NativeGrafana\" in uiConfig.json","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open grafana defaults.ini file and disable in [auth.proxy] section and make sure that [auth.basic] enabled ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove following in Apache Httpd vhost file Apache24\\conf\\extra\\httpd-vhosts.conf.","type":"text"}]},{"type":"codeBlock","content":[{"text":"SetEnvIf Cookie \"(^|;\\ *)username=([^;\\ ]+)\" MyCookieValue=$2\n\n RequestHeader set X-WEBAUTH-USER \"%{MyCookieValue}e\"\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart Apache httpd server and Grafana","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart PlatformService and UI.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}],"version":1}

Browser not supported