Configure Single Sign-On via SAML

Single sign-on servers mostly use HTTPS connections, so you will likely need to enable it for Collaborator server as well. For instructions, please see Configure HTTPS. Do not forget to restart the Collaborator server to apply changes.

1. Install your preferred SSO server. In this instruction we will use OneLogin SSO server.

2. Log in to your SSO server as account owner or super user.

3. Add new application integration:

   • Select Apps > Add Apps from the main menu.

   • Search for an application of the SAML Test Connector (IdP) type.

     

   • Specify the application display name and, optionally, its icons, then click Save.

   • Switch to the Configuration tab and specify the following data:

     Audience	The URL of the entity that is expected to receive the SAML message. In our case, this will be the URL of your Collaborator server. For instance: https://yourcollabserver.com. Your Collaborator server must be accessible to SSO server. Configure a firewall or enable tunneled connections to do so.
     ACS (Consumer) URL	The URL of Assertion Consumer Service (ACS) where the SAML response will be sent to. Collaborator servers have this service at the following endpoint: https://yourcollabserver.com/services/saml/acs
     ACS (Consumer) URL Validator	The regular expression to validate ACS URL. For instance: ^https:\/\/yourcollabserver\.com\/services\/saml\/acs\/$.
     Single Logout URL	The URL of endpoint where the logout request will be sent to. Collaborator servers have the following logout endpoint: https://yourcollabserver.com/services/saml/logout

   • Switch to the Parameters tab and append two assertion parameters with names: FirstName and LastName. For both parameters, enable the Include in SAML assertion option. These parameters will contain the users first and last name, respectively. Optionally, modify the NameID parameter to pass username rather than email address as primary user identifier. Also you can use the NameID parameter or add one more parameter to store LDAP user name for synchronizing group membership via LDAP or Active Directory. See Synching User Group Membership with LDAP/Active Directory below.

     

     Click the image to enlarge it.

   • Click Save to confirm application configuration changes.

4. Assign users to the created Collaborator SAML Connector application.

   • Select Users > All Users from the main menu.

   • Click the needed user.

   • Switch to the Applications tab.

   • Click the plus sign to assign an app to the user.

     

     Click the image to enlarge it.

     Make sure you have matchin user accounts in Collaborator server and in OneLogin – that is, the OneLogin username must be identical to the Collaborator user. Also, create at least one OneLogin user account that will match the account of Collaborator administrator; logging in with this account via SSO will log you into Collaborator server as its administrator.

5. Select Apps > Company Apps from the main meny, click Collaborator SAML connector application, then switch to the SSO tab.

   

   Click the image to enlarge it.

   This tab holds SAML metadata that you must provide to your Collaborator server to complete the integration.

1. Open the Collaborator login page in a browser and log in to Collaborator as an administrator.

2. In Collaborator, go to Admin > Single Sign-On.

3. In the New SSO Configuration section select SAML SSO configuration type and click Create. This will display the configuration settings.

   

   Click the image to enlarge it.

4. Specify the setting values:

   Service Provider	The URL of the entity that is expected to receive the SAML message. In our case, this will be the URL of your Collaborator server. For instance: https://yourcollabserver.com. Your Collaborator server must be accessible to SSO server. Configure a firewall or enable tunneled connections to do so.
   SSO login endpoint URL	The URL where to redirect users for single sign-on procedure, if a session is not already established. This should be the value from the SAML 2.0 Endpoint (HTTP) setting of Collaborator SAML Connector application on OneLogin server.
   SSO logout endpoint URL	The URL where to redirect users for single logout procedure. This should be the value from the SLO Endpoint (HTTP) setting of Collaborator SAML Connector application on OneLogin server.
   X.509 Certificate	The public certificate that establishes trust between SSO server and Collaborator server. This should be the value from the X.509 Certificate setting of Collaborator SAML Connector application on OneLogin server. To copy the X.509 certificate, click View Details and click the Copy to Clipboard icon.
   SAML NameIDPolicy Format	Specifies the format of the NameIDPolicy parameter in the authentication requests.
   Enable AD/LDAP lookup	Specifies whether Collaborator should retrieve user membership in groups from the LDAP/Active Directory. See Synching User Group Membership with LDAP/Active Directory.
   Username parameter	Defines the name of SAML response parameter that contains LDAP username. See Synching User Group Membership with LDAP/Active Directory. If the parameter name is not specified, or the parameter returns empty value the synchronization is not performed.

5. After you specified the values, click Save. This will create a SAML SSO configuration.

6. If you have multiple configurations, press Make Active to mark current configuration as active.

7. Scroll the Admin > Single Sign-On screen up to the Single Sign-On (SSO) Status section and change the Enable Single Sign-On setting to Yes.

Now the integration between Collaborator and single sign-on server is configured and running. Further attempts to log into Collaborator server will be processed by the sign-on server.

While using single sign-on server to manage users, you may additionally configure user and group synchronization between Collaborator and the LDAP directory or Active Directory. In this case, Collaborator will perform the following actions:

1. When user logs in, sign-on server server sends SAML response with some pre-configured parameters.
2. Collaborator receives the response, extracts the parameter which holds LDAP username, and sends this username to LDAP directory or Active Directory.
3. LDAP directory or Active Directory searches for groups this user belongs to and returns them to Collaborator
4. Collaborator checks if the specified user and group(s) exist, creates them if needed, and adds the user to the group(s).
5. Collaborator server logs the user in.

Configuration for LDAP/AD Synchronization

Technical details of LDAP/AD Synchronization

If you experience troubles with single sign-on authentication and cannot login to your Collaborator server (wrong redirect URLs, cannot login as admin, and so on), you can disable SAML single sign-on authentication via the -Dcom.smartbear.server.sso.disable=true Java VM option.

When users log out from OneLogin server, they still remain logged in Collaborator server. For some reason, OneLogin server does not trigger the Collaborator SLO endpoint when user logs out directly from OneLogin server. However, when users log out from Collaborator server, they will be logged out both from Collaborator server and from OneLogin server.