<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>I just went through getting SAML working, after much trial and error. Here's my config: <a href="https://gist.github.com/grahamb/3b28efad1a2ca9dd8502d8061ada2f1e">https://gist.github.com/grahamb/3b28efad1a2ca9dd8502d8061ada2f1e</a></div>
<div><br>
</div>
<div>I use midPoint Studio, and I'm storing the keystore credentials as encrypted secrets.</div>
<div><br>
</div>
<div>The config defines SAML as the default for the GUI, but also has an emergency "back door" login using internal accounts.</div>
<div><br>
</div>
<div>The best resource I found for this was in an Internet2 demo project; my config was mostly cribbed from there. <a href="https://github.internet2.edu/docker/midPoint_container/tree/master/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy">https://github.internet2.edu/docker/midPoint_container/tree/master/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy</a></div>
<div><br>
</div>
<div><br id="lineBreakAtBeginningOfMessage">
<div>
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div style="text-align: start; text-indent: 0px; overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; text-align: start; text-indent: 0px;">
– <br>
Graham Ballantyne (he/him)<br>
Identity & Access Management Architect — IT Services <br>
Simon Fraser University — Strand Hall 1001 <br>
8888 University Dr., Burnaby, B.C. V5A 1S6 <br>
grahamb@sfu.ca<br>
</div>
<div style="text-align: start; text-indent: 0px;"><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<div><br>
<blockquote type="cite">
<div>On Jan 12, 2024, at 12:02, Nadim El-Khoury via midPoint <midpoint@lists.evolveum.com> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div dir="ltr">
<div dir="ltr">Hi Martin, Everyone
<div><br>
</div>
<div>Thank you for the information. It is very helpful.</div>
<div>I have the following questions.</div>
<div>Is there a document that shows all of the XML entries that can be part of the security policy? I looked on the Evolveum site and could not find it.</div>
<div>The other question: can I put the security policy XML file in /opt/midpoint/post-initial-objects/securityPolicy or is it best to modify the security policy directly using the GUI?</div>
<div>Is there a working security SAML example that we can look at?</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>Best,</div>
<div><br>
</div>
<div>
<div>Nadim El-Khoury</div>
<div>Director of Networks, Systems, Infrastructure, and CISO</div>
<div>Springfield College</div>
<div>263 Alden Street</div>
<div>Springfield, MA 01109</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, Jan 12, 2024 at 4:33 AM Martin Lízner via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="msg-6269581302865076561">
<div dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt;">
Hi, it depends on your security policy. UrlSuffix could be e.g. "saml"</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt;"><span id="cid:ii_18cff3f4935cb971f161"><image.png></span></span></div>
<div id="m_7710385112247167927appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="m_7710385112247167927divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt"><b>Od:</b> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> za uživatele Nadim
El-Khoury via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Odesláno:</b> úterý 9. ledna 2024 4:17<br>
<b>Komu:</b> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Kopie:</b> Nadim El-Khoury <<a href="mailto:nel-khoury@springfield.edu" target="_blank">nel-khoury@springfield.edu</a>><br>
<b>Předmět:</b> [midPoint] SAML2 Module Configuration</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi Everyone,
<div><br>
</div>
<div>We are working on configuring the SAML2 module in Midpoint. </div>
<div>What is the <authenticationSequenceUrlSuffic> that is mentioned in section 2.1.10.7 (Generation of service provider metadata) of the
<a href="https://docs.evolveum.com/midpoint/reference/support-4.8/security/authentication/flexible-authentication/configuration/#module-saml2" target="_blank">
flexible authentication configuration</a>?</div>
<div><br clear="all">
<div>
<div>I really appreciate your help.</div>
<div><br>
</div>
<div>Best,</div>
<div><br>
</div>
<div>
<div>Nadim El-Khoury</div>
<div>Director of Networks, Systems, Infrastructure, and CISO</div>
<div>Springfield College</div>
<div>263 Alden Street</div>
<div>Springfield, MA 01109</div>
</div>
</div>
<div><br>
</div>
<span>-- </span><br>
<div dir="ltr">
<div dir="ltr"><font face="Helvetica Neue, Helvetica, Arial, sans-serif">"</font><span style="font-family: "Source Serif Pro", serif;">I’ve learned that people will forget what you said, people will forget what you did, but people will never forget how you
made them feel." </span><span style="font-family: "Source Serif Pro", serif;">Maya Angelou</span></div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
<span class="gmail_signature_prefix">-- </span><br>
<div dir="ltr" class="gmail_signature">
<div dir="ltr"><font face="Helvetica Neue, Helvetica, Arial, sans-serif">"</font><span style="font-family: "Source Serif Pro", serif;">I’ve learned that people will forget what you said, people will forget what you did, but people will never forget how you
made them feel." </span><span style="font-family: "Source Serif Pro", serif;">Maya Angelou</span></div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
midPoint@lists.evolveum.com<br>
https://lists.evolveum.com/mailman/listinfo/midpoint<br>
</div>
</blockquote>
</div>
<br>
</div>
</body>
</html>