<div dir="ltr"><div dir="ltr">Hi Graham,<div><br></div><div>Wow, thank you so much for sharing this with all of us. </div><div>It is very helpful.</div><div>I will set up midPoint Studio to help with the configuration. </div><div><br></div><div>I will report back to everyone with my progress.</div><div><br></div><div><div>Best,</div><div><br></div><div><div>Nadim El-Khoury</div><div>Director of Networks, Systems, Infrastructure, and CISO</div><div>Springfield College</div><div>263 Alden Street</div><div>Springfield, MA 01109</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 12, 2024 at 3:34 PM Graham Ballantyne <<a href="mailto:grahamb@sfu.ca">grahamb@sfu.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>I just went through getting SAML working, after much trial and error. Here's my config: <a href="https://gist.github.com/grahamb/3b28efad1a2ca9dd8502d8061ada2f1e" target="_blank">https://gist.github.com/grahamb/3b28efad1a2ca9dd8502d8061ada2f1e</a></div>
<div><br>
</div>
<div>I use midPoint Studio, and I'm storing the keystore credentials as encrypted secrets.</div>
<div><br>
</div>
<div>The config defines SAML as the default for the GUI, but also has an emergency "back door" login using internal accounts.</div>
<div><br>
</div>
<div>The best resource I found for this was in an Internet2 demo project; my config was mostly cribbed from there. <a href="https://github.internet2.edu/docker/midPoint_container/tree/master/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy" target="_blank">https://github.internet2.edu/docker/midPoint_container/tree/master/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy</a></div>
<div><br>
</div>
<div><br id="m_3312593806316024530lineBreakAtBeginningOfMessage">
<div>
<div dir="auto" style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">
<div dir="auto" style="text-align:start;text-indent:0px">
<div dir="auto" style="text-align:start;text-indent:0px">
<div dir="auto" style="text-align:start;text-indent:0px">
<div dir="auto" style="text-align:start;text-indent:0px">
<div dir="auto" style="text-align:start;text-indent:0px">
<div style="text-align:start;text-indent:0px">
<div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;text-align:start;text-indent:0px">
– <br>
Graham Ballantyne (he/him)<br>
Identity & Access Management Architect — IT Services <br>
Simon Fraser University — Strand Hall 1001 <br>
8888 University Dr., Burnaby, B.C. V5A 1S6 <br>
<a href="mailto:grahamb@sfu.ca" target="_blank">grahamb@sfu.ca</a><br>
</div>
<div style="text-align:start;text-indent:0px"><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<br>
</div>
<div><br>
<blockquote type="cite">
<div>On Jan 12, 2024, at 12:02, Nadim El-Khoury via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>> wrote:</div>
<br>
<div>
<div dir="ltr">
<div dir="ltr">Hi Martin, Everyone
<div><br>
</div>
<div>Thank you for the information. It is very helpful.</div>
<div>I have the following questions.</div>
<div>Is there a document that shows all of the XML entries that can be part of the security policy? I looked on the Evolveum site and could not find it.</div>
<div>The other question: can I put the security policy XML file in /opt/midpoint/post-initial-objects/securityPolicy or is it best to modify the security policy directly using the GUI?</div>
<div>Is there a working security SAML example that we can look at?</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>Best,</div>
<div><br>
</div>
<div>
<div>Nadim El-Khoury</div>
<div>Director of Networks, Systems, Infrastructure, and CISO</div>
<div>Springfield College</div>
<div>263 Alden Street</div>
<div>Springfield, MA 01109</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, Jan 12, 2024 at 4:33 AM Martin Lízner via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div dir="ltr">
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt">
Hi, it depends on your security policy. UrlSuffix could be e.g. "saml"</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt">
<br>
</div>
<div><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;font-size:12pt"><span id="m_3312593806316024530cid:ii_18cff3f4935cb971f161"><image.png></span></span></div>
<div id="m_3312593806316024530m_7710385112247167927appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="m_3312593806316024530m_7710385112247167927divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt"><b>Od:</b> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> za uživatele Nadim
El-Khoury via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Odesláno:</b> úterý 9. ledna 2024 4:17<br>
<b>Komu:</b> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Kopie:</b> Nadim El-Khoury <<a href="mailto:nel-khoury@springfield.edu" target="_blank">nel-khoury@springfield.edu</a>><br>
<b>Předmět:</b> [midPoint] SAML2 Module Configuration</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hi Everyone,
<div><br>
</div>
<div>We are working on configuring the SAML2 module in Midpoint. </div>
<div>What is the <authenticationSequenceUrlSuffic> that is mentioned in section 2.1.10.7 (Generation of service provider metadata) of the
<a href="https://docs.evolveum.com/midpoint/reference/support-4.8/security/authentication/flexible-authentication/configuration/#module-saml2" target="_blank">
flexible authentication configuration</a>?</div>
<div><br clear="all">
<div>
<div>I really appreciate your help.</div>
<div><br>
</div>
<div>Best,</div>
<div><br>
</div>
<div>
<div>Nadim El-Khoury</div>
<div>Director of Networks, Systems, Infrastructure, and CISO</div>
<div>Springfield College</div>
<div>263 Alden Street</div>
<div>Springfield, MA 01109</div>
</div>
</div>
<div><br>
</div>
<span>-- </span><br>
<div dir="ltr">
<div dir="ltr"><font face="Helvetica Neue, Helvetica, Arial, sans-serif">"</font><span style="font-family:"Source Serif Pro",serif">I’ve learned that people will forget what you said, people will forget what you did, but people will never forget how you
made them feel." </span><span style="font-family:"Source Serif Pro",serif">Maya Angelou</span></div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
<span class="gmail_signature_prefix">-- </span><br>
<div dir="ltr" class="gmail_signature">
<div dir="ltr"><font face="Helvetica Neue, Helvetica, Arial, sans-serif">"</font><span style="font-family:"Source Serif Pro",serif">I’ve learned that people will forget what you said, people will forget what you did, but people will never forget how you
made them feel." </span><span style="font-family:"Source Serif Pro",serif">Maya Angelou</span></div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote></div><br clear="all"><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><font color="#000000" face="Helvetica Neue, Helvetica, Arial, sans-serif">"</font><span style="color:rgba(0,0,0,0.9);font-family:"Source Serif Pro",serif">I’ve learned that people will forget what you said, people will forget what you did, but people will never forget how you made them feel." </span><span style="color:rgba(0,0,0,0.9);font-family:"Source Serif Pro",serif">Maya Angelou</span></div></div></div>