Back to home

Knowledge Base

Installation and System Setup

Integration

How to integrate PingFederate SSO with OvalEdge application

Introduction

This document outlines the process of integrating PingFederate SSO with the OvalEdge application.

Active Directory Integration

Configurations

Data store creation

Login to the PingFederate Application as shown below. Enter username and password.
After logging in to pingFederate, click on SYSTEM > Data Stores.
Click Data Stores.
Click Add New Data Store.
After clicking on Add new data store, enter the AD details as shown below.
From the screenshot below,
- NAME: In the name field, you can give any name.
- TYPE: Select Directory (LDAP) for the drop-down list and click Next.
The page below will appear; enter the hostname(IP) of the AD server, and give userDN and password.

Here,
Hostname: Enter AD server hostname.

UserDN= CN=Administrator,CN=Users,DC=<Domain component>,DC=<another Domain component like .net>
After adding details, click Next, review details, and click on save, as shown below.

PCV creation

Navigate to systems and click on password Credentials Validators as shown below.
Click on “Create New Instance” and enter the details as shown below.

Instance Name and Instance ID: You can give any name.
Type= Select LDAP username password credentials validator, and click Next.
After clicking on Next, you will see “Instance configuration” and add the details below as shown.

LDAP Datastores is a datastore that we created in “Data store section”

Search Base is the “Distinguished name”

Search Filter give sAMAccountName=${username}
In Extended Contract, click on ADD and enter memberOf as shown in the screenshot below, and click Next.
Finally, in summary, review the details and click on Save. You will see the page below.

IDP adaptor Creation

Click on Authentication, navigate to the IDP adaptor, and click on New Instance creation, as shown below.
After clicking on Create New Instance, add the details as shown below and click on Next.

Instance Name: You can give any name.

Instance ID: You can give any name.

TYPE: Select “HTML FORM IdP Adaptor.”
Add the data store details in the Adaptor tab and click Next as shown below.

Note: After adding the data store(Active Directory), click on update.
In the extended contract tab, enter the details as shown below.

In the highlighted screenshot below, add the Name, Email, firstName, and lastName parameters and click on next.
In the adaptor attribute section, give the highlighted details and click next.
In the next tab, Adaptor contract mapping, click on Configure Adaptor contract as shown below.
After clicking on configure Adaptor contract, you will see a page like this below; click on Add Attribute sources.
After clicking on the highlighted one above, you will see the page below, add the details, and click next.

Attribute Source ID: You can give any name.

Attribute Source Description: You can give anything.

Active Data Store: Give the Active Directory, i.e., the one you created in the datastore section.
Add the details as shown in the next tab and click Next.

Note: Make sure to add the above details.
Add the filter details as shown below and click Next.
Review the changes and click on Done. You will see the page below.

This is a part of step 7.
Now, click on Adaptor contract fulfillment and add the details as shown below.
Now click Next, and you will see the page below.
Click Next and Done. You will see the page below.
Now again, click Next, review your changes, and click Save.

Entity ID creation

Configurations

Click on Systems and then Server, as shown below.
After clicking on the server, you will see the page below.
Enter the SAML 2.0 entity ID, i.e., we can provide any URL. As shown below, click on next, next, next, and save.

Ovaledge Application Integration

Configurations

SP creation

Click on Applications and then SP connections, as shown below.
Click on Create Connection.
After that, click on the check box, i.e., “Do not use a template for this connection” and click Next.
Now, in connection type, select Browser SSO and click Next as shown below.
In connection options, select browser SSO and click Next.
In the import metadata URL, select none and then click Next.
In the General info, enter the following details.

Partners Entity ID: https://<IP Address or DNS>/saml/metadata

Connection Name: https://<IP Address or DNS>/saml/metadata

Base URL: https://<IP Address or DNS>
Note: Here, https://<IP Address or DNS> is an OvalEdge application URL.
After clicking Next, you will see the page below. Click on browser SSO.
After that, select the highlighted checkbox below and click Next.

IDP-INITIADED SSO

SP-INITIATED SSO
In Assertion-Lifetime, just click Next.
In the Assertion creation page, click on configure assertions creation as shown below.
After clicking on Configure Assertion Creation, you will see the page below. Select the standard checkbox and click Next.
Enter/create the attribute and click Next as shown below.
After clicking on the next page, the following will appear: click on “Map New adaptor” instances.
After clicking on “Map New Adaptor instance,” the following page will appear. In the drop-down list, select the Adaptor Name that we created in the Adaptor instance creation section.
After clicking Next, click on the checkbox and click Next.
In “Attribute contract fulfillment,” configure details below and click Next.

For roles, add expressions, and in values, add the below content.

#groupCnOnly = new java.util.ArrayList(),

#groups = #this.get("roles")!=null ? #this.get("roles").getValues() : {},
#groups.{

  #group = #this,

  #group = new javax.naming.ldap.LdapName(#group),

  #cn = #group.getRdn(#group.size() - 1).getValue().toString(),

  #groupCnOnly.add(#cn)

},

#this.get("roles")!=null ? new org.sourceid.saml20.adapter.attribute.AttributeValue(#groupCnOnly) : null
In the Issuance Criteria, just click Next.
After clicking Next, review the summary page and click on Done.
After that, click on Next, review the Assertion creation, and click on Done. You will navigate to the page below. Click Next.
After clicking Next, you will navigate to the Protocol setting page, as shown below.
Click on Configure protocol settings, give the following details, and click on Add and then Next.

Endpoint URL: https://<IP Address or DNS>/saml/SSO

Here https://<IP Address or DNS> is the OVAledge application URL
Now select the highlighted checkbox and click Next.
In the signature policy, click on Next, as shown below.
In the Encryption policy, just click Next.
In summary, just review the changes and click Done, as shown below.
After clicking Done, you will navigate to the page below. Just click Next and Done, as shown below.
After that, you will navigate to the page below. Click Next.
After clicking Next, you will see the page below. Click on Configure Credentials as shown below.
After clicking on Configure Credentials, click on Manage Certificates, as shown below.
Click on Create New.
Add the following details and click Next.
Now review the changes, and click Save.
After clicking Save, navigate to the page below and click Done.
After clicking Done, you will navigate to the page below. Click Next and Done.
After that, you will navigate to the page below, click Next, review the page, and click Done.

Click Next.

Click Save.
Finally, you will see the page below.
Now, click on Select Action, and Export Metadata as shown below.

Click Next

Click Export as shown below.

A metadata.xml file will be downloaded. Copy that metadata.xml file and paste it into the application server (ovaledge application folder).
Now log in to the OvalEdge application, click Continue with SSO, and log in with your Ping credentials.
Click on system settings, navigate to the SSO section, and in that ovaledge.extauth.authtype default value is HYBRID. Change it to REMOTE, as shown below.

Note: In the OvalEdge application, under System Setting, click on SSO and ovaledge.extauth.authtype configuration value is HYBRID, then no need to create the groups. Otherwise, the preferred value is REMOTE, so we need to create the groups, and below are the steps.

By default, it is HYBRID.

Change it to REMOTE
Now connect to the application server (Windows or Linux), create a folder with any name, and paste the metadata.xml(step 34) file into that folder as shown below.
Copy the metadata.xml file path, paste it into the oasis.properties file as shown below, and save the file.
Now, navigate to the Tomcat bin directory and configure setenv.sh (for windows tomcat9w.exe) file with -DOVALEDGE_SECURITY_TYPE=saml

For Windows:
Navigate to the Tomcat bin folder, open the command prompt here, execute the below command, and make changes.
tomcat9w.exe //ES/tomcat1 (Here tomcat1 is tomcat service name)

For Linux:

Now navigate to the tomcat bin path and edit setenv.sh. In -DOVALEDGE_SECURITY_TYPE=saml, add saml, as shown below.

-DOVALEDGE_SECURITY_TYPE=saml
Now restart Tomcat services and check the application after 5 minutes, as shown below.

Now, you can log in to the application with AD users.