Summary

This document will guide you through the steps to configure PhenixID Authentication Services to deliver multi-factor authentication and Single Sign-on (SSO) to Optiplan (Skolskjuts) (http://www.optiplan.se/).

System Requirements

• PhenixID Authentication Services 2.7 or higher
• PhenixID Authentication Services configured with a SAML Identity Provider connected to Skolfederation. Follow this step-by-step to add PhenixID Authentication Services to Skolfederation.

Instruction

Configure Execution flow for Optiplan (Skolskjuts)

• Login to Configuration Manager
• Click Scenarios, Federation.
• Select your previously configured IdP for Skolfederationen.
• Click Execution Flow
• Prepare SAML<->User Store attribute mapping for Optiplan (Skolskjuts) using this guide. The SAML attributes to be sent to Optiplan (Skolskjuts):
  • urn:oid:1.3.6.1.4.1.2428.90.1.5
  • urn:oid:2.5.4.42
  • urn:oid:2.5.4.4
• Expand the last execution flow and look for an existing AssertionProvider
• Expand the AssertionProvider
• Copy the Target Entity ID Value
• Add new valve to the last execution flow (where the SAML Assertion is produced)
  • Type=AssertionProvider
  • Set Target Entity ID to the previously copied value
  • Set NameID attribute = urn:oid:1.3.6.1.4.1.2428.90.1.5
  • Set Additional attributes = urn:oid:1.3.6.1.4.1.2428.90.1.5,urn:oid:2.5.4.42,urn:oid:2.5.4.4

• On the Advanced tab of the valve you should limit the AssertionProvider to only be executed when authentication to Optiplan (Skolskjuts) is requested. Add this to Execute if expression:
  flow.property(‘issuer’).equals(‘https://skolskjuts.se/Saml2‘)
  
  Verify that the issuer value above (https://skolskjuts.se/Saml2) is the same value as entityID for Optiplan in your environment. If not, change to the correct value.

• Save. Make sure the new AssertionProvider added is placed last in the Execution flow list.

Test

• Open a browser and open the Optiplan (Skolskjuts) authentication trigger URL.
• Your browser should be redirected to the PhenixID IdP
• Authenticate
• Verify that you are redirected to the Optiplan (Skolskjuts) application after login with a valid SAML Assertion. Please consult PhenixID for additional debugging if needed.