PhenixID

Step by Step – Gleerups – MFA and SSO with PhenixID Authentication Services

Summary

This document will guide you through the steps to configure PhenixID Authentication Services to deliver multi-factor authentication and Single Sign-on (SSO) to Gleerups (https://gleerupsportal.se/).

System Requirements

  • PhenixID Authentication Services 2.7 or higher
  • PhenixID Authentication Services configured with a SAML Identity Provider connected to Skolfederation. Follow this step-by-step to add PhenixID Authentication Services to Skolfederation.

Instruction

Configure Execution flow for Gleerups

  • Login to Configuration Manager
  • Click Scenarios, Federation.
  • Select your previously configured IdP for Skolfederationen.
  • Click Execution Flow
  • Prepare SAML<->User Store attribute mapping for Gleerups using this guide. The SAML attributes to be sent to Gleerups:
    • urn:oid:1.2.752.194.10.2.4
    • urn:oid:1.3.6.1.4.1.5923.1.1.1.9
    • urn:oid:0.9.2342.19200300.100.1.3
    • urn:oid:2.5.4.42
    • urn:oid:2.5.4.4
  • Expand the last execution flow and look for an existing AssertionProvider
  • Expand the AssertionProvider
  • Copy the Target Entity ID Value
  • Add new valve to the last execution flow (where the SAML Assertion is produced)
    • Type=AssertionProvider
    • Set Target Entity ID to the previously copied value
    • Set NameID attribute = userPrincipalName
    • Set Additional attributes = urn:oid:1.2.752.194.10.2.4,urn:oid:1.3.6.1.4.1.5923.1.1.1.9,urn:oid:0.9.2342.19200300.100.1.3,urn:oid:2.5.4.42,urn:oid:2.5.4.4
    • Set Source ID = https://www.gleerupslms.se/core/modules/SAML2.0/lib/www/module.php/saml/sp/metadata.php/default-sp
    • Add a Miscellanous value: nameIdFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
  • On the Advanced tab of the valve you should limit the AssertionProvider to only be executed when authentication to Gleerups is requested. Add this to Execute if expression:
    flow.property(‘issuer’).equals(‘https://www.gleerupslms.se/core/modules/SAML2.0/lib/www/module.php/saml/sp/metadata.php/default-sp‘)
  • Save. Make sure the new AssertionProvider added is placed last in the Execution flow list.

Test

  • Please contact your local Application manager for an application link to use for logon.
  • Your browser should be redirected to the PhenixID IdP
  • Authenticate
  • Verify that you are redirected to the Gleerups application after login with a valid SAML Assertion. Please consult PhenixID for additional debugging if needed.

DISCLAIMER
Information provided in this document is for your information only. PhenixID makes no explicit or implied claims to the validity of this information. Any trademarks referenced in this document are the property of their respective owners.

The origin of this information may be internal or external to PhenixID. PhenixID makes all reasonable efforts to verify this information.

PhenixID - support.phenixid.se