Provisioning Single Sign On in ACSF - NCIOCPL/cgov-digital-platform GitHub Wiki

  1. Create metadata
  2. Submit a Login Service Request to the NIH Login Team
  3. Login team does their configuration.
    • FUTURE Is there a way for us to verify configuration before the site is provisioned?
  4. Provision new site.

Related

Why does the "Recommended SP Session Duration" need to be set to omit the “use assertion validity”?

  • By default, NIH Login sends a SessionNotOnOrAfter value as part of the SAML response.
  • The SimpleSAMLphp library uses that value to override the maximum session duration.
  • This results in the session duration being set to the difference between the instant the authentication occurred (which appears in the AuthnInstant value). This works out to be 30 seconds.

Creating the metadata file

The metadata file is an ordinary XML file.

Using the template below.

  • Replace <<CERT>> (two instances) with the contents of the signing certifcate's saml.crt file.
  • Replace <<HOST>> (seven instances) with the new systems's hostname (e.g. www-test-ac).
  • Replace <<EMAIL>> (one instance) with the SMTP address ([email protected]) for the OCPL Application Alerts distribution.
<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/metadata.php/cancergov-sp">
  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol">
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate><<CERT>></ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate><<CERT>></ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml2-logout.php/cancergov-sp"/>
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml2-logout.php/cancergov-sp"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml2-acs.php/cancergov-sp" index="0"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml1-acs.php/cancergov-sp" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml2-acs.php/cancergov-sp" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://<<HOST>>.cancer.gov/simplesaml/module.php/saml/sp/saml1-acs.php/cancergov-sp/artifact" index="3"/>
  </md:SPSSODescriptor>
  <md:ContactPerson contactType="technical">
    <md:GivenName>OCPL App Alerts</md:GivenName>
    <md:EmailAddress><<EMAIL>></md:EmailAddress>
  </md:ContactPerson>
</md:EntityDescriptor>
⚠️ **GitHub.com Fallback** ⚠️