SAML 2.0 Authentication Handler

AEM ships with a SAML authentication handler. This handler provides support for the SAML 2.0 Authentication Request Protocol (Web-SSO profile) using the HTTP POST binding.

It supports:

• signing and encryption of messages
• automatic creation of users
• synching groups to existing ones in AEM
• Service Provider and Identity Provider initiated authentication

This handler stores the encrypted SAML response message in the user-node ( usernode/samlResponse) to facilitate communication with a third-party Service Provider.

Configuring The SAML 2.0 Authentication Handler

The Web console provides access to the SAML 2.0 Authentication Handler configuration called Adobe Granite SAML 2.0 Authentication Handler. The following properties can be set.

Path Repository path for which this authentication handler should be used by Sling. If this is empty, the authentication handler will be disabled.

Service Ranking OSGi Framework Service Ranking value to indicate the order in which to call this service. This is an integer value where higher values designate higher precedence.

IDP Certificate Alias The alias of the IdP’s certificate in the global truststore. If this property is empty the authentication handler is disabled. See the “Add the IdP Certificate to the AEM TrustStore” chapter below on how to set it up.

Identity Provider URL URL of the IDP where the SAML Authentication Request should be sent to. If this property is empty the authentication handler is disabled.

Service Provider Entity ID ID which uniquely identifies this service provider with the identity provider. If this property is empty the authentication handler is disabled.

Default Redirect The default location to redirect to after successful authentication.

User-ID Attribute The name of the attribute containing the user ID used to authenticate and create the user in the CRX repository.

Use Encryption Whether or not this authentication handler expects encrypted SAML assertions.

Autocreate CRX Users Whether or not to automatically create non-existing users in the repository after successful authentication.

Add to Groups Whether or not a user should be automatically added to CRX groups after successful authentication.

Group Membership The name of the saml:Attribute containing a list of CRX groups this user should be added to.

Add the IdP Certificate to the AEM TrustStore

SAML assertions are signed and may optionally be encrypted. In order for this to work you have to provide at least the public certificate of the IdP in the repository. In order to do this you need to:

1. Go to http:/serveraddress:serverport/libs/granite/security/content/truststore.html

2. Press the Create TrustStore link

3. Enter the password for the TrustStore and press Save.

4. Click on Manage TrustStore.

5. Upload the IdP certificate.

6. Take note of the certificate Alias. The alias is admin#1436172864930 in the example below.

   

Add the Service Provider key and certificate chain to the AEM keystore

1. Go to: http://localhost:4502/libs/granite/security/content/useradmin.html
2. Edit the authentication-service user.
3. Create a KeyStore by clicking Create KeyStore under Account Settings.

1. Upload the Private key file by clicking Select Private Key File. The key meeds to be in PKCS#8 format with DER encoding.

2. Upload the certificate file by clicking Select Certificate Chain Files.

3. Assign an Alias, as shown below:

   

Configure a Logger for SAML

You can set up a Logger in order to debug any issues that might arise from misconfiguring SAML. You can do this by:

1. Going to the Web Console, at http://localhost:4502/system/console/configMgr

2. Search for and click on the entry called Apache Sling Logging Logger Configuration

3. Create a logger with the following configuration:

   • Log Level: Debug
   • Log File: logs/saml.log
   • Logger: com.adobe.granite.auth.saml

Business.Adobe.com resources

Multichannel Communication Asset Collections Embedded Charts Dynamic Media Dynamic Forms Digital Signage