.NET SAML Consumer VAM Deployment Guide

Open the Internet Information Services Manager by typing run in the Start menu, then typing inetmgr.

If the IIS manager console is not displayed, enable it manually. In the Control Panel, select Programs and Features. In the left pane, click Turn Windows features on or off. In the Windows Features screen, expand the Internet Information Services and then expand Web Management Tools. Select the IIS Management Console option , then click OK.

In Connections in the left pane, open the top-level directory and expand the Sites folder to see the Default Web Site.

1. Right-click the Default Web Site and select Add Application.

2. In the Add Application screen, enter a name for the site in the Alias field. This will be the URL to be used later.

3. To the right of the Application Pool field, click Select. In the Select Application Pool screen, select .NET v4.5.

Add a physical path location.

1. Open the Browse for Folder dialog box.

2. Click Make New Folder.

3. Enter the SAMLConsumer as the new folder name and click OK.

4. In the Add Application dialog box, specify the Alias as SAMLConsumer and place the .NET SAML Consumer files in the newly-created samlconsumer folder.

   

5. Click OK to save the changes.

Extract the contents of the .NET SAML Consumer compressed file into the directory created above.

Return to the IIS Manager screen and validate that the ASP.NET v4.0 application pool has the correct identity defined so that it can read from or write to the newly-created directory.

1. On the left pane of the IIS Manager, select Application Pools. All available application pools are displayed in the main pane.

2. Click the ASP.NET v4.5 application pool.

3. On the right Actions pane, select Advanced Settings.

   The Advanced Settings window appears.

4. Hover over the Identity text field for the identity. The Application Pool Identity dialog box is displayed.

From the available options in the Built-in account window, click to highlight a valid account then click OK.

Define the rights to the assigned folder (samlconsumer) you created in step 3.

1. Right-click the folder you created and select Properties to open the properties page.

2. Click Edit to open the Permissions page for the folder.

3. Click Add and enter the account name in the Enter the object names to select field

4. Click Check Names to verify that this account name is correct then click OK.

   The Permissions page is displayed with the newly-defined permission highlighted, NETWORK SERVICE in the example in the following image.

5. In the Permissions box at the bottom of the screen, set Allow for the Modify permission.

6. Click Apply and OK.

7. Click OK in the Select Users, Computers, Service Accounts, or Groups dialog box to save the changes.

Load the admin console for the newly-created site by typing the following into a browser:

https://<FQDN>/<Folder name, e.g., samlconsumer>/SamlAdmin.aspx

The SamlAdmin.aspx file is one of the files extracted into the new folder previously created. The SecureAuth SAML Consumer page appears.

Alternatively, you can create a identity provider from existing metadata by clicking the Create From Metadata button. For more information, see Create an Identity Provider from metadata.

By default, IdentityProvider0 is disabled; click Add in the Identity Provider section then click Edit.

To enable the Identity Provider, click Get to select a certificate.

The following table describes the fields on the Edit SAML Identity Provider screen.

If you want to follow directions without customizing, continue to step 3.

Set up the SecureAuth SAML Consumer by editing the following fields.

1. On the Issuer field, type a valid issuer.

   Note

   The valid issuer can be any name that matches the issuer of the Identity Provider.

2. On the Certificate field, enter the certificate serial number or click the Get to select a certificate from a list of installed certificates.

   If the required certificate is not listed, import the required certificate using the Windows MMC snap-in for managing local computer certificates.

3. Install the certificate that was supplied by the Identity Provider Owner. This should be a base-64 file with a .cer extension, such as Robert.cer.

4. Return to the admin console and click Get. The Choose Certificate screen is displayed.

5. Click the radio button next to the certificate you loaded into the certificate console, then click Select.

6. Click Save Configuration to update the settings file.

   Settings for the identity providers, primarily encryption-related, are displayed in the Application Authentication Cookie section.

Create a folder for the SAML Consumer logs where the SAMLConsumer folder is located.

In the Application Authentication Cookie section, select one of the following options in the Select Cookie Type field.

If you select the Forms Authentication Cookie option, the Forms Authentication Cookie Setup screen is displayed.

The following table describes the fields on the Forms Authentication Cookie Setup screen.

* This field value is automatically retrieved from IIS for the SAML consumer application; you can review it at SAMLConsumer\ASP.NET\Machine Key. Load balanced environments must all match.

If you select the Standard Cookie option, a form like the following image is displayed.

The only field associated with this form is Standard Cookie Name, which is a read-only field that indicates the current name assigned to this cookie.

Open the Forms Authentication Cookie Setup screen by clicking Refresh Auth. Settings (for Web.Config).

In the text box, copy the string that is displayed and paste it into both the service provider web.config file and the SAMLConsumer web.config file.

An additional modification might be required in the two web.config files. In the “authentication” section, ensure the name attribute of the “forms” node is the same for both files, both with entries like the following example.

<authentication mode="Forms">
<forms name="FormsAuth1" loginUrl="https://vm-oc1- d0622.sadev.local/samlconsumer/ sp.aspx?idpkey=IdentityProvider0" requireSSL="false"/>
</authentication>

Use the three buttons at the bottom of the page as follows:

Click Save when you are finished with modifications.

Open the SAML Consumer SAMLAdmin page by entering the following URL in a browser, where <server> is the name of your server:

https://<server>/SAMLConsumer/SAMLAdmin.aspx

In the Identity Providers section at the top, click Create From Metadata.

In the Select A Metadata File dialog box, click the Browse button and select the file containing the metadata you need to import.

When you’ve selected the correct file, click OK. The file is added, as in the following image:

A suggested path for the certificate embedded in the metadata is displayed.

Click Save Cert.

The original admin page displays a new ID Provider; however, this new ID Provider will not be selectable since the certificate has not yet been installed on your local machine store.

Install the certificate.

1. In the File Explorer, browse to the location where you saved the certificate and double-click it to view the certificate.

2. Click the Install Certificate button to view the following Certificate Import Wizard.

3. Select the Local Machine radio button then click Next.

4. Select the Place all certificates in the following store radio button, then click Browse.

5. In the Select Certificate Store dialog box, select the Personal folder and click OK.

6. Click Finish.

   A success or failure message will be displayed reflecting the state of the import.

   Return to the SAML Consumer Admin page and click the Reload button.

   You can now select the new Identity Provider for verification and further editing, if required.

At the bottom of the Application Authentication Cookie page, click on the Modify Applications Settings button.

Use the following table to set the fields.

Click Save Settings when you are finished making changes

Select the Post Authentication tab.

From the “Authenticated User Redirect” dropdown, select SAML 2.0 (SP Initiated) Assertion.

Scroll down to the User ID Mapping section and in the User ID Mapping dropdown, select the SecureAuth IdP property that corresponds to the directory field containing the username, such as Authenticated User ID.

In the Name ID Format dropdown, select the default value: urn:oasis:names:tc:SAML:1.1:nameid- format:unspecified.

In the Encode to Base64 dropdown field, select False.

Scroll down to the SAML Assertion/WS Federation section.

Set the ‘SAML Consumer URL’ field to:

https://<FQDN>/samlconsumer/ assertionconsumer.aspx?IDProviderName=Id entityProviderX

Set the WSFed/SAML Issuer field to your Wombat's Entity ID (such as SAMLIssuer)

In the Sign SAML Assertion dropdown, select True.

In the Sign SAML Message dropdown, select True.

Leave the ‘Signing Cert Serial Number’ field as the default value unless you are using a third- party certificate for the SAML assertion.

When using a third-party certificate, click Select Certificate and choose the appropriate certificate.