Install the SAML Session Provider 1.13 using the standalone deployment profile

To install the SAML Session Provider 1.13 manually, you must set up a properties file containing the deployment profile configuration data.

There are many possible properties to configure for the manual SAML Session Provider deployment. Only a few of those are required. The other properties will get their default value if omitted in the properties file.

Standalone deployment can be done for on-premise or cloud.

This section contains three tables:

  • A table showing shared properties that apply to both, on-premise and cloud

  • A table showing properties that apply to on-premise only

  • A table showing properties that apply to cloud only

This table shows properties that apply to both, on-premise and cloud:

Property Required? Description
routerFqdn Yes SAML-enabled grid router external FQDN.
routerIP No IP address for external access to the SAML router.
routerHttpsPort Yes SSL port to the SAML router.
createRouter No Boolean value that dictates if a new router should be created during deployment. This router will use the routerFqdn, routerIP, routerHttpsPort, and routerName properties for its configuration. The router will be configured with the saml2 web authentication method. Default value is false.
routerName No The name of the new Router created if createRouter is set to true. Default value is "SAML Router".
routerOnAllHosts No The SAML router is created to run on all hosts in the Grid. If false, the router is created only on the SAML Session Provider host. Default value is false.
restrictSystemAccess No Dictate if SYSTEM should be restricted on the SAML router. This will block users logging in via the SAML router from accessing the grid management UI. The default value is false.
SignAssertions No Requests the IdP to sign assertions. Default is true.
signatureAlgorithm No

The signature algorithm to be used for signed AuthnRequests and LogoutResponses. Possible values are:

  • "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" (the default and recommended value)

  • "http://www.w3.org/2000/09/xmldsig#rsa-sha1"

See Managing the signature algorithm for the SAML Session Provider.
sessionTimeout No The idle timeout, in minutes, for grid sessions created by the SAML Session Provider. The default value is 480 minutes.
identityClaimName No

The claim containing the name for the GridPrincipal.

Default ​value for on-premise installations: http://schemas.infor.com/claims/Identity

Default value for cloud installations: http://schemas.infor.com/claims/Identity2

roleClaimName No The claim to use for GridPrincipal roles. Default value is http://schemas.infor.com/claims/SecurityRole.
assertionTimeout No Provides the timeout in seconds for an assertion. Default is 300.
preferredSPBinding No The protocol binding to set for SAML authentication requests, used by the IdP for authentication responses. The only valid values are urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect and urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST (default).
enableACSUpdate No

Automatically create ACS URLs for all SAML enabled routers during module startup. Default value is false.

Note that the IdP configuration always must be updated when a new ACS URL is added.
proxyServerAddress.x No

Indexed property containing FQDN:port pairs for addresses, such as load balancers or proxy servers, to be used for ACS URLs and logout endpoint. ACS URLs are created for all these addresses. A logout URL is created for the first address.

The first proxy server address, if present, will be used to form the name of the SP/RPT that is registered with IFS and the IdP.
excludeRouterACS No Do not create ACS URLs for the SAML router FQDN or IP address, only for the proxyServerAddress.x entries. The default value is false.
nameidFormat No Provides the NameIDFormat used for WS-Federation. Default is urn:oasis:names:tc:SAML:2.0:nameid-format:transient.
adminUser.# No

Users that should be mapped to the grid-admin role during installation. The mapping will occur only if selfGrant is true. This property is post-fixed with #, where the # denotes an index from 0 upwards.

Note that the names specified must correspond exactly to the names of the grid users after authentication, i.e. the values carried in the identity claim.
selfGrant No Determine whether the SAML SP should be granted as the active session provider. If not granted, the admin users are not mapped. Default value is false.
authLevel No

Set the authentication level that the SAML SP should request from the user authentication in the IdP. Possible values are (ranging from the least secure):

  • "Username/Password"

  • "Password Protected Transport"

  • "Transport Layer Security (TLS) Client"

  • "X.509 Certificate"

  • "Integrated Windows Authentication"

  • "Kerberos"

Default is "Password Protected Transport".

For information on the supported authentication methods, see Session Provider Requirements and Selection.
authLevelComparison No

Set the comparison type for the auth level. Possible values are:

  • "exact" - Only the provided auth level is approved.

  • "better" - Must be stronger than the provided auth level.

  • "minimum" - At least as strong as the provided auth level.

  • "maximum" - Not stronger than the provided auth level.

Default value is "minimum".

cloudDeployment No When set to true, IdP properties are read from the input file, SP properties are provided as a file, and other properties get the cloud default values. Default is false.
ifs.version No Specifies the IFS wsdl version. Possible values are IFSWSv2 (default for on-premise) and IFSWSv3CE (default for cloud).
disable.role.cache No Configuration for the security role cache, used when listing groups for the role mapping UI. The cache is cleaned every 15 minutes. Default is false.
disable.user.cache No Configuration for the user cache, used when searching for user information (not authentication). Default is false.
cache.clean.interval No Number of minutes between user cache cleaning. Default is 60.

This table shows properties that apply to on-premise only:

Property Required? Description
idpFqdn Yes ADFS/IFS server FQDN.
idpHttp No HTTP port to ADFS/IFS. Default is 80. IFS installation guide recommends changing the port.
idpHttps No SSL port to ADFS/IFS. Default is 443. IFS installation guide recommends changing the port.
idpUri No The URI to the Federation metadata xml file of ADFS. The value can be found in the AD FS 2.0+ management tool under Service > Endpoints. At the bottom are the Metadata links. Default is /FederationMetadata/2007-06/FederationMetadata.xml.
ifsFqdn No The FQDN of the IFS server, if it differs from the IdP FQDN.
ifsHttp No The HTTP port of IFS, if it differs from the IdP HTTP port.
ifsHttps No The HTTPS port of IFS, if it differs from the IdP HTTPS port.
useIFS No Dictate if the SAML Session Provider should look up roles in IFS to present in the role mappping UI. Default is true.
deployToIFS No Dictate whether IFS setup should be performed. If set to "false" (or omitted) all IFS/ADFS configuration must be done manually. Default value is false.
IFSUser Yes, if useIFS is true or if useIFS is not defined Username for an IFS Administrator. This user must have the IFSApplicationAdmin and the AttributeServiceCaller Security Roles in IFS. Note that a user in domain\user format must be written as "domain\\user".
IFSPassword Yes, if useIFS is true or if useIFS is not defined The password for the IFSUser.
serverAdminUser No

The local Administrator account on the IFS/AD FS server, to activate the application in IFS if UAC is turned on. Defaults to the IFSUser.

Note: This property does not apply to LTR or Infor OS.
serverAdminPassword No

The Administrator password. Defaults to the IFSPassword if serverAdminUser is not provided.

Note: This property does not apply to LTR or Infor OS.
ifsCfgsvcUrl No The virtual directory of the IFS web application on the idpFqdn. Default is IFSServices.

This table shows properties that apply to cloud only:

Property Required? Description
​idp.saml.metadata.xml.base64 Yes A base64-encoded string representing the IdP metadata, copied from the idp.properties for the PingFederate installation.
displayNameClaim No The claim to use for the GridPrincipal display name. The default is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn
spPropertyOutputFile No Full path and file name to the SP property output file. Ensure that the user running the installation has write permissions in this location. The file may also be retrieved using a REST call to /info/metadata/properties or through the SAML SP Management pages Metadata section.
idp.last.activity.cookie.name No The Ming.le CE property for the keep-alive cookie name.
idp.last.activity.domain.name No The Ming.le CE property for the keep-alive cookie domain name.
​ifs.attributeservice.url No The URL to the IFS CE attribute service.
​ifs.attributeservice.wsdl.url Maybe The URL to the IFS CE wsdl. This property is required if IFS CE is used.
​ifs.attributeservice.client.certificate.base64 Maybe ​A client keystore as a base64-encoded string. This keystore is required to authenticate to IFS CE.
​ifs.attributeservice.client.certificate.password Maybe ​The password needed to import the client certificate provided in the ifs.attributeservice.client.certificate.base64 property. This property is required if IFS CE is used.
ifs.attributeservice.service.certificate.chain.base64 Maybe The certificate chain of all the IFS CE server SSL certificates in a base64-encoded string. This keystore is required to be able to connect to IFS CE. This property is required if IFS CE is used.

To install the SAML Session Provider 1.13 using the standalone deployment profile:

  1. For on-premise installations targeting IFS 11: Before starting the installation, note that the password of the local Administrator account must be given in the property file if UAC is active on the IFS/ADFS server. If this is not done, manual activation must be performed; see step 14.
  2. Access the Configuration Manager for the grid and log on as a grid-admin.
  3. Click Communication > Routers.
  4. If there already is a SAML router, note the external FQDN, HTTP and HTTPS ports, and external IP address. Specify them in the configuration data file. Ensure that the SAML router supports the saml2 authentication method for both HTTP and HTTPS. Also note the host it is running on. You need this information at step 5 for configuration. If there is no SAML router already, set the createRouter property to true in the configuration file.
  5. Enter the router properties into the configuration data file.
  6. Prepare the rest of the configuration data in the file to be used during deployment. See the previous tables for information about the properties.

    For on-premise deployment, the properties in the shared table as well as the properties in the on-premise table can be used.

    For cloud deployment, the properties in the shared table as well as the properties in the cloud table can be used.

  7. Navigate back to the Configuration Manager home page.
  8. Click Applications.
  9. Click Install New Application.
  10. On the Select Application tab, if the SAMLSessionProvider is not available in the list, click Upload. Browse to the gar file and click Upload.
  11. When the SAMLSessionProvider is available on the Select Application tab, select it and click Next.
  12. On the Install Options tab, ensure that the name is SAMLSessionProvider and that the selected deployment profile is StandaloneDeploymentProfile. Browse for the configuration data file and select which host(s) to deploy it to. Click Finish.
  13. After the deployment is done, the SAML Session Provider will start and be in status "Starting" for up to 2 minutes. The reason for this is that the actual IFS configuration takes place the first time the SAML Session Provider is started and not during the deployment. When the IFS setup is finished, the SAML Session Provider should be put into status "OK". If there was no other session provider previously installed and activated, the SAML Session Provider is now the active session provider.
  14. For IFS 11: If the activation of the SAML Session Provider fails it will show as an error in the SAML Session Provider log. The error may look like this: 
    2013-12-17 11:05:43,359 +0100Z ERROR SAMLSessionProviderModule StandaloneStartupConfiguration: The application was created in IFS but the activation failed. The application "urn:host.infor.com_12345"must be manually activated in the IFS management UI.

    If this happens, the SAML Session Provider must be manually activated in the Infor Federation Services (IFS) UI. See the administration guide for IFS for further information.

  15. Finish the installation by configuring the IdP. For AD FS, follow the steps described in Add Assertion Consumer Service endpoint to AD FS. For PingFederate, follow the steps described in Add Service Provider Configuration to PingFederate.