Skip to content

Commit 3b88c5a

Browse files
Otijomcconard96orthagh
authored
Saml (#107)
* modify SCIM plugin * modify structure & highlighting the token * modify structure & FAQ * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/setup_plugin.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/setup_plugin.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/setup_plugin.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/requirements.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/password_SSO.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/okta.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/entra.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/okta.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/okta.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/okta.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * Update source/scim/okta.rst Co-authored-by: Curtis Conard <cconard96@gmail.com> * modify structure and text * add plugin SAMl/entra * Apply suggestions from code review Co-authored-by: Curtis Conard <cconard96@gmail.com> * add files transifex * modify SAML * Update source/saml/entra.rst Co-authored-by: Alexandre Delaunay <delaunay.alexandre@gmail.com> * SAML - Add Google * add files transifex * add section security on Google * add requirements --------- Co-authored-by: Curtis Conard <cconard96@gmail.com> Co-authored-by: Alexandre Delaunay <delaunay.alexandre@gmail.com>
1 parent 8afe924 commit 3b88c5a

82 files changed

Lines changed: 768 additions & 171 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.tx/config‎

Lines changed: 77 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,33 @@ source_file = build/locale/scim/index.pot
195195
source_lang = en
196196
type = PO
197197

198-
[o:teclib:p:glpi-plugins-documentation:r:scim--azure]
199-
file_filter = source/locale/<lang>/LC_MESSAGES/scim/azure.po
200-
source_file = build/locale/scim/azure.pot
198+
[o:teclib:p:glpi-plugins-documentation:r:scim--entra]
199+
file_filter = source/locale/<lang>/LC_MESSAGES/scim/entra.po
200+
source_file = build/locale/scim/entra.pot
201+
source_lang = en
202+
type = PO
203+
204+
[o:teclib:p:glpi-plugins-documentation:r:scim--faq]
205+
file_filter = source/locale/<lang>/LC_MESSAGES/scim/faq.po
206+
source_file = build/locale/scim/faq.pot
207+
source_lang = en
208+
type = PO
209+
210+
[o:teclib:p:glpi-plugins-documentation:r:scim--install_plugin]
211+
file_filter = source/locale/<lang>/LC_MESSAGES/scim/install_plugin.po
212+
source_file = build/locale/scim/install_plugin.pot
213+
source_lang = en
214+
type = PO
215+
216+
[o:teclib:p:glpi-plugins-documentation:r:scim--password_SSO]
217+
file_filter = source/locale/<lang>/LC_MESSAGES/scim/password_SSO.po
218+
source_file = build/locale/scim/password_SSO.pot
219+
source_lang = en
220+
type = PO
221+
222+
[o:teclib:p:glpi-plugins-documentation:r:scim--requirements]
223+
file_filter = source/locale/<lang>/LC_MESSAGES/scim/requirements.po
224+
source_file = build/locale/scim/requirements.pot
201225
source_lang = en
202226
type = PO
203227

@@ -398,3 +422,53 @@ file_filter = source/locale/<lang>/LC_MESSAGES/glpiai/example.po
398422
source_file = build/locale/glpiai/example.pot
399423
source_lang = en
400424
type = PO
425+
426+
[o:teclib:p:glpi-plugins-documentation:r:saml--entra]
427+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/entra.po
428+
source_file = build/locale/saml/entra.pot
429+
source_lang = en
430+
type = PO
431+
432+
[o:teclib:p:glpi-plugins-documentation:r:saml--google]
433+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/google.po
434+
source_file = build/locale/saml/google.pot
435+
source_lang = en
436+
type = PO
437+
438+
[o:teclib:p:glpi-plugins-documentation:r:saml--index]
439+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/index.po
440+
source_file = build/locale/saml/index.pot
441+
source_lang = en
442+
type = PO
443+
444+
[o:teclib:p:glpi-plugins-documentation:r:saml--requirements]
445+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/requirements.po
446+
source_file = build/locale/saml/requirements.pot
447+
source_lang = en
448+
type = PO
449+
450+
[o:teclib:p:glpi-plugins-documentation:r:saml--rules]
451+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/rules.po
452+
source_file = build/locale/saml/rules.pot
453+
source_lang = en
454+
type = PO
455+
456+
[o:teclib:p:glpi-plugins-documentation:r:saml--sources]
457+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/tabs/sources.po
458+
source_file = build/locale/saml/tabs/sources.pot
459+
source_lang = en
460+
type = PO
461+
462+
[o:teclib:p:glpi-plugins-documentation:r:saml--add-app]
463+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/tabs/add-app.po
464+
source_file = build/locale/saml/tabs/add-app.pot
465+
source_lang = en
466+
type = PO
467+
468+
[o:teclib:p:glpi-plugins-documentation:r:saml--for-entra]
469+
file_filter = source/locale/<lang>/LC_MESSAGES/saml/tabs/for-entra.po
470+
source_file = build/locale/saml/tabs/for-entra.pot
471+
source_lang = en
472+
type = PO
473+
474+

‎source/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ You'll find here user documentation for various `GLPI <http://glpi-project.org>`
3535
oauthimap/index
3636
order/index
3737
pdf/index
38+
saml/index
3839
sccm/index
3940
treeview/index
4041
tag/index

‎source/saml/entra.rst‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
Entra
2+
=====
3+
4+
.. include:: tabs/add-app.rst
5+
6+
.. include:: tabs/for-entra.rst
7+
8+
Add an app in Entra
9+
-------------------
10+
11+
* Connect to your `Entra portal <https://portal.azure.com/#home>`_
12+
* Click on **Entreprise Application**
13+
* **And + New application**
14+
* In the search bar, enter **saml toolkit**
15+
* Click on **Microsoft Entra SAML Toolkit**
16+
17+
.. image:: images/add-app-entra.png
18+
:alt: create app entra
19+
:scale: 72%
20+
21+
* Optionnal : You can rename this app
22+
* Click on **Create**
23+
24+
When the application is created :
25+
26+
* Go to **Single sign-on**
27+
* Click on SAML
28+
29+
.. image:: images/setup-saml-entra.png
30+
:alt: create SAM app entra
31+
:scale: 51%
32+
33+
Setup the app
34+
-------------
35+
36+
* In the 1st insert, click on **Edit**
37+
* Copy the values as follows
38+
39+
.. image:: images/setup-basic-saml-entra.png
40+
:alt: Report the values in entra
41+
:scale: 90%
42+
43+
.. image:: images/setup-basic-saml-glpi.png
44+
:alt: See the values in GLPI
45+
:scale: 75%
46+
47+
Setup the Service Provider
48+
---------------------------
49+
50+
In **SP certificate** and **SP Private Key**, copy/paste your certificate in place of those already present.
51+
There are no strict requirements for these certificates, other than that they are valid X509 certificates.
52+
53+
.. image:: images/certificates-service-provider.png
54+
:alt: setup the values
55+
:scale: 80%
56+
57+
Setup the Identity Provider
58+
---------------------------
59+
60+
* In the third insert of Entra app, click on **Download** from **Certificate (Base64)**
61+
62+
.. image:: images/extract-certificate.png
63+
:alt: Download certificate
64+
:scale: 90%
65+
66+
* **Open** this certificate with notepad ++ (or other tool which can read this type of certificate)
67+
* **Copy** the content of the certificate in GLPI with the tags
68+
* **Paste** the certificate in **Identity provider** > **X509 certificate**
69+
* Then fill in the fields as follows withe the informations in the fourth insert :
70+
71+
72+
.. image:: images/setup-identity-provider.png
73+
:alt: Paste certificate and setup the values
74+
:scale: 42%
75+
76+
.. image:: images/setup-identity-provider-toolkit.png
77+
:alt: setup the values
78+
:scale: 100%
79+
80+
.. tip:: It is advisable to use **none** as the **REQ AUTHN CONTEXT**
81+
82+
Security
83+
--------
84+
85+
For a production instance, you must activate the **Strict** option.
86+
87+
We advise you to activate **JIT user creation**. This will allow the rules you create from JIT Rules to be applied.
88+
89+
.. image:: images/security.png
90+
:alt: options for security
91+
:scale: 82%
92+
93+
.. Warning::
94+
For the plugin to authenticate a user, the field must contain a **valid UPN** formatted **as an email**.
95+
This behaviour can lead to duplicate entries in GLPI when users leave Ldap.
96+
This is an important detail because some users who leave Active directory in certain scenarios still use the usersam account name
97+
(old netbui names) as the UPN in entra.
98+
As a result, the nameId field in the samlResponse will not be populated with a valid email address.
99+
The username field is used because the email field is not guaranteed to be unique in GLPI and it is essential that a
100+
unique identifier is used to allow authorisation of a specific GLPI user.
101+
102+
103+
Add users allowed to use SAML
104+
-----------------------------
105+
106+
SAML needs users/groups to be added so that they are authorised to use authentication.
107+
108+
* Click on **users and groups** tab,
109+
* Click on **+ Add user/group**
110+
* Select all the users and groups required
111+
* Click on **Assign**
112+
113+
.. image:: images/select-users-groups.png
114+
:alt: add user allowed
115+
:scale: 45%
116+
117+
Mapping
118+
-------
119+
120+
If you wish to add additional information to your profile, you can use Attributes & Claims.
121+
Your profile will be populated with the information entered in Entra.
122+
123+
* In **Single sign on**, click on **Edit**
124+
* Copy the URL of the one of the other claim
125+
126+
.. image:: images/copy_url_claims.png
127+
:alt: Copy the URL schema
128+
:scale: 78%
129+
130+
* Click on **+ Add new claim**
131+
* Select a name
132+
* Paste the URL you've just copied ine **Namespace**
133+
* Selct **attribute**
134+
* Search the value that you want in the **Source attribute**
135+
* Save your modification
136+
* Repeat this step for all the desired values
137+
138+
139+
.. image:: images/add_claims_entra.png
140+
:alt: add claims in Entra
141+
:scale: 45%
142+
143+
.. image:: images/see_claims_entra.png
144+
:alt: see claims in Entra
145+
:scale: 83%
146+
147+
.. include:: tabs/rules.rst
148+
149+
.. include:: tabs/source.rst

‎source/saml/google.rst‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
Google
2+
======
3+
4+
.. include:: tabs/add-app.rst
5+
6+
Add an app in Google
7+
--------------------
8+
9+
* Connect to your `Google portal <https://accounts.google.com/>`_
10+
* Click on **Apps**
11+
* Cick on **Web and mobile apps**
12+
* Then, click on **Add app**
13+
* And **Add custom SAML app**
14+
15+
.. image:: images/add_custom_app.png
16+
:alt: create app Google
17+
:scale: 43%
18+
19+
* Name your application
20+
* Click on **Continue**
21+
22+
.. image:: images/app_name.png
23+
:alt: give a name to your app
24+
:scale: 49%
25+
26+
- Click on **Save** on GLPI.
27+
28+
Setup the Identity Provider
29+
---------------------------
30+
31+
* Enter the values as shown in the 2 screenshots below
32+
33+
.. image:: images/idp_infos.png
34+
:alt: IDP info Google
35+
:scale: 49%
36+
37+
.. image:: images/idp_infos_glpi.png
38+
:alt: report the values in GLPI
39+
:scale: 44%
40+
41+
.. tip:: Copy/paste the content of the certificate in GLPI with the tags *---BEGIN CERTIFICATE--- ---END CERTIFICATE---*
42+
43+
Setup the Service Provider
44+
---------------------------
45+
46+
* In Service provider details, report the values from GLPI to Google :
47+
48+
.. image:: images/sp_infos_glpi.png
49+
:alt: Service provider info GLPI
50+
:scale: 44%
51+
52+
.. image:: images/sp_infos.png
53+
:alt: Report the values form GLPI
54+
:scale: 49%
55+
56+
* From Google, select **EMAIL** in **Name ID format**
57+
* In **Name ID**, select **Basic information > Primary email**
58+
* From GLPI, select **Email Address** in **NAMEID FORMAT**
59+
60+
In **SP certificate** and **SP Private Key**, copy/paste your certificate in place of those already present.
61+
There are no strict requirements for these certificates, other than that they are valid X509 certificates.
62+
63+
.. image:: images/certificates-service-provider.png
64+
:alt: setup the values
65+
:scale: 80%
66+
67+
* Click on **Continue**
68+
* Then **Finish**
69+
70+
Your app is now created
71+
72+
.. image:: images/app_created.png
73+
:alt: Your app is now created
74+
:scale: 44%
75+
76+
Security
77+
--------
78+
79+
For a production instance, in GLPI, you must activate the **Strict** option in setup plugin SAML.
80+
81+
We advise you to activate **JIT user creation**. This will allow the rules you create from JIT Rules to be applied.
82+
83+
.. image:: images/security.png
84+
:alt: options for security
85+
:scale: 82%
86+
87+
.. Warning::
88+
For the plugin to authenticate a user, the field must contain a **valid UPN** formatted **as an email**.
89+
This behaviour can lead to duplicate entries in GLPI when users leave Ldap.
90+
This is an important detail because some users who leave Active directory in certain scenarios still use the usersam account name
91+
(old netbui names) as the UPN in entra.
92+
As a result, the nameId field in the samlResponse will not be populated with a valid email address.
93+
The username field is used because the email field is not guaranteed to be unique in GLPI and it is essential that a
94+
unique identifier is used to allow authorisation of a specific GLPI user.
95+
96+
Add users allowed to use SAML
97+
-----------------------------
98+
99+
SAML needs users/groups to be added so that they are authorised to use authentication.
100+
101+
* On your appl, click on **Viex details** tab in **User access**
102+
* Click on **On for everyone**
103+
* Click on **Save**
104+
105+
.. image:: images/service_state.png
106+
:alt: Allow users to use app
107+
:scale: 53%
108+
109+
110+
Mapping
111+
-------
112+
113+
If you wish to add additional information to your profile, you can use Attributes.
114+
Your profile will be populated with the information entered in Entra.
115+
116+
* In you app, click on **Configure SAML attribute mapping** in **SAML attribute mapping**
117+
* Copy the URL of the one of the other claim
118+
* Add informations that you want
119+
* Click on **Save**
120+
121+
.. image:: images/add_mapping_google.png
122+
:alt: add attributes for Google
123+
:scale: 45%
124+
125+
.. image:: images/see_attributes.png
126+
:alt: Allow users to use app
127+
:scale: 60%
128+
129+
.. include:: tabs/rules.rst
130+
131+
.. include:: tabs/source.rst

‎source/saml/images/add-app-entra.png‎

18.8 KB
Loading

‎source/saml/images/add-app-glpi.png‎

43.2 KB
Loading

‎source/saml/images/add-rule.png‎

15.3 KB
Loading

‎source/saml/images/add_claims_entra.png‎

18.8 KB
Loading

‎source/saml/images/add_custom_app.png‎

74 KB
Loading

‎source/saml/images/add_mapping_google.png‎

46.1 KB
Loading

0 commit comments

Comments
 (0)