en-US - - English

SAML2 Provider

A SAML2 provider can also be added in Padmin on its own, not only as an addition to the Azure provider. First, though, you must create the SAML2 application on the Azure portal.

Azure

In Azure, you can create an application with SAML2 authentication. For this, stay in the Azure Active Directory section.

  1. On the left, under Manage, choose Enterprise applications.
  2. Choose New application, then Create your own application.
  3. In the right panel, name your application (keep the third option), then select Create.
  4. After a while the application is created. Add users: only the users added here can sign in with the SSO type application.
  5. On the left, choose Single sign-on.
  6. Then choose SAML.
  7. In Basic SAML Configuration, set Identifier, Reply URL and Sign on URL to PASSMAN_URL/api/authorize/saml2/PROVIDER_NAME.
  8. In Attributes & Claims, make sure that the name or the unique user identifier (UPN) is given. If name is given, make sure it comes back in UPN format.

Padmin

  1. Go to System settings > Authentication.
  2. With NEW, add a Saml2 provider.
  3. Fill in the sign-in and sign-out URLs and the Azure identifier of the service: SSO Login URL*, SSO Logout URL and Identity Provider Entity ID*. You can copy the values from Azure.
  4. Download the certificate: in Azure, under SAML Signing Certificate, download the Certificate (Base64) file. Open its content, for example in Notepad, and copy the body text (without the headers) into the IdP Signature certificate* field in Padmin.
  5. Fill in the name data too: UPN SAML attribute name*, First name SAML attribute name, Last name SAML attribute name, Email SAML attribute name and Groups SAML attribute name*. All five are in the Azure edit view: in the Attributes & Claims section (edit), in the Additional claims, Claim name list. Into UPN SAML attribute name*, copy the claim shown in the second-to-last row, the value of user.principalname (which is actually a URL).

PassMan validates sign-in based on group membership: the users who can sign in are the members of the group or groups given in Groups SAML attribute name*.

Groups in Azure

To manage groups in Azure, go to Groups. You can create a new group, or select an existing one.

  • The users of the selected group are under Members.
  • To add a user to the group: Add members. In the panel that slides in on the right, add a user; the Select button at the bottom adds it. The list of members now includes the added user.

When every required field is filled in, save the new provider with SAVE. From then on, Padmin keeps its data.