Configure SAML integration on identity provider

Identity providers require specific values and configurations to successfully integrate with MKE. As these dependencies vary depending on the identity provider, consult your identity provider documentation for instructions on how to best provide the needed information.

Okta integration

Okta integration requires the following values:

Value	Description
URL for single signon (SSO)	URL for MKE, qualified with `/enzi/v0/saml/acs`. For example, `https://111.111.111.111/enzi/v0/saml/acs`.
Service provider audience URI	URL for MKE, qualified with `/enzi/v0/saml/metadata`. For example, `https://111.111.111.111/enzi/v0/saml/metadata`.
NameID format	Select Unspecified.
Application user name	Email. For example, a custom `${f:substringBefore(user.email, "@")}` specifies the user name portion of the email address.
Attribute Statements	Name: `fullname` Value: `user.displayName`
Group Attribute Statement	Name: `member-of` Filter: (user defined) for associate group membership. The group name is returned with the assertion. Name: `is-admin` Filter: (user defined) for identifying whether the user is an admin.

Okta configuration

When two or more group names are expected to return with the assertion, use the regex filter. For example, use the value apple|orange to return groups apple and orange.

ADFS integration

To enable ADFS integration:

Add a relying party trust.
Obtain the service provider metadata URI.

The service provider metadata URI value is the URL for MKE, qualified with /enzi/v0/saml/metadata. For example, https://111.111.111.111/enzi/v0/saml/metadata.
Add claim rules.
1. Convert values from AD to SAML
  - Display-name : Common Name
  - E-Mail-Addresses : E-Mail Address
  - SAM-Account-Name : Name ID
2. Create a full name for MKE (custom rule):
```
c:[Type == "http://schemas.xmlsoap.org/claims/CommonName"]      => issue(Type = "fullname", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value,       ValueType = c.ValueType);
```
3. Transform account name to Name ID:
  - Incoming type: Name ID
  - Incoming format: Unspecified
  - Outgoing claim type: Name ID
  - Outgoing format: Transient ID
4. Pass admin value to allow admin access based on AD group. Send group membership as claim:
  - Users group: your admin group
  - Outgoing claim type: is*admin
  - Outgoing claim value: 1
5. Configure group membership for more complex organizations, with multiple groups able to manage access.
  - Send LDAP attributes as claims
  - Attribute store: Active Directory
    - Add two rows with the following information:
      - LDAP attribute = email address; outgoing claim type: email address
      - LDAP attribute = Display*Name; outgoing claim type: common name
  - Mapping:
    - Token-Groups - Unqualified Names : member-of

PingFederate integration

Note

The information herein is specific for PingOne, the PingFederate cloud IdP setup.

To enable PingFederate integration:

Configure PingFed:

Go to Applications`|:guilabel:`Applications and click the + icon.
Enter an Application Name`and :guilabel:`Description.
Select the SAML Application button and click Save.
Import metadata, using the output of the Service Provider Metadata URL from MKE web UI (https://{MKE host}/enzi/v0/saml/metadata). Make sure to save this page as an XML file, to upload when you configure MKE.
Enable with the slider.
Click Configuration.
Copy the URL for IDP Metadata URL.

Syntax:

ID>

Example:

Note

If you are conifguring local users, set them up manually under Directory.

Configure MKE:

MKE web UI

Log in to the MKE web UI as an administrator.
In the left-side navigation panel, navigate to <user-name> > Admin Settings > Authentication & Authorization to display the Authentication & Authorization pane.
Toggle the SAML control to enable SAML and expand the SAML settings.
Insert the PingFed Metadata URL you copied during your PingFederate configuration into the IdP Metadata URL field.
Click Save.

MKE CLI

Modify the MKE configuration file as follows:

[auth]
samlEnabled = true
[auth.saml]
   idpMetadataURL = <PingFed metadata URI from above>
   spHost = "<mke-host-URI>"

Post the MKE configuration file to https://<MKE host>/api/ucp/config-toml.

Note

Once you enable SAML, Service Provider metadata is available at https://<SPHost>/enzi/v0/saml/metadata. The metadata link is also labeled as entityID.

Only POST binding is supported for the Assertion Consumer Service, which is located at https://<SP Host>/enzi/v0/saml/acs.