SAML 2.0 (Deprecated) | Anjana Data Documentación

Purpose

This guide explains how to configure single sign-on (SSO) with SAML 2.0 in Anjana.

It also describes the optional but recommended configuration for User Provisioning, which allows Anjana to query and list the users with access from your identity provider (IdP).

How it works: two parts of the configuration

This integration has two independent parts configured in parallel:

SAML Authentication (the "Login"): allows a user to log in. It is configured in your IdP (Azure, Google, AWS) and in the security.authentication.saml2 section of Anjana.
User Provisioning (the "User List"): allows Anjana to access your provider's API (with administrator permissions) to get the list of assigned users. It is configured in the security.provisioning section of Anjana.

The provider key (e.g. devazure) links both configurations.

Zeus base configuration

Before configuring your identity provider, define the global properties for the zeus service in Anjana.

1. Global application properties

This property defines the base public URL where zeus is hosted.

YAML

app:
  # The host where the zeus microservice is hosted
  base-url: https://dominio-anjana.com
  # Gateway to the public API of the Zeus microservice
  gateway: /gateway/

2. Security configuration template

In the application.yml file of zeus, we will find two main sections within security:

YAML

security:
  # ===============================================
  # SECTION 1: USER PROVISIONING (OPTIONAL)
  # ===============================================
  provisioning:
    providers:
      # All Azure-type providers must go inside this attribute
      azure-graph:
        # The 'azuread' key is an example. Use a unique name
        # for each provider you configure.
        azuread:
          # ... the API credentials you obtain from your IdP will go here
          # (See the specific guides below)
      # All Google Workspace-type providers must go inside this attribute
      google:
        devgcp:
          # ... the API credentials you obtain from your IdP will go here
          # (See the specific guides below)
      # All AWS IAM IC-type providers must go inside this attribute
      aws-iam-ic:
        devaws:
          # ... the API credentials you obtain from your IdP will go here
          # (See the specific guides below)

  # ===============================================
  # SECTION 2: SAML AUTHENTICATION (LOGIN)
  # ===============================================
  authentication:
    saml2:
      # Base paths for the SAML endpoints.
      # It is recommended not to change these default values, and the {registrationId} part must not be modified because it will be filled in by the application
      # The acs-location-path property must match the one configured in the provider from .../saml2 onward; each specific document has more details
      acs-location-path: /sso/{registrationId}
      authenticate-path: /authenticate/{registrationId}
      providers:
        # The 'azuread' key must be IDENTICAL to the key used in 'provisioning'
        azuread:
          # Provider display name
          name: <name>
          # Identifier of the SAML2 application in the provider
          entityId: <entityID>
          # URL/file path from which the metadata is retrieved to correctly process the authentication
          idpMetadataUri: <URL/Path>

Provider-specific configuration guide

Find below the instructions for your identity provider.

SAML 2.0 - AZURE SAML 2.0 - GCP SAML 2.0 - AWS IAM

Final step: restart

After updating your application.yml with the SAML and provisioning configuration for your providers, restart the Zeus microservice to apply the changes.