SSO SAML 2.0

The SAML 2.0 protocol is a federation standard widely used in corporate environments. Anjana Data allows you to configure multiple identity providers (IdP) simultaneously under the security.authentication.saml2 section.

1. Response URL (ACS URL)

For authentication to work, you must correctly register the Assertion Consumer Service (ACS) URL in your Identity Provider. This is the address to which the IdP will send the encrypted/signed SAML response.

The URL is built following this pattern:

https://{dominio-anjana}/gateway/saml2/sso/{registrationId}

• dominio-anjana: Your public domain (e.g.: app.midominio.com).

• registrationId: The exact key you use in the YAML to define the provider.

Example: If you configure a provider with the key azuread in the YAML, the URL to register in Azure will be:

https://app.midominio.com/gateway/saml2/sso/azuread

2. Configuration properties

Each SAML provider is configured under security.authentication.saml2.providers.<registrationId>, where <registrationId> is a unique internal name (e.g.: azuread, okta-corp).

3. Configuration by Provider

Below are the steps to obtain the necessary data and the configuration example for the main providers.

Base YAML structure

security:
  authentication:
    saml2:
      # (Optional) Default base paths. Do not modify unless there is a specific need.
      # acs-location-path: /sso/{registrationId}
      # authenticate-path: /authenticate/{registrationId}
      providers:
        # Specific providers are added here

A. Microsoft Azure AD (Entra ID)

For integrations with Microsoft 365 / Azure Enterprise Applications.

Step 1: Configuration in Azure Portal

1. Go to Enterprise Applications > New application > Create your own application > Integrate any other application you don't find in the gallery (Non-gallery).

2. In Single sign-on (SAML), edit the Basic SAML Configuration:

   • Identifier (Entity ID): Define a unique name, for example: anjana-saml-azure.

   • Reply URL (ACS): https://<dominio-anjana>/gateway/saml2/sso/azuread

3. In SAML Signing Certificates, copy the App Federation Metadata Url.

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        azuread:
          name: Azure Login
          type: AZURE
          entityId: anjana-saml-azure
          idpMetadataUri: https://login.microsoftonline.com/uuid-tenant/federationmetadata/2007-06/federationmetadata.xml

B. Google Workspace

For authentication using corporate Google accounts.

Step 1: Configuration in Google Admin Console

1. Go to Apps > Web and mobile apps > Add app > Add custom SAML app.

2. Identity provider details: Download the IdP metadata file and upload it to your Anjana server (e.g.: /opt/anjana/configs/google-metadata.xml).

3. Service provider details:

   • ACS URL: https://<dominio-anjana>/gateway/saml2/sso/devgcp

   • Entity ID: Define a name, for example: anjana-saml-gcp.

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        devgcp:
          name: Google Workspace
          type: GOOGLE
          entityId: anjana-saml-gcp
          idpMetadataUri: file:/opt/anjana/configs/google-metadata.xml

C. AWS IAM Identity Center

For centralized authentication with AWS SSO.

Step 1: Configuration in AWS Console

1. Go to IAM Identity Center > Applications > Add application > Add custom SAML 2.0 application.

2. IAM Identity Center SAML metadata: Copy the IdP SAML metadata URL.

3. Application metadata:

   • ACS URL: https://<dominio-anjana>/gateway/saml2/sso/devaws

   • SAML Audience (Entity ID): Define a name, for example: anjana-saml-aws.

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        devaws:
          name: AWS Access
          type: AWS
          entityId: anjana-saml-aws
          idpMetadataUri: https://portal.sso.eu-west-1.amazonaws.com/saml/metadata/ExampleID

D. Okta (SAML)

For integrations with Okta using the SAML protocol instead of OIDC.

Step 1: Configuration in Okta Admin

1. Go to Applications > Create App Integration.

2. Select SAML 2.0 and click Next.

3. Configure SAML:

   • Single sign on URL (ACS): https://<dominio-anjana>/gateway/saml2/sso/okta-saml

   • Audience URI (SP Entity ID): Define a unique name, for example: anjana-saml-okta.

4. On the Sign On tab, copy the Metadata URL.

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        okta-saml:
          name: Okta Login
          type: OKTA
          entityId: anjana-saml-okta
          idpMetadataUri: https://dev-123456.okta.com/app/exk1.../sso/saml/metadata

E. Auth0 (SAML)

Auth0 supports SAML through an "Addon" on top of a standard web application.

Step 1: Configuration in Auth0 Dashboard

1. Go to Applications > Create Application > Regular Web App.

2. Once created, go to the Addons tab and enable SAML2 Web App.

3. On the Addon configuration screen (Settings tab):

   • Application Callback URL: https://<dominio-anjana>/gateway/saml2/sso/auth0-saml

   • Settings (JSON): Configure the audience:<code class="language-json">{ "audience": "anjana-saml-auth0" }</code>

4. Go to the Usage tab and copy the Identity Provider Metadata URL.

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        auth0-saml:
          name: Auth0 Login
          type: AUTH0
          entityId: anjana-saml-auth0
          idpMetadataUri: https://mi-tenant.eu.auth0.com/samlp/metadata/abcdef...

F. Keycloak (SAML)

For organizations that use Keycloak as an identity and access server.

Step 1: Configuration in Keycloak Admin Console

1. Access the Keycloak Admin Console and select the corresponding realm.

2. In Clients > Create client:

   • Client type: SAML

   • Client ID: This value will be your entityId. Define a unique name, e.g. anjana-saml-keycloak.

3. On the Settings tab:

   • Valid redirect URIs: https://<dominio-anjana>/gateway/saml2/sso/keycloak-saml

   • Master SAML Processing URL (ACS URL): https://<dominio-anjana>/gateway/saml2/sso/keycloak-saml

4. IdP metadata URL (Keycloak): https://<keycloak-server>/realms/<realm>/protocol/saml/descriptor

Step 2: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        keycloak-saml:
          name: Keycloak Login
          type: KEYCLOAK
          # Must exactly match the Client ID defined in Keycloak
          entityId: anjana-saml-keycloak
          # Keycloak realm metadata URL
          idpMetadataUri: https://sso.mi-dominio.com/realms/mi-realm/protocol/saml/descriptor

G. Generic Provider (ADFS, Shibboleth, others)

Use this configuration for any SAML 2.0-compatible identity provider not included in the list above (for example: Active Directory Federation Services, Shibboleth, PingFederate).

Step 1: Configuration in your Identity Provider (IdP)

In your admin panel, create a new SAML client and configure the following Service Provider (SP) parameters:

• ACS URL (Assertion Consumer Service): https://<dominio-anjana>/gateway/saml2/sso/generic-idp

• Entity ID (Audience / Issuer): Define a unique identifier, for example: anjana-saml-generic.

• NameID Format: It is recommended to configure Persistent or EmailAddress.

Step 2: Obtaining Metadata

Locate the public URL of your IdP's metadata. If the Anjana server does not have access, download the XML and use the path file:/....

Step 3: YAML Configuration

security:
  authentication:
    saml2:
      providers:
        generic-idp:
          name: Login Corporativo
          type: OTHER
          entityId: anjana-saml-generic
          idpMetadataUri: https://sso.mi-empresa.com/metadata.xml