Configure Single Sign-On with SAML

To enable encrypted assertion for SAML with Moogsoft Onprem, log in to your SAML IdP and enable encrypted assertions. Refer to your IdP's documentation for information.

Once enabled, the IdP encrypts all SAML assertions made with Moogsoft Onprem.

The assertion time limit is the period of time between the IdP providing the SAML assertion and Moogsoft Onprem accepting it.

Moogsoft Onprem accepts a delay of up to one hour by default. You can specify a different period of time in minutes using the maximumAuthenticationLifetime property in the security configuration file for your SAML realm. For example:

"maximumAuthenticationLifetime": 3600

You can enable entity ID assertion, also known as audience restriction, to restrict SAML assertions to Moogsoft Onprem.

To do this, specify the serviceProviderEntityID property in $MOOGSOFT_HOME/config/security.conf. You must also configure this in your IdP. The values must match for successful SAML authorization. For example:

"serviceProviderEntityId": "MySystemName"

When you create your SAML realm, you can configure the attributes your IdP passes to Moogsoft Onprem at SAML authentication.

By default, the IdP email attribute maps to both the Moogsoft Onprem username and email. The Moogsoft Onprem full name maps to First Name and Last Name from the IdP. For example:

"username": "$Email",
"email": "$Email",
"fullname": "$FirstName.$LastName",

You may see errors indicating failure to configure an attribute mapping or the IdP's failure to provide a configured attribute if something goes wrong at login.

You can map other IdP user attributes such contact number, department, primary group and time zone. For example:

"contactNumber": "phone",
"department": "department",
"primaryGroup": "primaryGroup",
"timezone": "timezone",

If you already have users in Moogsoft Onprem, you can map the user attributes to the IdP using the existingUserMappingField property. For example:

"existingUserMappingField": "username",

When a user logs in via the IdP for the first time but does not map to an existing user entry, Moogsoft Onprem creates a new user.

You can define which primary group, roles and teams to assign to users using the following properties in the SAML realm configuration:

For example:

"assignTeams": 
{
    "teamAttribute": "groups",
    "teamMap": 
    {
        "IdP Team": "Networks",
        "Another IdP Team": "Application Support"
    }
}
"assignRoles": 
{
    "roleAttribute": "groups",
    "roleMap": 
    {
        "IdP Standard User": "Operator",
        "IdP Manager User": "Manager"
    }
}

Enable the createNewTeams property to create new teams and assign newly created users to these teams as part of the SAML login process, instead of assigning new users to the default teams.

"createNewTeams": true

Moogsoft recommends that you enable createNewTeams with a custom profile attribute that you specifically use to determine Moogsoft Onprem team membership and contains a very limited set of values.

After you enable SAML, you can configure a different logout page to display when a Moogsoft Onprem user ends their session.

To configure the logout URL:

An example web configuration file is as follows:

"authentication": 
{
    "pages": 
    {
        "login": "/login/",
        "logout": "/logout/",
        "failedLogin": "/login/?error=true",
        "sessionTimeout": "/logout/?error=session",
        "dbFailure": "/login/?error=dbfailure"
    },
    "paramNames": 
    {
        "userId": "userid",
        "password": "password"
    }
}