SAML Single Sign-On (SSO) into Drupal using RSA SecureID as IdP
Overview
The Drupal SAML integration using the miniOrange SAML SP module establishes seamless SSO between RSA SecureID and the Drupal site. The users will be able to log in to the Drupal site using their RSA SecureID credentials. This document will walk you through the steps to configure Single Sign-On - SSO between Drupal as a Service Provider (SP) and RSA SecureID as an Identity Provider (IdP). The module is compatible with Drupal 7, Drupal 8, Drupal 9, and Drupal 10, and Drupal 11.
Installation Steps
- Using Composer
- Using Drush
- Manual Installation
Configuration Steps
Drupal SAML SP Metadata
- Go to Configuration → People → SAML Login Configuration in the Administration menu. (/admin/config/people/miniorange_saml/idp_setup)
- Navigate to the Service Provider Metadata tab, click on the Download XML Metadata button. (This is required to configure RSA SecureID as an Identity Provider).
Setup RSA SecureID as SAML Identity Provider
- Login to the RSA Secure ID as Super Admin.
- In the Administration Console, click Application → Application Catalog.
- Click Create From Template button on the top right corner.
- Next to the SAML Direct, click Select in the Choose Connector Template page. The Add Connector wizard appears.
- Fill the required information in the Basic Information page on the Add Connector
wizard.
Name Name of the application for eg. miniOrange Plugin. Description (Optional) Description for your application. Disabled [a checkbox] (optional) Select this only if you want to make this application unavailable to users. When disabled, the application appears in My Application but does not appear in the RSA application portal. - Click Next Step button.
- In the Connection Profile section upload the previously downloaded metadata file from Drupal. Click on IMport Metadata button.
- Verify the configured URLs and clicks on the Save button on the top right corner of the pop-up window.
- Under the Initiat SAML Workflow section, select SP-Initiated, if you want the SSO should be invoked from Application or select IDP-initiated, if you want the user should log in into RSA first and then access Application from his RSA Dashboard.
- Configure base URL of your Application or you can leave it blank if IDP-initiated is selected.
- Select Binding type: POST and Signed Checked.
- Under the SAML Identity Provider(Issuer), upload the public and private key which will be used to signed SAML Response or you can generate new key pair by clicking on the Generate Cert Bundle button.
- (Optional) Enable checkbox for Include Certificate in Outgoing Assertion.
- In Service Provider window, Assertion Consumer Service URL and Audience URL should be preconfigured if you have uploaded plugin’s metadata in the Connection Profile section. If not, you can find the required URLs from Service Provider Info tab of the miniOrange SAML plugin and update the URL here.
- In the User Identity, configure NameID information that identifies the user on whose behalf the SAML Assertion is generated.
- In the Attributes Extension, configure additional user information to be sent to the Application in the SAML Response, for example, username, email, display name, groups etc.
- Configure uncommon Formatting SAML Response:
- Sign outgoing Assertion: Assertion within Response.
- Encrypt Assertion (Optional): If checked, you need to load miniOrange module public certificate and you can download it from the Service Provider Info tab of the module.
- Unchecked Send encoded URL in Assertion.
- Checked include issuer NameID format and select NameID Format as Unspecified.
- Save the configuration and move to the next page i.e. User Access page.
- Define application access in the User Access page.
- Configure application display settings for RSA end users like app icon etc and save the settings.
- Now, In the Administration Console, click Application → My Application.
- Find the app that you have configured and click on Edit → Export Metadata. Keep the metadata handy, it will require to configure miniOrange module.
- Click on Publish Changes in the top left corner of the RSA Admin Console to publish this configuration and immediately activate it.
Configure Drupal as SAML Service Provider:
- Navigate to the Service Provider Setup tab of the Drupal site and click on Upload IDP Metadata.
- In the Upload Metadata File field and upload the IdP metadata file that you downloaded from RSA SecureID. Then, click on Upload File button to proceed.
Note: To update Identity Provider Name, follow these steps:
- Under Action, select the Edit.
- Enter RSA SecureID in the Identity Provider Name text field.
- Scroll down and click on the Save Configuration button.
- Click on the Test link to test the connection between Drupal and RSA SecureID.
- On a Test Configuration popup, if you don't have an active session in the RSA SecureID on the same browser, you will be asked to sign in to RSA SecureID. After successfully login into RSA SecureID, you will be provided with a list of attributes that are received from the RSA SecureID. Click on Done
Congratulations! you have successfully configure RSA SecureID as SAML Identity Provider (IdP) and Drupal as SAML Service Provider.
How does SAML SSO login work?
- Open a new browser/private window and navigate to the Drupal site login page.
- Click the Login using Identity Provider (RSA SecureID) link.
- You will be redirected to the RSA SecureID login page. Enter the RSA SecureID credentials. After successful authentication, the user will be redirected back to the Drupal site.
Why choose us:
Contact us
[MO_CONTACT_US]
