SAML Single Sign-On into Joomla using IdentityServer4

miniOrange Joomla SAML SP SSO plugin helps you to integrate your Joomla site to IdentityServer4 using SAML 2.0 protocol. Our user-friendly plugin simplifies the process of setting up Single Sign-on (SSO) with IdentityServer4 in Joomla, ensuring a secure login experience. This enables users to access various Joomla sites effortlessly using their IdentityServer4 IDP credentials.

Our plugin is designed to be compatible with Joomla 3, 4 as well as 5 and works seamlessly with all SAML 2.0 compliant Identity Providers. For a detailed overview of the comprehensive features offered by the Joomla SAML SP plugin, please visit our page here. Below, we provide a step-by-step guide on configuring SAML SSO login between your Joomla site and IdentityServer4, with IdentityServer4 serving as the Identity Provider (IDP) and Joomla as the Service Provider (SP).

Pre-requisites: Download And Installation

Download

Handbook

Free Trial

Steps to Integrate IdentityServer4 Single Sign-On (SSO) with Joomla SAML SP

1. Setup Joomla SAML SP plugin

• Download the zip file for the miniOrange SAML SP plugin for Joomla.
• Login into your Joomla site’s Administrator console.
• From left toggle menu, click on System, then under Install section click on Extensions.
• Now click on Or Browse for file button to locate and install the plugin file downloaded earlier.

• Installation of plugin is successful. Now click on Get Started!

• Go to the Service Provider Metadata tab and scroll down to copy the SP-EntityID and the ACS URL.

2. Configure IdentityServer4 as IdP

Note: To add SAML IDP functionality you would require modifications in the Startup.cs file.

• In the ConfigureServices method, your call to AddIdentityServer needs to be updated with the following code:

            
services.AddIdentityServer()

                // the rest of registrations (clients, resources, users, etc)

                  .AddSigningCredential(new X509Certificate2(/*your cert*/))

                  .AddSamlPlugin(options => {
                        options.Licensee = "/*your license key org name*/";

                        options.LicenseKey = "/*your license key*/";

                })

                .AddInMemoryServiceProviders(new List());

• In the configure method, the call to UseIdentityServer needs to be extended with following code:

        
app.UseIdentityServer()

              .UseIdentityServerSamlPlugin();
    

Configure IdentityServer4 as Service Provider

• In the Config.cs file create a Client entry.

            
new Client {

                   ClientId = "http://localhost:5001/saml",

                   ClientName = "RSK SAML2P Test Client",

                   ProtocolType = IdentityServerConstants.ProtocolTypes.Saml2p,

                   AllowedScopes = { "openid", "profile" }
           }
        

ClientId Provide entityID from Service Provider Metadata tab

ClientName Provide Service Provider name

ProtocolType IdentityServerConstants.ProtocolTypes.Saml2p

AllowedScopes openid, profile

• In the Config.cs configure SAML Specifics using Service Provider object.

            
new ServiceProvider {

                   EntityId = "http://localhost:5001/saml",

                   SigningCertificates = {new X509Certificate2("TestClient.cer")},/*Enter the certificate name*/

                   AssertionConsumerServices = { new Service(SamlConstants.BindingTypes.HttpPost, "http://localhost:5001/signin-saml") }

           };

Note: The Client ID and Entity ID must be Equal.

• You would need the following information from the Service Provider Metadata Here.

EntityId Provide Entity-Id from Service Provider Metadata tab

Signing Certificates Download the Certificate from Service Provider Metadata tab of the plugin and enter Certificate name

Assertion Consumer Service URL Provide the required Binding type followed by the ACS URL: Http Post method: SamlConstants.BindingTypes.HttpPost Http Redirect method: SamlConstants.BindingTypes.HttpRedirect ACS URL: Provide ACS URL from Service Provider Metadata Tab

• To configure your Service Provider retrieve IDP Metadata by visiting /saml/metadata URL.
• You will get the endpoints required for the Service Provider configuration.

You have successfully configured IdentityServer4 as SAML IDP ( Identity Provider) for achieving IdentityServer4 SSO login into your joomla Site.