Setting up ADFS Configuration

On ADFS side, go to Trust Relationships -> Relying Party Trusts, click on Add Relying Party Trust

• Select Data Source: Enter data about the relying party manually

• Specify Display Name: Exivity

• Choose Profile: AD FS Profile

• Configure Certificate: Leave blank

• Configure URL: Leave blank

• Configure Identifier: https://EXIVITY-URL /v1/auth/saml/metadata

• Configure Multi-factor authentication now?: Choose I do not want to configure multi-factor authentication settings for this relying party trust at this time.

• Choose Issuance Authorization Rules: Permit all users to access this relying party

• Ready to Add trust: --

• Click on Finish.

Right click the newly added trust: Properties

• Go to Endpoints – Add SAML:

  • Endpoint type: SAML Assertion Consumer

  • Binding: POST

  • Trusted URL: https://EXIVITY-URL/v1/auth/saml/acs

• Click on Save.

Right click the newly added trust: Edit Claim Rules

• Go to Issuance Transform Rules – Add Rule

• Choose Rule Type: Send Claims using a Custom Rule

• Configure Claim Rule:

  • Claim Rule Name – Exivity

  • Custom Rule:

  • c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]

    => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");

• Finally, click on Save.

Setting up ADFS in Exivity

First, go to Administration - Settings - Single sign-on and choose the SAML tab:

In a separate browser tab, open the Exivity SAML configuration and fill the following settings:

As the last step, enable Single Sign-On in Exivity by navigating to Administration > Settings and then clicking on the System tab. Make sure the Single Sign-On option is set to Enabled, and click the Update button:

SSO is now configured and enabled, and you can now use ADFS to login to your Exivity instance. The login screen will look something like this:

And by clicking on the Login button, you'll be taken to the ADFS login screen.

Setting up Azure Active Directory is pretty straight-forward, but it helps to know the exact steps to follow, as configuraing SAML can be a bit daunting.

To add Exivity to your Azure AD applications, follow these steps:

• In your Azure portal, go to the Azure Active Directory service:

• In the sidebar, click Enterprise applications:

• Click the New application button:

• Click the Non-gallery application button:

• Enter a name for the new application (i.e. My Exivity instance) and click the Add button.

• Click the Configure single sign-on (required) button:

• From the Single Sign-On Mode dropdown list, select SAML-based Sign-on:

• Now enter the following details on this page:

The resulting page could look something like this:

• Click the Configure [your application name] button:

The Exivity configuration page could look something like this:

• Now unfold the Advanced menu at the bottom of the screen, and paste the following JSON data:

• Then in Exivity, click the Update button

• And in your Azure Portal, click the Save button:

• As the last step, enable Single Sign-On in Exivity by navigating to Administration > Configuration and then clicking on the System tab. Make sure the Single Sign-On option is set to Enabled, and click the Update button:

SSO is now configured and enabled, and you can now use Azure AD to login to your Exivity instance. The login screen will look something like this:

And by clicking on the Login button, you'll be taken to the Azure AD login screen. Exivity will receive the Azure AD e-mail address and create a new user with a minimal set of permissions if no existing user is found.

Exivity can act as a SAML Service Provider (SP) which can be connected to a SAML Identity Provider (IdP). Some configuration is required to setup a secure connection.

SAML configuration

The SAML configuration can be accessed by navigating to Administration > Settings and then clicking on the SAML tab. On this page, you'll find two sub-tabs:

• Configuration: Your IdP endpoints can be entered here, along with details about the certificate used by the IdP.

• Endpoints: When registering Exivity with your IdP, you need to provide these Exivity endpoints.

Configuration

The configuration settings are listed below:

Advanced settings

Using the advanced settings editor, even more options are exposed for configurating the integration. Please note that settings should be entered using a valid JSON format. Please consult with your implementation partner first before editing the advanced settings.

Endpoints

To view the full SAML endpoints for your Exivity instance, navigate to Administration > System and then click on the SAML tab and then the Endpoints sub-tab.

Integration tutorials

External resources

First, we need to add Exivity to your Auth0 applications. Follow these steps:

• On the Auth0 dashboard, click the Applications menu item, and then the Create application button:

• Choose a descriptive name for your application, click the Single Page Web App button, and finally the Create button:

• On the application overview page, click the Settings tab:

• On this page, fill out the following details and click on the Save changes button:

• Click on the SAML2 addon button. On the Settings tab, fill out the following details and click the Save button:

{
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
  ],
  "logout": {
    "callback": "[Exivity Single Logout Service endpoint]"
  },
  "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
}

• Click on the Usage tab.

In a separate browser tab, open the Exivity SAML configuration (see configuration) and copy over the following settings:

• As the last step, enable Single Sign-On in Exivity by navigating to Administration > Settings and then clicking on the System tab. Make sure the Single Sign-On option is set to Enabled, and click the Update button:

SSO is now configured and enabled, and you can now use Auth0 to login to your Exivity instance. The login screen will look something like this:

And by clicking on the Login button, you'll be taken to the Auth0 login screen. Exivity will receive the Auth0 e-mail address and create a new user in the configured user group (see configuration) if no existing user is found.

Setting up LDAP in Exivity

First, go to Administration - Settings - Single sign-on and choose the LDAP tab:

Fill the required Server and Attributes section parameters, and click on UPDATE.

Server section:

Attributes section:

Finally, go to the System tab, in the Core section, set the Single Sign-On parameter to Local and LDAP Authentication and click on UPDATE.

Now you can start login in Exivity using LDAP authentication.

Setting up your security certificate

If you don't have a certificate in .pem format you can convert your current certificate with the OpenSSL tool.

Once you have your pem certificate stored in the server hard drive, take a note of its path, and create a system environmental variable LDAPTLS_CACERT . The value of this environmental variable will be the certificate full path.

Finally, restart the Exivity Web Service.

In order to use OneLogin as an Identity Provider, we need to set up a new application. To do so, navigate to the OneLogin administration, hover over Applications in the navigation bar, and click on Applications:

Click on the Add App button:

In the list of applications, search for "saml" and click on the item SAML Test Connector (IdP w/ attr w/ sign response):

Choose a descriptive name for your application and click the Save button:

Click the Configuration tab:

Refer to the endpoints section in the Single Sign On article how to obtain the endpoints values. Fill in these fields:

Now, we have to copy and paste some values from our OneLogin application into the Exivity instance Single Sign-on settings. In OneLogin, click on the SSO tab:

In a separate browser tab, open the Exivity SAML setting (See SAML configuration) and copy over the following settings:

Now, let's set up the OneLogin certificate in Exivity. Under the label X.509 Certificate, click the View Details link. Copy the X.509 Certificate and paste it in the X-509 certificate field in the Exivity settings.

As the last step, copy and paste this JSON object in the Advanced settings in the Exivity settings:

{
  "security": {
    "wantXMLValidation": false
  }
}

Now you're ready to use OneLogin as a SAML Identity Provider. Enable Single Sign-On in Exivity by navigating to Administration, Settings and then click on the System tab. Make sure the Single Sign-On option is set to an option including SAML2 Authentication:

OneLogin is now configured and enabled, and you can now use it to log in to your Exivity instance. The login screen will look something like this:

And by clicking on the Login button, you'll be taken to the OneLogin login screen. Exivity will receive the users e-mail address and create a new user in the configured user group (see configuration) if no existing user is found.