Identity Providers

This view allows adding Identity Providers to the STAGE system. Instead of STAGE validating a user’s identity, STAGE uses one or more external Identity Provider services that provide user authentication for STAGE. In this scenario, STAGE does not store passwords or provide a 2-factor authentication mechanism for these users as this part is externalized by the Identity Provider for them.

STAGE shares information with the Identity Provider. However, there are a number of different Identity Providers that are supported and the way you need to configure the Identity Provider will be different and the way users are stored in a given Identity Provider will also be different from one to the next. In all cases, STAGE uses SAML v2.0 to communicate with the Identity Provider. This is an advanced configuration task that requires an in-depth knowledge of your Identity Provider’s configuration and operation.

At minimum, STAGE always maintains the Admin account which cannot be deleted, so that access to the STAGE configuration remains available at all times. This ensures that should the connection to an identity provider become disrupted, access to configure STAGE configuration remains available, by the STAGE system administrator.

PREREQUISITE: These configuration procedures can only be carried out by an experienced administrator of your Identity Provider service.

Overview

User Management - Identity Provider

The DETAILS section on the right can be expanded/collapsed by clicking on the left or right arrow symbols.

Using the Identity Providers view

Adding an Identity Provider

To add an Identity Provider, you must set the connection details from the Identity Provider, and then provide STAGE’s connection details to the Identity Provider. The procedure below makes reference to Keycloak as an example of an Identity Provider. The Identity Provider you use will be similar, but not the same.

1. Click . See section #Configured-Identity-Providers.

2. Select the SAML 2.0 interface.

3. In the Identity Provider Details section in the Setup tab, enter a Name and an Alias for the identity provider. See section #Identity-Provider-Configuration.

4. Import the SAML 2 connection details using one of the following methods:

   1. From a URL:

      1. Select the Import from URL option to import the Identity Provider’s connection information from a URL supplied by the Identity Provider.

      2. Enter the URL to the Identity Provider’s XML metadata in Metadata URL. This URL comes from the Identity Provider’s configuration. For example, with Keycloak, this is found under Realm settings, Endpoints. Refer to your identity provider’s documentation.

      3. Click .

   2. From an XML file:

      1. From your Identity Provider’s configuration, save the connection metadata as an XML file to your PC. This XML file comes from the Identity Provider’s configuration. For example, with Keycloak, this is found under Realm settings, Endpoints. Refer to your identity provider’s documentation.

      2. Select the Import from XML option to import the Identity Provider’s connection information from an XML file supplied by the Identity Provider.

      3. Click .

      4. Select the XML file on your computer that has the Identity Provider’s connection metadata.

      5. Click .

   3. By manually entering the connection details:

      1. Select the Manual Setup option where you have to configure the Identity Provider’s connection details.

      2. Click .

      3. In the Connection tab, enter the relevant connection information about the Identity Provider in all fields. See section #Connection-Tab.

      4. Click .

5. In the Setup tab, click .

6. In the Setup tab, the Status should become Enabled.

7. Export STAGE’s Identity Provider SAML 2.0 metadata XML file to your PC: Click Export to File in the Setup tab.

8. The Identity Provider needs STAGE’s SAML Metadata to make the connection between STAGE and the Identity Provider complete. In your Identity Provider’s configuration, import a client:

   1. In the Identity Provider’s client list, import a new client.

   2. Browse for STAGE’s SAML 2.0 metadata XML file (resource file).

   3. Click Save.

STAGE is added as a client in your Identity Provider under the name you defined in step #3 above.

9. In your Identity Provider’s configuration for the STAGE connection, add mappers for certain STAGE client properties. For example, in your Identity Provider, you need to add mapping for email, givenName,surname, and username.

   

10. In Keycloak for example, the mapper type to use for username is User Attribute For NameID.

    

11. In the STAGE Identity Provider Management, Property / Group Mapping tab, add the equivalent SAML Attributes as they are defined in your Identity Provider under the SAML Attribute column. In this example, the Identity Provider uses the following attributes: email, givenName, and surname.

    

12. Click Save.

13. In the Setup tab, click Enable. The Status should become Enabled. In Users (see chapter Users), the users from the Identity Provider have been added to the user list and are identified as Identity Provider in the Origin column.

14. Assign these users to Groups or give them Permissions to access STAGE. See chapter Users.

15. Logout of STAGE and then log back in. This new Identity Provider has been added to the login screen under the name you defined in step #3 above, under Or sign in with.

    

16. Click the Identity Provider. You are taken to the Identity Provider’s sign in page where you sign in with your credentials you have previously established with the Identity Provider. See chapter Start & Login.

Mapping Identity Provider Users to a User Group in STAGE

User identities from an Identity Provider can be mapped into STAGE User Groups when Users have already been assigned to one or more groups in the Identity Provider. These user groups are mapped into STAGE User Groups where they have access to STAGE according to the permissions assigned to the User Group.

PREREQUISITE: You must have created one or more User Groups in STAGE. See chapter User Groups. One or more groups in the Identity Provider must have been created. User identities in the Identity Provider should be assigned to one or more groups.

1. In the Setup tab, if the connection status is Enabled, click Disable to break the connection between STAGE and the Identity Provider. This action will cause an outage for users trying to authenticate themselves with the Identity Provider. Only perform this action during off hours.

2. In Group Mapping, click Add.

3. In Group Mapping, select a STAGE User Group in the STAGE Group column.

4. In Attribute, set the name the Identity Provider uses for a group. For example, this is often group or groups.

5. In Attribute Value, set the name of the group used in Identity Provider to map to the selected group in STAGE.

6. Click Save.

7. In the Setup tab, click Enable to re-establish the connection between STAGE and the Identity Provider.

Configured Identity Providers

The table lists all the Identity Providers set up in the STAGE setup.

By clicking on an Identity Provider, Details are displayed on the right-hand side.

Identity Provider Configuration

The Details section on the right-hand side displays full information about the selected identity provider.

• Any changes in this section need to be confirmed by clicking the button.

• Click the button to discard any changes.

• The button removes the selected identity provider after confirmation.

Setup Tab

This section is specific to using SAML 2.0 as identity provider.

Identity Provider Details

Import

This section is visible after clicking on an Identity Provider.

Connection Tab

When you have selected the Manual Setup option in the Setup tab, you must manually add the connection details about the Identity Provider, by entering the values for the fields in this tab. See section #Adding-an-Identity-Provider.

If you have already added an Identity Provider, this tab shows the Identity Provider’s current configuration parameters.

URL

Connection Details

Property / Group Mapping Tab

To manage user group memberships in your SAML system, STAGE needs a way to find out how they are mapped as attributes in a SAML system which are not fixed. As such, you have to map attribute names used in the SAML system for STAGE parameters such as email, first name, and last name.

For every STAGE User Group (as configured in the User Groups tab), you need to provide an attribute and a value under Property Mapping.

STAGE will then check with the SAML system for every user:

• If the attribute exists.

• If the value of the attribute contains the value provided. When true, the user is allowed to be part of the group