Blogs
Armin Cyrus Dahncke
A Minute Read
If you have followed the IdP setup you will find the setup steps very similar.
First we need to setup a keystore, we gonna use the java keytool to create a keystore we can easily use from command line.
It is cruzial to create the key with the name of the SP-entity we want to use in the portal-ext.properties. In this case we will use liferaysamlspdemo
To have the keystore in a directory we can adress from liferay properties we can for ease of use execute the command in the liferay data directory
keytool -genkey -keyalg RSA -alias liferaysamlspdemo -keystore keystore.jks -storepass liferay -validity 360 -keysize 2048
The command line output looks somewhat like
MacBook-Pro:data xxx$ keytool -genkey -keyalg RSA -alias liferaysamlspdemo -keystore keystore.jks -storepass liferay -validity 360 -keysize 2048
What is your first and last name?
[Unknown]: Liferay SAML SP Demo
What is the name of your organizational unit?
[Unknown]: Liferay SAML SP Demo
What is the name of your organization?
[Unknown]: Liferay SAML SP Demo
What is the name of your City or Locality?
[Unknown]: Liferay SAML SP Demo
What is the name of your State or Province?
[Unknown]: Liferay SAML SP Demo
What is the two-letter country code for this unit?
[Unknown]: XX
Is CN=Liferay SAML SP Demo, OU=Liferay SAML SP Demo, O=Liferay SAML SP Demo, L=Liferay SAML SP Demo, ST=Liferay SAML SP Demo, C=XX correct?
[no]: yes
Enter key password for <liferaysamlspdemo>
(RETURN if same as keystore password):
Re-enter new password:
We need to bootstrap the SAML plugin in the portal-ext.properties
##
## SAML
##
# Enable SAML Plugin
saml.enabled=true
# Set the role to sp on the Service Provider side
saml.role=sp
# Set the SAML entity id, it matches the alias we used to setup the keystore
saml.entity.id=liferaysamlspdemo
# The metadata location for Identity Provider
saml.metadata.paths=http://localhost:8080/c/portal/saml/metadata
We also need a refererence to the keystore we setup earlier, therefore we need to add the following to portal-ext.properties
#
# Keystore
#
# keystore type
saml.keystore.type=jks
# location of the keystore
saml.keystore.path=${liferay.home}/data/keystore.jks
# pwd for accessing the keystore
saml.keystore.password=liferay
# pwd for accessing the certificate of the entity in the keystore
saml.keystore.credential.password[liferaysamlspdemo]=liferay
Finally we need to configure the Service Provider itsself there we add the following to portal-ext.properties
#
# Service Provider
#
# Service Provider SAML entity id
saml.sp.default.idp.entity.id=liferaysamlidpdemo
# Set the SAML authentication mandatory
saml.sp.sign.authn.request=true
# disable signatures for the demo
saml.sp.assertion.signature.required=false
# timeout setting for IdP clock deviation in ms
saml.sp.clock.skew=3000
# Session keep alive url
saml.sp.session.keepalive.url=http://localhost:8080/c/portal/saml/idp/keepalive
# Service Provider user attribute mappings
saml.sp.user.attribute.mappings=screenName=screenName\nemailAddress=emailAddress\nfirstName=firstName\nlastName=lastName
After applying these settings we can deploy the SAML-portlet plugin. I deployed first to the IDP and then to the SP.
http://localhost:8080/c/portal/saml/sso?entityId=liferaysamlspdemo
This url will initiate the SAML IdP based login process check out if it works.
njoy
p.s. This is a demo showing of the SAML 2 connection between 2 liferay instances on separate tomcats. Where one tomcat is the IdP on port 8080 and the SP is on a different liferay portal tomcat port 7080.
Related Assets...
No Results Found
More Blog Entries...
Community
Company
Feedback