...
...
...
...
...
...
...
...
...
...
|
Delegated Authentication Single Sign-On
Centralized authentication is also known as “delegated authentication”.
In this scenario, Kiuwan delegates your authentication to an external system, it’s a matter of trust!!
How this can be accomplished? Take a look at the next image.
In this scenario:
Login to Kiuwan
First, you must
...
...
...
...
...
...
can log in to different independent systems through the use of a single set of credentials, centrally managed in a repository |
In a SAML - SSO scenario, we can define the following actors or participants:
A User requesting for some resource or service
A Service Provider (SP) that receives the request and provides the service or access to the resource
An Identity Provider (IdP) that authenticate the user and asserts the user identity
SSO can be implemented through different protocols, being SAML and OpenId Connect the most widely used.
Kiuwan currently supports SAML and this document serves as a how-to to use Kiuwan in
...
...
...
...
...
...
...
web browser) requests a resource to a Service Provider (SP)
If a valid security context does not exist, the SP redirects the user agent to the Identity Provider’s (IdP) SSO Service
The user agent issues a request to the IdP’s SSO Service to identify the user (if there’s not a previous security context)
IdP validates the request and responds to the user agent
The user agent sends the “authentication” assertion to the SP
The SP processes the assertion and redirects the user agent to the requested resource
The user agent requests SP for the requested resource
Finally, SP returns the resource to the user agent.
SAML 2.0 Metadata
In the Web Browser SSO workflow above, there are some interactions between the IdP and the SP that are based on mutual trust, for example:
How does the SP know the IdP is authentic? And in turn, how does the IdP know the SP is authentic?
How does the SP know where to send the user agent with the auth request? And how does the IdP know where to send the user agent with the auth response?
How does the IdP encrypt the SAML assertion so that the trusted SP (and only the trusted SP) can decrypt the assertion?
How does the service provider know that the auth response is coming from a trusted IdP?
| Info |
|---|
These and other similar “trust” conditions are based on the use of SAML 2.0 Metadata.
Metadata ensures a secure transaction between an IdP and |
...
...
...
...
...
...
...
terminology).
As seen above, to set up a Web SSO environment, SAML agents (idP and SP) need to be identified and let each other know of their existence.
This step is accomplished by exchanging each other’s metadata.
Kiuwan configuration: How to configure your IdP in Kiuwan
| Info |
|---|
Kiuwan provides an administration page to configure your IdP metadata. |
You can find the SSO configuration page at Account Management >> Organization and clicking on Configure SSO button.
Please read carefully the notes:
By activating the SSO in your account, all users of your account will be automatically migrated to your
...
...
...
...
...
at https://<your_idp_domainname>/FederationMetadata/2007-06/FederationMetadata.xml
| Info |
|---|
If your IdP is Azure AD, please be sure to check My IdP is Azure AD. |
Once it’s loaded, click on Continue button
At this moment, you should have received an email with an activation code as well as Domain Id and Login URL. Enter the activation code and click Activate SSO button.
Note: See How to login at Kiuwan in a Web SSO scenario on how to use the
...
...
...
...
...
if your users are using Kiuwan Local Analyzer, DO NOT CHECK THIS OPTION, because all the users will be forced to use SSO. Because KLA still does not fully support SSO, if checked you will need to manually activate user/password auth for all KLA’s users !!
Admin users can ALWAYS login both ways. Other users can be managed individually as using Kiuwan auth or SSO (see User management). |
Example mail with activation code:
| Info |
|---|
After SSO activation, you will get the URL you need to configure Kiuwan as |
...
an SP in your IdP (see section Kiuwan’s metadata configuration in ADFS here ). |
Close the page and .. voilà! Your Kiuwan SSO configuration is done!!
In case you further need to update existing metadata with new IdP metadata just to SSO initial configuration page and Upload a new IdP Metadata.
Click on Save to complete the update
After metadata configuration, you will see the following data into your Kiuwan account.
At Account Management >> Profile you will see :
Domain ID field only appears when your Kiuwan account is configured to use SSO.
- This ID is needed to login to your kiuwan account and it’s shared by all users of a Kiuwan account, but unique for every Kiuwan account.
Username field contains your Kiuwan username and it matches the Claim mapping (Name ID) defined in your IdP when you defined Kiuwan as Service Provider (see image above for ADFS).
Email, Name and Lastname fields are descriptive data about the user.
IdP configuration: How to configure Kiuwan as Service Provider
| Info |
|---|
You must configure your IdP (Identity Provider) so it can recognize Kiuwan as |
...
...
...
...
your sysadmins or product documentation.
Active Directory Federation Services (ADFS) configuration
You can use ADFS’s Add Relying Party Trust wizard
Select Claims aware option and Start.
Then, ADFS will ask you about Kiuwan’s identity metadata.
Ideally, if your ADFS can reach Kiuwan servers, you will select the first option (Import data .. online).
Then you must provide the address that can be found at your Kiuwan website at Account Management >> Organization page (see image below)
In case your ADFS cannot reach the Kiuwan server, you can upload the XML metadata document by selecting Import data .. from a file.
In this case, you must previously download the XML document from the KIuwan URL above. Just paste the URL in a browser that can access the Kiuwan server
...
The next step is to provide a Display name for Kiuwan.
You can choose any name, it doesn’t have to be a domain hostname.
...
The next step is to choose the Access Control Policy that will govern the access rules of your organization’s users to Kiuwan.
After choosing a policy, just confirm (or change) and click Next.
Review the information from the SP (relying party) and click next to finish the SP configuration in ADFS.
Notice that “Configure claims issuance policy ..” is checked.
When checked, you will define how to map/transform your organization’s users to Kiuwan users.
Edit Claim Issuance Policy dialog will pop up:
Clicking on Add Rule will open Add Transform Claim Rule Wizard.
First, you must select the template rule most adequate
...
...
an LDAP attribute
| Info |
|---|
You can select whatever LDAP attribute that it’s unique to every user. In this example, we are using the user’s email address And map that attribute to the Name ID claim type. Do not select any other claim type, Kiuwan will only use Name ID. Doing this way, Kiuwan will store as a username the selected attribute value. |
After finishing, apply changes
How to login at Kiuwan in a Web SSO scenario
| Info |
|---|
...
...
...
...
...
...
...
...
...
URL.
Anyway, once you have successfully accessed Kiuwan for the first time, your browser will store the domain id, so you can just type https://www.kiuwan.com and everything will work.
Then, the Kiuwan SSO Login page will be displayed.
Just click
...
...
and the SSO-SAML protocol will be activated.
- If you were already successfully authenticated, you will log in to Kiuwan.
- If not, you will be redirected to your organizational authentication page. Once authenticated, you will be redirected to the Kiuwan dashboard.
An alternative method to login to Kiuwan is from your IdP.
If you are using ADF, you will find a URL like this:
https://<your_idp_hostname>/adfs/ls/idpInitiatedsignon.htm
Just select the site (the Display Name defined at your IdP), you will be asked for your credentials and will be redirected to the Kiuwan dashboard!!
How to configure Kiuwan clients to work with SSO - SAML
| Info |
|---|
After configuring SSO, |
...
...
log in to the Kiuwan website using the new login URL. But, Kiuwan “clients” (i.e. Kiuwan Local Analyzer, Kiuwan 4 Developers, and any custom program using Kiuwan REST-API) need to be configured to use SSO. |
Kiuwan Local Analyzer (KLA): SSO configuration
| Info |
|---|
Once SSO is configured, it's mandatory to configure KLA with the SSO Domain ID. Otherwise, KLA will stop to work!!
Nevertheless, KLA will still use user/password configuration (a new KLA with SSO authentication will be released shortly). |
In summary, after SSO activation:
Configure KLA with SSO Domain ID
Be sure KLA users are allowed to use username/password authentication
KLA’s SSO Domain ID configuration can be done in three different ways:
First, by using KLA GUI as the image shows:
Also, by modifying the agent.properties file:
set domain.id property to your domain id
Additionally, if you are using KLA CLI you can also specify the domain.id property as a command-line parameter.
Kiuwan for Developers (K4D): SSO configuration
| Info |
|---|
Similarly to KLA SSO configuration, K4D also needs to be configured with the Domain ID Go to |
...
your IDE’s Kiuwan configuration, select Connection Properties >> Single Sign-On section/tab and enter your Domain ID. |
REST-API: SSO configuration
For custom programs using Kiuwan REST-API calls, you have to add a new header (X-KW-CORPORATE-DOMAIN-ID) to indicate the Domain ID to pass the BASIC authentication.
For example:
curl -H "X-KW-CORPORATE-DOMAIN-ID: {domain.id}" -u {username}:{password} https://api.kiuwan.com/info
SSO login vs username-password login
When a Kiuwan account is converted to SSO-enabled, by default, all existing users :
- They must use the new login URL (see How to login at Kiuwan in a Web SSO scenario )
- Previous URL login (https://www.kiuwan.com/saas/web/login.html) will not work
...
...
...
...
...
...
through the User Administration page, enabling Login with password enabled to selected users
| Info |
|---|
Users with privilege "Login with password enabled" can then login to Kiuwan in two ways:
|
Adding a new user in
...
...
an SSO-enabled account, when you create a new user you can decide if that user can access Kiuwan with a password (besides SSO).
Just check Enable login with password option at New User page and, of course, click on Generate password to let him/her know 
...
...
an SP (Service Provider).
In Azure AD, you should create an Enterprise Application (Kiuwan SSO, in this example).
To do it, select Azure Active Directory >> Enterprise applications
and click on New application
Select Non-gallery application and fill in the app name (Kiuwan SSO in our example) and click Add button
Just created, you will see a page like this.
Next, you will need to add users that will be allowed to
...
log in to the Kiuwan SSO application.
Select the users from your Azure Active Directory that will be allowed to
...
log in to the Kiuwan SSO application.
Now that some user has been added, you need to configure the Single sign-on
First, you need to export the Azure Active Directory metadata and import it to Kiuwan.
To export AAD metadata, click on the Download link at Federation Metadata XML.
| Info |
|---|
Downloaded XML file needs to be imported into your Kiuwan account |
...
...
metadata that you will import into AAD. |
To export Kiuwan metadata, go to Account Management >> Organization and you will see the URL to download Kiuwan metadata.
Just type the URL in a browser and save the content as
...
an XML file.
| Info |
|---|
Now, you can import (upload) the Kiuwan metadata XML file into AAD. |
Once uploaded, click
...
Save.
Once done, you need to set your Claims policy. To do it, click on User Attributes & Claims
Select the Name identifier value
and
...
set up the policy on how to manage your ADA usernames to Kiuwan usernames.
In this example, we take the first part of the email.
For example, an AAD user with email john.doe@domain.com will be mapped to john.doe when sent to Kiuwan.
Now, you can test Single Sign-On with the Kiuwan SSO app.
Just click
...
on the Test button.
Select the user (the current or someone else)
Because you are already logged in ADD (and therefore authenticated) you will be forwarded directly to the Kiuwan app.
Login from Kiuwan site
Login from Kiuwan site
...
...
...
...
...
...
...