This demo shows how to run midPoint container using SAML2 authentication with Shibboleth IdP.

Note that the bundled SAML2 SP is used in this demo, but midPoint supports using standalone SPs (e.g. Shibboleth SP) too. In that case you need to pass username to midPoint in HTTP header and configure httpHeader module instead of SAML2 in flexible authentication. See following page for details: https://wiki.evolveum.com/display/midPoint/Flexible+Authentication+Configuration#FlexibleAuthenticationConfiguration-ModulehttpHeader

Starting

$ cd demo/shibboleth
$ docker-compose up

After docker-compose up command successfully finishes you should see something like this on the console:

midpoint_server_1  | midpoint;midpoint.log;demo;;2018-09-20 16:25:22,191 [] [main] INFO (org.springframework.boot.web.embedded.tomcat.TomcatWebServer): Tomcat started on port(s): 8080 (http) 9090 (http) with context path '/midpoint'
midpoint_server_1  | midpoint;midpoint.log;demo;;2018-09-20 16:25:22,209 [] [main] INFO (com.evolveum.midpoint.web.boot.MidPointSpringApplication): Started MidPointSpringApplication in 60.512 seconds (JVM running for 61.688)

Now you can log into midPoint using https://localhost:8443/midpoint URL. This will redirect you to the Shibboleth login page where you will enter the user name of administrator and a password of password.

After entering that you will get into midPoint.

Containers

The demo/shibboleth composition contains the following containers:

Communication

The containers publish the following TCP ports. (Port mapped to localhost denotes the mapping of container port to the host port where it can be reached from the outside.)

Docker volumes

The following volumes are created to persist data and other relevant files.

Configuring the composition

The following configuration properties are supported. Please refer to the main documentation page for their explanation.

You can tailor these to your needs.

The following Docker secrets are used:

The following configuration files are used:

You can modify or replace these files as needed.

Login without Shibboleth authentication

You can log into midPoint using the usual https://localhost:8443/midpoint/auth/emergency URL that will point you to midPoint login page (instead of Shibboleth one). Then you will use administrator as a user name and 5ecr3t as a password.

Login using bundled SAML2 SP

Midpoint contains bundled SAML2 SP, which can be used instead of Shibboleth SP. To use this SP use https://localhost:8443/midpoint/auth/saml-internal/ URL for accessing midPoint. You will be redirected to the same IdP as it's used in the default settings. Use login "administrator" and password "password" to sign in.

Change authentication to login form

You can change midPoint authentication to internal login form, when you rewrite name of authentication module for sequence admin-gui-default in Default Security Policy. You have to find: 

<sequence>
    <name>admin-gui-default</name>
    <description>
        Default GUI authentication sequence.
    </description>
    <channel>
        <channelId>http://midpoint.evolveum.com/xml/ns/public/model/channels-3#user</channelId>
        <default>true</default>
        <urlSuffix>gui-default</urlSuffix>
    </channel>
    <module>
        <name>mySamlSso</name>
        <order>30</order>
        <necessity>sufficient</necessity>
    </module>
</sequence>

And change <name>mySamlSso</name> to <name>internalLoginForm</name>. After saving of security policy you have to logout. Then you will use administrator as a user name and 5ecr3t as a password to login.

Implementation

Shibboleth authentication is implemented by using Apache httpd as a reverse proxy for midPoint. Clients connect to Apache listening on port 443 (redirected to localhost:8443). It authenticates the requests using Shibboleth SP (if configured to do so) and forwards them to midPoint on port 9090 (AJP).

This mode of authentication makes use of the following auxiliary environment variables within midPoint container (besides the ones mentioned in the documentation):

Notes

The default configuration of Shibboleth provided in this demo is that it authenticates users against LDAP. So, before a user can log into midPoint, he has to have an LDAP account created, with uid matching his name (user.name) in midPoint.

The relevant httpd configuration file for Shibboleth authentication is midpoint.conf.auth.shibboleth.