# UDS Enterprise (Virtual Cable)

> Integrate Ironchip with UDS Enterprise 3.5 through a SAML authenticator: create the application, configure the authenticator, define attributes and groups.

URL: https://docs.ironchip.com/en/identidad/integraciones/puestos/uds-enterprise/

This guide integrates a [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/) authenticator from UDS Enterprise 3.5 to validate users in Ironchip, so that Ironchip users can access UDS Enterprise services.

## Requirements

- Access to the Ironchip admin console with a user that has administration permissions.
- An account with permissions to configure UDS Enterprise.
- Users registered on both platforms.

## Configure Ironchip

### Create the SAML application

1. In the Ironchip admin console, select **SAML apps**.

   [Image: SAML apps section of the console]

2. Register a new custom SAML application.

   [Image: Option to create a custom SAML application]

3. In the configuration wizard, enter a name to identify the application and select the **SAML** integration type.

   [Image: Application name and SAML integration type]

4. Download the metadata that Ironchip generates. You need it in UDS Enterprise. Leave this window open and continue with the next step.

   [Image: Download of the metadata generated by Ironchip]

## Configure UDS Enterprise

### Create the SAML authenticator

1. In the UDS Enterprise administration, go to **Authenticators**, select **New**, and choose **SAML Authenticator**.

   [Image: Menu to create a SAML authenticator in UDS Enterprise]

2. On the **Main** tab, enter a name for the authenticator (it cannot contain spaces), the priority, and a **Label**.

   [Image: Main tab of the authenticator]

3. On the **Certificates** tab, enter a valid certificate and its key. They must be in PEM format.

   [Image: Certificates tab of the authenticator]

#### Generate a certificate with OpenSSL

If you do not have certificates, you can generate one with OpenSSL. The UDS server has OpenSSL installed, so you can use that machine.

1. Generate the certificate and key.

   ```bash
   openssl req -new -newkey rsa:2048 -days 3650 -x509 -nodes -keyout server.key -out server.crt
   ```

   [Image: Example of certificate generation]

2. Fill in the data the command asks for to generate the certificate.

   [Image: Data requested to generate the certificate]

3. Convert the key to RSA format.

   ```bash
   openssl rsa -in server.key -out server_rsa.key
   ```

   [Image: Key conversion to RSA]

4. Copy the contents of the certificate file and the RSA key into UDS.

   [Image: Contents of the certificate and the RSA key]

5. Paste the key in **Private Key** and the certificate in **Certificate**.

   [Image: Private Key and Certificate fields filled in]

### Add the Ironchip metadata

1. On the **Metadata** tab, fill in **IDP Metadata** with the metadata you downloaded from Ironchip when you registered the custom SAML application. Copy the complete content of the file. Open the file with a suitable editor and never with a browser, because it hides parts of the code.

   [Image: Metadata tab with the IDP Metadata pasted]

2. Leave **Entity ID** empty. UDS fills it in automatically when you save the authenticator, based on the URL you use to connect to the UDS Enterprise portal.
3. Save the authenticator. To let you save, enter any data on the **Attributes** tab. You will return to this section later to apply the final configuration.
4. Edit the authenticator again. There you get the **Entity ID** data you need to finish configuring the custom SAML application in the Ironchip console.

   [Image: Entity ID and metadata data of the saved authenticator]

## Finish the configuration in Ironchip

1. Return to the Ironchip wizard to create the custom SAML application. It asks for the **Metadata URL** that UDS Enterprise generated after you saved and re-edited the authenticator.

   [Image: Metadata URL field in the Ironchip wizard]

2. Enter the URL and finish the wizard.
3. Give your users access to the application you created. You can add users individually or groups of users.

   [Image: Option to give users access to the application]

   [Image: User or group selection]

   [Image: Selected users]

   [Image: Access configuration]

   [Image: Access added to the application]

## Define attributes and groups in UDS Enterprise

1. In the UDS Enterprise administration, select the SAML authenticator you created and edit it.

   [Image: Editing the SAML authenticator]

2. In **Attributes**, enter the correct attributes. They are defined and visible in the Ironchip documentation. By default they are:

   | Description      | Friendly Name          | SAML Name                           |
   | ---------------- | ---------------------- | ----------------------------------- |
   | User Name        | `uid`                  | `urn:oid:0.9.2342.19200300.100.1.1` |
   | User Email       | `mail`                 | `urn:oid:0.9.2342.19200300.100.1.3` |
   | User given Name  | `givenName`            | `urn:oid:2.5.4.42`                  |
   | User common Name | `cn`                   | `urn:oid:2.5.4.3`                   |
   | User Groups      | `eduPersonAffiliation` | `urn:oid:1.3.6.1.4.1.5923.1.1.1.1`  |

   [Image: Attributes tab with the attributes defined]

   :::note
   In UDS Enterprise you can specify several attributes or use regular expressions, for example to define new group membership attributes.
   :::

3. Save, and open the authenticator you created in UDS Enterprise.
4. Go to the **Groups** section and add the groups you need. You have to add them manually, because the automatic search does not apply to this type of authenticator.

   [Image: Groups section of the authenticator]

5. Add all the groups you need. In this example, the groups are the departments the users belong to, because the department membership attribute Ironchip uses is `Groups`.

   [Image: Groups added to the authenticator]

## Verify the integration

1. Access the UDS Enterprise portal through the SAML authenticator you just created.

   [Image: UDS Enterprise portal with the SAML authenticator]

2. When you select the SAML authenticator, UDS Enterprise redirects you to the provider's page. In this case, the system asks for the email address of the user who will receive a push notification.

   [Image: Ironchip sign-in page asking for the email address]

   [Image: Push notification sent to the user]

   :::note
   The validation mode is the one configured in the provider itself. If you have user validation through MFA, it is used.
   :::

3. After you sign in to Ironchip, you are redirected back to the UDS Enterprise services page.

   [Image: UDS Enterprise services page after signing in]

   If the group the user belongs to has services assigned, they are displayed and the user can access them.

4. To check which groups a user belongs to, open the authenticator and edit the user.

   [Image: Editing the user in the authenticator]

In this example, the user belongs to the UDS Enterprise group and, because that group is registered in the authenticator, the user can access.