UDS Enterprise (Virtual Cable)

This guide integrates a SAML authenticator from UDS Enterprise 3.5 to validate users in Ironchip, so that Ironchip users can access UDS Enterprise services.

Requirements

• Access to the Ironchip admin console with a user that has administration permissions.
• An account with permissions to configure UDS Enterprise.
• Users registered on both platforms.

Configure Ironchip

Create the SAML application

1. In the Ironchip admin console, select SAML apps.

   

2. Register a new custom SAML application.

   

3. In the configuration wizard, enter a name to identify the application and select the SAML integration type.

   

4. Download the metadata that Ironchip generates. You need it in UDS Enterprise. Leave this window open and continue with the next step.

   

Configure UDS Enterprise

Create the SAML authenticator

1. In the UDS Enterprise administration, go to Authenticators, select New, and choose SAML Authenticator.

   

2. On the Main tab, enter a name for the authenticator (it cannot contain spaces), the priority, and a Label.

   

3. On the Certificates tab, enter a valid certificate and its key. They must be in PEM format.

   

Generate a certificate with OpenSSL

If you do not have certificates, you can generate one with OpenSSL. The UDS server has OpenSSL installed, so you can use that machine.

1. Generate the certificate and key.

   openssl req -new -newkey rsa:2048 -days 3650 -x509 -nodes -keyout server.key -out server.crt

   

2. Fill in the data the command asks for to generate the certificate.

   

3. Convert the key to RSA format.

   openssl rsa -in server.key -out server_rsa.key

   

4. Copy the contents of the certificate file and the RSA key into UDS.

   

5. Paste the key in Private Key and the certificate in Certificate.

   

Add the Ironchip metadata

1. On the Metadata tab, fill in IDP Metadata with the metadata you downloaded from Ironchip when you registered the custom SAML application. Copy the complete content of the file. Open the file with a suitable editor and never with a browser, because it hides parts of the code.

   

2. Leave Entity ID empty. UDS fills it in automatically when you save the authenticator, based on the URL you use to connect to the UDS Enterprise portal.

3. Save the authenticator. To let you save, enter any data on the Attributes tab. You will return to this section later to apply the final configuration.

4. Edit the authenticator again. There you get the Entity ID data you need to finish configuring the custom SAML application in the Ironchip console.

   

Finish the configuration in Ironchip

1. Return to the Ironchip wizard to create the custom SAML application. It asks for the Metadata URL that UDS Enterprise generated after you saved and re-edited the authenticator.

   

2. Enter the URL and finish the wizard.

3. Give your users access to the application you created. You can add users individually or groups of users.

   

   

   

   

   

Define attributes and groups in UDS Enterprise

1. In the UDS Enterprise administration, select the SAML authenticator you created and edit it.

   

2. In Attributes, enter the correct attributes. They are defined and visible in the Ironchip documentation. By default they are:

   Description	Friendly Name	SAML Name
   User Name	uid	urn:oid:0.9.2342.19200300.100.1.1
   User Email	mail	urn:oid:0.9.2342.19200300.100.1.3
   User given Name	givenName	urn:oid:2.5.4.42
   User common Name	cn	urn:oid:2.5.4.3
   User Groups	eduPersonAffiliation	urn:oid:1.3.6.1.4.1.5923.1.1.1.1

   

   Note

   In UDS Enterprise you can specify several attributes or use regular expressions, for example to define new group membership attributes.

3. Save, and open the authenticator you created in UDS Enterprise.

4. Go to the Groups section and add the groups you need. You have to add them manually, because the automatic search does not apply to this type of authenticator.

   

5. Add all the groups you need. In this example, the groups are the departments the users belong to, because the department membership attribute Ironchip uses is Groups.

   

Verify the integration

1. Access the UDS Enterprise portal through the SAML authenticator you just created.

   

2. When you select the SAML authenticator, UDS Enterprise redirects you to the provider’s page. In this case, the system asks for the email address of the user who will receive a push notification.

   

   

   Note

   The validation mode is the one configured in the provider itself. If you have user validation through MFA, it is used.

3. After you sign in to Ironchip, you are redirected back to the UDS Enterprise services page.

   

   If the group the user belongs to has services assigned, they are displayed and the user can access them.

4. To check which groups a user belongs to, open the authenticator and edit the user.

   

In this example, the user belongs to the UDS Enterprise group and, because that group is registered in the authenticator, the user can access.