Single Sign-On - Tinkering with Microsoft Active Directory Federation Services, SAML and WebSphere Application Server

A brief bit of context ….

A colleague was asking some questions about WAS and ADFS and SAML, so I wanted to create a basic test environment to get my head around some of the new ( to me ) concepts.

I already had a Windows Server 2012 VM and another Red Hat Enterprise Linux (RHEL) VM.

The latter was already configured / installed with: -

so I was mostly good to go in the WAS/application world.

On the Windows 2012 VM, I installed / configured: -

So I had a wee bit of effort to setup AD and ADFS, and also to configure IIS.

For the record, IIS isn't required for the SAML setup etc. BUT it's a useful way to generate a self-signed certificate, which can be exported, with public AND private key, as a PFX file, ready to be be imported into ADFS.

As ever, this is an ongoing work-in-progress.

Having got the AD and ADFS stuff mainly setup, I then ran through the following: -

Note that I'm installing this into the BAW (BPM) SupCluster, which does NOT run the main BAW workload - Process Server, SCA BPEL etc.

/opt/ibm/WebSphere/AppServer/profiles/Dmgr01/bin/wsadmin.sh -lang jython -username wasadmin -password passw0rd -f /opt/ibm/WebSphere/AppServer/bin/installSamlACS.py install SupCluster

Start WSAdmin Client

/opt/ibm/WebSphere/AppServer/profiles/Dmgr01/bin/wsadmin.sh -lang jython -username wasadmin -password passw0rd

Add SAML TAI

This creates the SAML TAI configuration - we'll populate this further shortly

AdminTask.addSAMLTAISSO('-enable true -acsUrl https://workflow.uk.ibm.com:9445/samlsps/acs')

Save and Sync

AdminConfig.save()
AdminNodeManagement.syncActiveNodes()

Export SP Metadata from WAS

We need this metadata to complete the ADFS configuration

AdminTask.exportSAMLSpMetadata('-spMetadataFileName /home/wasadmin/WASSAMLMetadata.xml -ssoId 1')

Import IdP Metadata into WAS

This is what we previously pulled from the ADFS box

AdminTask.importSAMLIdpMetadata('-idpMetadataFileName /home/wasadmin/FederationMetadata.xml -idpId 1 -ssoId 1 -signingCertAlias idp1')

Save and Sync

AdminConfig.save()
AdminNodeManagement.syncActiveNodes()

Quit

exit

Set TAI Properties

I'm doing this manually, but will script it later

Name:sso_1.sp.acsUrl
Value:https://workflow.uk.ibm.com:9445/samlsps/acs

Name:sso_1.sp.idMap
Value:idAssertion

Name:sso_1.idp_1.EntityID
Value:http://windows2012.uk.ibm.com/adfs/services/trust

Name:sso_1.idp_1.SingleSignOnUrl
Value:https://windows2012.uk.ibm.com/adfs/ls/

Name:sso_1.sp.login.error.page
Value:https://windows2012.uk.ibm.com/adfs/ls/idpinitiatedSignOn.aspx

Name:sso_1.sp.targetUrl
Value:https://workflow.uk.ibm.com:9445/bpc

Name:sso_1.sp.useRealm
Value:defaultWIMFileBasedRealm

Start Clusters

• MECluster
• SupCluster
• AppCluster

Functional Test

Access BPC: -

https://workflow.uk.ibm.com:9445/bpc

Should redirect to: -

https://windows2012.uk.ibm.com/adfs/ls/idpinitiatedSignOn.aspx

and be prompted to log on with AD acount e.g. UK\Administrator

Need to click on Sign-in button again; I don't yet know why this is the case :-(

Should then be redirected to BPC

Repeat for Process Portal: -

https://workflow.uk.ibm.com:9444/ProcessPortal

and Process Center: -

https://workflow.uk.ibm.com:9444/ProcessCenter

Sources

How to setup Microsoft Active Directory Federation Services [AD FS]

Front Side SAML SSO with microsoft product (ADFS -> WAS SAML TAI)

Enabling your system to use the SAML web single sign-on (SSO) feature