Open for Voting

Shibboleth Authentication

Implement and fully support Shibboleth as a documented authentication method.

Many environments, particularly large education institutions, rely on Shibboleth as the sole authentication system.  As more departments and colleges on our campus alone are exploring new help desk software options full Shibboleth support, including documentation, account creation, and attribute synchronization on login, would be a significant selling point.

We were able to implement a workaround using an Apache proxy, Shibboleth login hook and the WHD API to present the users with the federated login page, sync the necessary data with WHD, and then login but it breaks during updates and we had to figure it out without assistance from support.  We haven't tried changing this with the 12.5.x versions but the 12.4 versions did not work when trying to use the SAML 2.0 support within WHD.

kwtobin

  • We got shibboleth to fully work with the built in SAML settings in versions 12.7.x. Below is a general guide:

    1. Sign-in page URL = our-idp-domain/.../SSO

    This sign-in page url may be different, you'd need to ask your IdP what it is for your case.

    2. Verification certificate = This is just the X509 signing certificate that's presented in your IdP's entityID shibboleth page. I took this and pasted it into a .crt file then just folded into base64 via "fold -w 64 idp.plain > idp.crt

    3. The metadata that webhelpdesk presents should be installed by your IdP. The IdP should also override settings for some arbitrary attribute that's presented in SAML. Our IdP chose to send 'uid' into nameid-format:unspecified. Similar to (https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072358/IdPCustomNameIdentifier)

    4. You also need to only use Tomcat, apache is not needed. So create the tomcat keystore and import your domain's ssl certificate into the keystore.

    5. If you're using LDAP to populate clients (Clients > AD / LDAP Connections) you'd need to make sure that that LDAP connection is working. Then you can just pull whatever attribute from AD once the user is logged in.

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.