SAML configuration in AEM

<md:EntityDescriptorxmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"entityID="http://localhost:4503/">
<md:SPSSODescriptorprotocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat/>
<md:AssertionConsumerServiceBinding ="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"Location="http://localhost:4503/saml_login "index="1" />
</md:SPSSODescriptor>
</md:EntityDescriptor>

1. Above mentioned IdP metadata provides thefollowing information.
   • Service provider entity Id : Everyservice provider needs to be uniquely identified by the IDP. IDPregisters the SP with the Entity Id. Later with the help of thisinformation IDP identifies that the requested SP.
   • Redirect URL of service provider (SP): On authentication, IdP POSTs SAML response to this providedURL. This redirect URL should be written in a specific pattern, URLshould be followed by /saml_login. Eg. of redirect URL ishttp://localhost:4502/saml_login.
2. Configure AEM with the Identificationprovider (IdP) information :
   To communicate through secured channel, IdPcertificate needs to be installed in AEM. You need to perform the following steps to in import certificate.
   For AEM 6.0
   1. Create the folder structure within “etc” in AEM- \/etc\/key\/saml
   2. Certificate upload can be executed through both GUI and curl.
   Using curl command
   curl -u admin:admin -F idp_cert=<path toIdP Cert>\\<idp.cert> -F idp_cert@TypeHint=Binaryhttp://localhost:4503/etc/key/saml
   Using Crx-de
   

   Double click on “idp_cert”, as given in the diagram. Adialog box will appear to browse the certificate.
   
   
   
   

   Browse the certificate then click OK.
   
   
   
   

   For AEM 6.1
   1. Add IdP public cert to AEM truststore
      • Go to: http://localhost:4502/libs/granite/security/content/useradmin.html
      • Select any user because TrustStore is global to AEM
      • Create trust store by supplying the password & then manage trust store
      • Upload the IdP certificate & make note of the certificate Alias
   2. Add SP key and certificate chain to AEM keystore (authentication-service)
      • Go to: http://localhost:4502/libs/granite/security/content/useradmin.html
      • Select authentication-service
      • Create KeyStore by supplying the password
      • If encrypting SAML assertions then go to manage KeyStore for uploading the private & public key
   3. Configure the SAML authentication handler in the web console
      • Go to: http://localhost:4502/system/console/configMgr
      • Search for Adobe Granite SAML 2.0 Authentication Handler
      • Add a new handler configuration and alias here should match with step1.
3. Configure Adobe Granite SAML 2.0 authentication handler
   SAML can be configured through Felix console but it is advisable to configure through runmodes, so that reconfiguration is not required for different environment.

   SAML Configuration attributes :

   • Path :- Path where authentication handler to be applied.
   • Path :- Path where authentication handler to be applied.
   • IDP-Url : - IDP url where authentication request should be redirected.
   • Service provider entity id :- This is the same Id which is shared with the IdP for the uniquely identification of service provider e.g. https://www.example.com.
   • Default redirect: - URL where IdP should be redirected after This is useful if autocreate of the user is enabled. It gets the user from SAML attributes and if user does not exist then user gets created.
   • User Id:- URL where IdP should be redirected after successful login.
   • Group membership:- Name of the group to which user should belong to. Group should be available as a part of SAML attribute.
   • Synchronized attributes:- List of attributes should be synchronized with the attributes available in SAML response.
   • Logout URL:- Logout Url of the IdP, where logout request should be redirected from SP./li>

4. Configure Apache sling referrer filter
   As we know that on successful authentication IdP redirects to the SP and posts SAML response. So, IdP URL must be added as Sling referrer. In absence of it you may encounter with the (403 Forbidden error).
   As we know that on successful authentication IdP redirects to the SP and posts SAML response. So, IdP URL must be added as Sling referrer. In absence of it you may encounter with the (403 Forbidden error).

5. SAML debnuging
   Saml log is important to identify how it is doing at the AEM end. SAML Trace FF plugin:- As we know that SAML is browser driven not the server, so it becomes very important to trace at client end. It can also help to trace SAML request and response.
   If users are not yet synchronize with IdP, and you are expecting that the user should be created with SAML response as AEM is already configured. So, in this case you must check the SAML response and verify that the SAML response must have user attributes.
7.