AnsweredAssumed Answered

aveksa/command.submit?cmd=loginUser with AuthSource=SSO

Question asked by Shlomo Katz on May 22, 2019
Latest reply on Sep 30, 2020 by Jacques Adankon
Branched to a new discussion

Like • Show 1 Like1
Comment • 3

Hello

Environment: 7.1.1 Patch 1

I am trying to get the loginUser token with the above command "https://.....aveksa/command.submit?cmd=loginUser&AuthSource=SSO"

Problem: When using AuthSource, (not using username/password tags) it returns "Error occurred logging user null in with authprovider"

Using <username></username><password></password> without AUTHSOURCE works.

We do use SSO to log in normally, so I know SSO is working generally.

Any ideas?

Mostafa Helmy

May 30, 2019 3:59 PM

Correct Answer

There are two things to take care of when doing SSO SAML logins using the web services:

You need to actually perform a proper SAML authentication call first to your IdP (SSO Server).
- You would do an IdP-initiated login call first to get a SAML Assertion.
- Once you get a valid SAML Assertion, you need to pass it in the body of the login command as a x-www-form-urlencoded.
- For this part, if you do not have a lot of experience with SAML, I would suggest you involve someone from your SSO team as they would know how to do this using your local SAML IdP.

You need to configure an additional relying trust with your IdP to the webservices URL.
- Generally for the UI logins, your IdP would be setup for the URL https://.../aveksa/main
- However the web services URL is different https://.../aveksa/command.submit
- So your SSO team would need to configure a secondary relying trust for the web services URL.

See the reply in context

No one else had this question

Outcomes

Mostafa Helmy

May 30, 2019 3:59 PM

There are two things to take care of when doing SSO SAML logins using the web services:

You need to actually perform a proper SAML authentication call first to your IdP (SSO Server).
- You would do an IdP-initiated login call first to get a SAML Assertion.
- Once you get a valid SAML Assertion, you need to pass it in the body of the login command as a x-www-form-urlencoded.
- For this part, if you do not have a lot of experience with SAML, I would suggest you involve someone from your SSO team as they would know how to do this using your local SAML IdP.

You need to configure an additional relying trust with your IdP to the webservices URL.
- Generally for the UI logins, your IdP would be setup for the URL https://.../aveksa/main
- However the web services URL is different https://.../aveksa/command.submit
- So your SSO team would need to configure a secondary relying trust for the web services URL.

2 people found this helpful

Actions

Jacques Adankon Sep 30, 2020 5:41 AM

Hello Mostafa Helmy,

I'm using RSA IGL 7.1.1 now and I'm struggling with SAML authentication whith Okta. I already got the the SAML assertion from the IDP. Now I need to send it to RSA.
Above you mentioned that we need to "pass it in the body of the login command as a x-www-form-urlencoded". In that case, for that parameter, what should be the name of the 'key' when the value is the SAML assertion?

Actions

Mostafa Helmy

@ Jacques Adankon on Sep 30, 2020 6:00 AM

The key should be SAMLResponse.

1 person found this helpful

Actions

3 Replies

Mostafa Helmy May 30, 2019 3:59 PM
Unmark Correct
Correct Answer
There are two things to take care of when doing SSO SAML logins using the web services:

You need to actually perform a proper SAML authentication call first to your IdP (SSO Server).
You would do an IdP-initiated login call first to get a SAML Assertion.
Once you get a valid SAML Assertion, you need to pass it in the body of the login command as a x-www-form-urlencoded.
For this part, if you do not have a lot of experience with SAML, I would suggest you involve someone from your SSO team as they would know how to do this using your local SAML IdP.

You need to configure an additional relying trust with your IdP to the webservices URL.
Generally for the UI logins, your IdP would be setup for the URL https://.../aveksa/main
However the web services URL is different https://.../aveksa/command.submit
So your SSO team would need to configure a secondary relying trust for the web services URL.
2 people found this helpful
Like • Show 3 Likes3
Actions
Jacques Adankon Sep 30, 2020 5:41 AM
Mark Correct
Correct Answer
Hello Mostafa Helmy,
I'm using RSA IGL 7.1.1 now and I'm struggling with SAML authentication whith Okta. I already got the the SAML assertion from the IDP. Now I need to send it to RSA.
Above you mentioned that we need to "pass it in the body of the login command as a x-www-form-urlencoded". In that case, for that parameter, what should be the name of the 'key' when the value is the SAML assertion?
Like • Show 0 Likes0
Actions
- Mostafa Helmy @ Jacques Adankon on Sep 30, 2020 6:00 AM
  Mark Correct
  Correct Answer
  The key should be SAMLResponse.
  1 person found this helpful
  Like • Show 1 Like1
  Actions

aveksa/command.submit?cmd=loginUser with AuthSource=SSO

Outcomes

Related Content

Recommended Content