Configure SAML SSO in a single Service Portal instance

The following are instructions on how to configure SAML Single Sign-On (SSO) when Service Portal is deployed in single instance mode.

Prerequisites

Before you proceed, make sure that you have met the following prerequisites:

• An Active Directory domain is configured with a properly configured ADFS server, and you have the administrator account of this domain.

  Note You will need to log in to the ADFS server host as the domain administrator.

• You have determined the IdM SAML Keystore password and certificate passwords, which will be used in the SAML keystore generation and private keys importing step.

• The ADFS host and Service Portal host can ping each other by their fully qualified domain name (FQDN).

• Network Time Protocol (NTP) is configured on the Service Portal server.

  It is important that all servers involved in the SAML SSO setup are synced with a time server (NTP). The ntpd service does not start at boot on RHEL 7, as described here. By default, another NTP service (chronyd) is enabled on RHEL 7 and prevents ntpd from starting at boot.

  The chronyd service can be disabled by running the following command:

  # systemctl disable chronyd.service

  Make sure the ntpd service is set to start at boot by running the following command:

  # systemctl enable ntpd.service

  Check that the ntpd service is running by running the following command:

  # systemctl list-unit-files | grep ntpd

  RedHat defaults to chronyd for NTP services. This service is configured to start at boot and to use port 123. When the ntpd service attempts to start, it fails because port 123 is already in use. You can check the port by running the following command:

  # netstat -tulpn | grep 123

  If the ntpd service is stopped, check the logs by running the following command:

  # cat /var/log/messages | grep ntpd

  You can add NTP logging. To do this, edit /etc/ntp.conf and add the following line:

  logfile /var/log/ntp.log + restart ntpd (systemctl restart ntpd)

  Check the date/time on your server using the following commands:

  # ntpq -p
  # date -R

  If you want to query and synchronize against a pool of your choice, use the ntpdate command, followed by the server or servers IP addresses, as suggested in the following command line example:

  # ntpdate -q <your NTP server IP address>

  You can add an NTP server of your choice to /etc/ntp.conf.

Configuration procedure

The configuration procedure comprises the following steps:

Set up a trust relationship between IdM and ADFS

Create a SAML configuration for your organization

Configure the ADFS SAML token

Adjust the max authentication age setting in IdM