CornerStone On Demand (CSOD) allows to use SAML to authenticate users. It works by default with IDP intiated mechanism, but can works with the standard SP initiated cinematic.
To work with LL::NG it requires:
You should have configured LL::NG as an SAML Identity Provider,
Now we will add CSOD as a new SAML Service Provider:
New service provider
.Email
in Options
» Authentication Response
» Default NameID format
Metadata
, and unprotect the field to paste the following value:<md:EntityDescriptor entityID="mycompanyid.csod.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <KeyDescriptor use="signing"> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:X509Data> <ds:X509Certificate> Base64 encoded CSOD certificate </ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </KeyDescriptor> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mycompanyid.csod.com/samldefault.aspx" index="1" /> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat> </SPSSODescriptor> </md:EntityDescriptor>
AssertionConsumerService
markup, parameter Location
) into your CSOD company ID and put the certificate value inside the ds:X509Certificate markup
CSOD needs two things to configure LL::NG as an IDP: * Certificate * SAML assertion
For the certificate, you can build it from the signing private key registered in Manager. Select the key, and export it (button Download this file
):
After choosing the file name (for example lemonldapn-ng-priv.key), download the key on your disk.
Then use openssl to generate an auto-signed certificate:
openssl req -new -key lemonldap-ng-priv.key -out cert.csr openssl x509 -req -days 3650 -in cert.csr -signkey lemonldap-ng-priv.key -out cert.pem
This is quite difficult to have because LL::NG only send SAML assertions when it receives an SAML request, and CSOD will only send an SAML Request when configured.
The only solution is to simulate an SAML Request on LL::NG. It requires to disable signature verification in the CSDO SP configuration.
After that, you can create your own SAML Request:
<AuthnRequest xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="6fe8d616-9210-49ad-ad54-f4482e17c5ba" Version="2.0" IssueInstant="2013-11-26T14:50:00.515738Z" Destination="https://auth.example.com/saml/singleSignOn" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://mycompanyid.csod.com/samldefault.aspx" xmlns="urn:oasis:names:tc:SAML:2.0:protocol" > <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">mycompanyid.csod.com</Issuer> <NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /> <Conditions NotBefore="2013-01-31T23:22:32.515738Z" NotOnOrAfter="2014-01-31T23:27:32.515738Z" xmlns="urn:oasis:names:tc:SAML:2.0:assertion" /> </AuthnRequest>
AssertionConsumerService
markup, parameter Location
) into your CSOD company ID, update all dates and update the URL in Destination
Encode it into base64 and send it to LL::NG as a GET request:
https://auth.example.com/saml/singleSignOn?SAMLRequest=XXXX
With the network tracer of your browser, you can get the POST response and extract the SAML assertion.