Prerequisites

 Authentication Only mode:

When you create your  SAML tenant, you can select Authentication Only mode..This is done by checking a checkbox when you configure your SAML tenant.

If Authentication Only is selected, SAML is used only for authentication. Authorization depends on the roles defined in 

.  SAML will authenticate the user but not retrieve any of the attributes.
You may choose to use this mode if you:

• do not want to add

  
   roles to your LDAP.

• LDAP has many roles that have no relevance to your workflow.

• Find the SAML mapping for the other required attributes complex. For example, retrieving the manager user id and role names may require writing custom rules.

In this mode, manual creation of users & roles in the

 tenant is required. The

 CSV upload feature makes this easy.

If Authentication Only is not selected, users will be added (discovery) at runtime when they log in for the first time. It is important to consider the following points before making your decision.

1.  

   • User discovery:

     • There is no guarantee that the first login will occur before a task is created for a specific user /role. If you have workflows, that are routed to users who have not logged in yet, your workflow may not do what you expect. If the user’s role changes after 1st login but before the next task is routed to their new role, the task will not appear on their Task List. For example, a user with the role of employee, logs into 

       . The user then gets prompted to manager. The user will not receive a task routed to the user's new role of manager. workflow is initiated before the user logs out and logs in again and the user account is updated.

     • Manually creating/uploading users and roles ahead of time avoids this situation.

The group names for these three special roles must be frevvo.User, frevvo.TenantAdmin, and frevvo.Designer. Upper/lower case may be a factor for Open LDAP systems. 

Configuring the SAML Security Manager

In the directions given below, the Service Provider refers to frevvo

. The metadata for your

SAML tenant must be obtained first. Customers will need to configure the

metadata when creating the SAML tenant.

1. Generate your certificate (On-premise installations only)

2. Create the frevvo Metadata file.

3. Configure your Identity Provider

4. Create/edit the SAML tenant

5. Manage Users/Roles for your SAML tenant

6. Logging into Live Forms in a SAML Tenant

Step 1 - Generate Your Certificate

Cloud customers can skip this step. These instructions are provided for On-premise customers only.

If you re using the frevvo tomcat bundle, the supplied keystore, frevvoKeystore.jks is located in the <frevvo-home>/tomcat/lib folder, The keystore contains a default certificate with alias=frevvo and password=p@ssw0rd. Replace this  with a certificate for your installation.

• The alias and password can be configured with the properties, com.frevvo.security.saml.key and com.frevvo.security.saml.password in the <frevvo-home>\tomcat\conf\localhost\frevvo.xml file.

This certificate is used to sign/encrypt the SAML request. The use of a long-lived self-signed certificate is recommended.

Since the keystore is located outside the frevvo war, you can use the Java keytool to generate and store your certificates. Folllow these steps:

1. Login as  Administrator.

2. Delete the existing certificate:

   keytool -delete -alias frevvo -keypass p@ssw0rd -keystore frevvoKeystore.jks -storepass p@ssw0rd

3. Generate a new certificate: Here is the command: Change the -dname value to the DNS name of your IDP

   keytool -genkey -dname "cn=app.frevvo.com" -alias frevvo -keypass p@ssw0rd -keystore frevvoKeystore.jks -storepass p@ssw0rd -keyalg rsa -keysize 2048 -validity 3650

4.  The certificate can be viewed (and used in the metadata XML) by exporting it to a file:

   keytool -exportcert -alias frevvo -file frevvo.rfc -rfc -keystore frevvoKeystore.jks -storepass p@ssw0rd

Step 2 - Create the 

Metadata file

Follow these steps to generate the frevvo metadata for your SAML tenant. You can do this even if the tenant has not been created yet.

1. Paste this URL into your browsr:

   1. Cloud Customers: https://app.frevvo.com:443/frevvo/web/saml/metadata/alias/{t} - replace {t} with the tenant id of your SAML tenant.

   2. On-premise customers: http://<server>:<port>/frevvo/web/saml/metadata/alias/{t} - replace <server> with the ip of your server, <port> with the port number (if applicable) and t with your tenant id).
      
      

2. When the metadata displays, right click and select the browser option to View the Page source.
   
   

   
   
   

3. Save the page as an xml file.
   
   

4. Metadata must be generated for each SAML tenant. Each tenant will have a unique URL.

Step 3 - Configure Your Identity Provider

1. Configure the Service Provider metadata for your Identity Provider. For example, the Shiboleth Identity provider requires modification of a file to provide the path to the

   tenant metadata xml file created above.

2. Your Identity Provider must be configured to expose the attributes that

   requires. Attribute mapping is done when you create the SAML tenant. These are:

   1. User Id

   2. First Name

   3. Last Name

   4. Email

   5. Manager Id (optional)

   6. Groups

   7. Custom Attributes (optional)

We know that your IDP software of choice is outside of the frevvo server software and that you have the expertise in house to install, configure and maintain your IDP software. But here are some tips we have found that may assist you.