helpcenter/Web/Controls/Help/Server/ControlPanel/SSODescription/SSODescription.ascx

<%@ Control Language="C#" Inherits="BaseContentUserControls" %>
<%@ Register Namespace="TeamLab.Controls" Assembly="__Code" TagPrefix="cc" %>

<script runat="server">
    protected override void Init()
    {
        PageTitle = PageCaption = "ONLYOFFICE Single Sign-on overview";
        MetaKeyWords = "Control Panel, SSO, Single sign-on";
        MetaDescription = "Learn how to use ONLYOFFICE Single Sign-on overview.";
    }
</script>
<div class="main_buscall_container dataBackup">
    <div class="MainHelpCenter">
        <h1 class="subHeaderFeaturesCaption TipsCaption">ONLYOFFICE Single Sign-on overview</h1>
    <cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/VariousControls/Versions/ControlPanel/ControlPanel_Current.ascx" />
        <div class="keyword_block">
            <ul>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/server-version/server-version.ascx" /></li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/local-server/local-server.ascx" /></li>
                <li>
                    <span class="enterprise_display">
                        <cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/enterprise-edition/enterprise-edition.ascx" />
                    </span>
                </li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/control-panel/control-panel.ascx" /></li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/sso/sso.ascx" /></li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/shibboleth/shibboleth.ascx" /></li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/onelogin/onelogin.ascx" /></li>
                <li><cc:LocalizeContent runat="Server" ControlName="~/Controls/Help/Tags/adfs/adfs.ascx" /></li>
            </ul>
        </div>
        <h2 id="Introduction">Introduction</h2>
        <p>The <b>Single Sign-on</b> feature provided by the <b>Control Panel</b> allows you to enable third-party authentication using the installed SSO services  (<a target="_blank" href="https://shibboleth.net/">Shibboleth</a>, <a target="_blank" href="https://www.onelogin.com/">OneLogin</a>, or <a target="_blank" href="https://en.wikipedia.org/wiki/Active_Directory_Federation_Services">Active Directory Federation Services</a>).</p>
        <p>Generally, the <b>Single Sign-on</b> technology allows users to sign in only once and then get access to multiple applications/services without re-authentication. E.g. if a web portal includes several large independent sections (forum, chat, blogs etc.), a user can undergo the authentication procedure within one of the services and automatically get access to all other services without entering credentials several times.</p>
        <p>SSO is always ensured by the joint operation of two applications: an Identity Provider and a Service Provider (hereinafter referred to as "IdP" and "SP").</p>
        <p>ONLYOFFICE SSO implements the SP only. A lot of different providers can act as an IdP, but ONLYOFFICE has been tested with the following services only: Shibboleth, OneLogin and AD FS.</p>
        <p>Using SSO authentication you get the following main benefits:</p>
        <ul>
            <li><b>Increased convenience</b>. Users obtain a more quick and easy way to access the portal without the necessity to memorize multiple passwords and logins.</li>
            <li><b>Enhanced security</b>. ONLYOFFICE does not store user passwords in any form, instead of that it uses the results of the authentication on the Identity Provider side.</li>
            <li><b>Easy administration</b>. All the necessary user information is transmitted through an authentication token. If the user information changes on the Identity Provider side, it will be automatically updated on the portal during the next SSO authentication. If a user profile does not exist on the portal, it will be created automatically when the user signs in to the portal using the SSO credentials for the first time.</li>
        </ul>        
        <p>In ONLYOFFICE, SSO authentication is implemented on the base of the secure and commonly used SAML standard. <b>SAML</b> (Security Assertion Markup Language) is an XML standard that allows to transmit user authentication/authorization data between an Identity Provider and a Service Provider through security tokens which contain assertions.</p>
        <p>This article describes the process of enabling SSO in general. If you search for specific settings/examples for certain IdPs, please refer to our articles on how to configure ONLYOFFICE SP and <a href="<%=VirtualPathUtility.ToAbsolute("~/server/controlpanel/enterprise/configure-shibboleth.aspx")%>">Shibboleth</a>, <a href="<%=VirtualPathUtility.ToAbsolute("~/server/controlpanel/enterprise/configure-onelogin.aspx")%>">OneLogin</a>, or <a href="<%=VirtualPathUtility.ToAbsolute("~/server/controlpanel/enterprise/configure-adfs.aspx")%>">AD FS</a> IdPs.</p>
        <h2 id="EnablingSSO">Enabling SSO</h2>
        <p>To enable and configure SSO authentication for your portal, you need to perform the following two main steps:</p>
        <ol>
            <li>Register your Identity Provider at the ONLYOFFICE <b>Control Panel</b> -> <b>SSO</b> page. The information you should specify can be found in your Identity Provider account.
                <div class="notehelp enterprise_display">If you want to use SSO when connecting <b>ONLYOFFICE Desktop Editors</b> to your <b><%= ((BasePage)Page).EditionVersion %></b>, disable <b>Private Rooms</b> in the <b>Control Panel</b>.</div>
            </li>
            <li>Register ONLYOFFICE as a trusted Service Provider in your Identity Provider account. This procedure differs depending on the selected Identity Provider.</li>
        </ol>
        <div class="notehelp">Each portal can only be integrated with one Identity Provider at the same time.</div>
        <h2 id="RegisterIdP">Registering your Identity Provider in the ONLYOFFICE Service Provider</h2>
        <p>To register your IdP in ONLYOFFICE SP, use the <b>ONLYOFFICE SP Settings</b> section of the <b>SSO</b> page.</p>
        <ol>
            <li>On your ONLYOFFICE portal, go to the <b>Control Panel</b> and open the <b>SSO</b> page in the <b>PORTAL SETTINGS</b> section on the left sidebar.</li>
            <li>Click the <b>Enable Single Sign-on Authentication</b> switcher.</li>
            <li>Fill in the required fields in the <b>ONLYOFFICE SP Settings</b> section. The necessary information can be specified in several different ways:
                <ul>
                    <li><b>Enter the URL address to the metadata file</b>. If your IdP metadata is accessible from outside by the link, insert the link into the <b>URL to IdP Metadata XML</b> field and click the <b>Load data</b> button. When the data is loaded, all the required parameters will be automatically displayed in the extended form.</li>
                    <li><b>Upload the metadata file</b>. If your IdP provides a metadata file, use the <b>Select file</b> button to browse for the file stored on your local machine. When the file is uploaded, all the required parameters will be automatically displayed in the extended form.</li>
                    <li><b>Specify the required parameters manually</b>. If the metadata file is not available, enter the necessary parameters manually. To obtain the necessary values, please contact your IdP administrator.</li>
                </ul>
            </li>
        </ol>
        <p>The following parameters are available:</p>
        <ul>
            <li><b>IdP Entity Id</b>  (obligatory field) - the Identity Provider identifier or URL address which will be used by the Service Provider to unequivocally identify the IdP.
                <div class="example">https://example.com/idp/shibboleth</div>
                <p>where example.com is your SSO service domain name</p>
            </li>
            <li><b>IdP Single Sign-On Endpoint URL</b>  (obligatory field) - the URL used for the single sign-on on the Identity Provider side. It is the endpoint address in your IdP to which SP sends authentication requests.
                <p>Set the necessary <b>Binding</b> type selecting one of the corresponding radio buttons. Bindings specify the way in which authentication requests and responses are transmitted between the IdP and SP over the underlying transport protocol: using the HTTP <b>POST</b> or HTTP <b>Redirect</b> binding.</p>
            </li>
            <li><b>IdP Single Logout Endpoint URL</b> - the URL used for the single logout on the Service provider side. It is the endpoint address in your IdP to which SP sends logout requests/responses.
                <p>Set the necessary <b>Binding</b> type selecting one of the corresponding radio buttons. Bindings specify the way in which logout requests and responses are transmitted between the IdP and SP over the underlying transport protocol: using the HTTP <b>POST</b> or HTTP <b>Redirect</b> binding.</p>
            </li>
            <li><b>NameId Format</b> - the <b>NameID</b> parameter allows SP to identify a user. Select one of the available formats from the list.</li>
        </ul>
        <div class="notehelp">It's possible to customize the button used to login to the portal with the Single Sign-on service at the ONLYOFFICE authentication page. You can do it using the <b>Custom login button caption</b> field in the <b>ONLYOFFICE SP Settings</b> section.</div>
        <p>You can also add the IdP and SP certificates.</p>
        <h5>IdP Public Certificates</h5>
        <p><b>IdP Public Certificates</b> - this section allows you to add the Identity Provider public certificates used by the SP to verify the requests and responses from the IdP.</p>
        <p>If you have loaded the IdP metadata, these certificates will be added to the <b>Control Panel</b> automatically. Otherwise, the certificates can be found in your IdP account. To add a certificate manually, click the <b>Add certificate</b> button. The <b>New Certificate</b> window opens. Enter the certificate in the <b>Public Certificate</b> field and click the <b>OK</b> button.</p>
        <p>Set additional parameters for certificates checking the corresponding boxes.</p>
        <p>Specify which signatures of requests/responses sent from IdP to SP should be verified:</p>
        <ul>
            <li><b>Verify Authentication Response Signature</b> - to verify signatures of the SAML authentication responses sent to SP.</li>
            <li><b>Verify Logout Request Signature</b> - to verify signatures of the SAML logout requests sent to SP.</li>
            <li><b>Verify Logout Response Signature</b> - to verify signatures of the SAML logout responses sent to SP.</li>
        </ul>
        <p>Select the necessary algorithm from the <b>Default Signature Verification Algorithm</b> list: <code>rsa-sha1</code>, <code>rsa-sha256</code> or <code>rsa-sha512</code>.</p>
        <div class="notehelp">Default settings are used only in cases if the IdP metadata does not specify which algorithm should be used.</div>
        <p>You can edit or delete the added certificates using the corresponding link.</p>
        <h5>SP Certificates</h5>
        <p><b>SP Certificates</b> - this section allows you to add the Service Provider certificates used to sign and encrypt the requests and responses from the SP.</p>
        <p>If your IdP requires that input data is signed and/or encrypted, create or add corresponding certificates in this section.</p>
        <p>Click the <b>Add certificate</b> button. The <b>New Certificate</b> window opens. You can generate a self-signed certificate or add an existing certificate in the <b>Public Certificate</b> field and the corresponding private key in the <b>Private Key</b> field. In the <b>Use for</b> list, select one of the available options: <code>signing</code>, <code>encrypt</code>, <code>signing and encrypt</code>. When ready, click the <b>OK</b> button.</p>
        <p>Depending on the certificate purpose selected in the <b>Use for</b> list when uploading/generating the certificate, the certificate additional parameters are specified. The following parameters define which requests/responses sent from SP to IdP should be signed:</p>
        <ul>
            <li><b>Sign Authentication Requests</b> - to have SP sign the SAML authentication requests sent to IdP.</li>
            <li><b>Sign Logout Requests</b> - to have SP sign the SAML logout requests sent to IdP.</li>
            <li><b>Sign Logout Responses</b> - to have SP sign the SAML logout responses sent to IdP.</li>
        </ul>
        <p>If you have selected the <code>encrypt</code> or <code>signing and encrypt</code> option in the <b>Use for</b> list, the <b>Decrypt Assertions</b> parameter is also checked. The decryption is performed using the corresponding <b>Private Key</b>.</p>
        <p>Select the necessary algorithms from the lists:</p>
        <ul>
            <li><b>Signing Algorithm</b>: <code>rsa-sha1</code>, <code>rsa-sha256</code> or <code>rsa-sha512</code>.</li>
            <li><b>Default Decryption Algorithm</b>: <code>aes128-cbc</code>, <code>aes256-cbc</code> or <code>tripledes-cbc</code>.</li>
        </ul>
        <p>You can edit or delete the added certificates using the corresponding link.</p>
        <h5>Attribute Mapping</h5>
        <p><b>Attribute Mapping</b> - this section allows you to set the correspondence of the fields in the ONLYOFFICE <b>People</b> module to the user attributes which will be returned from the IdP. When a user signs in to the ONLYOFFICE SP using the SSO credentials, ONLYOFFICE SP receives the required attributes and populates the full name and email address fields in the user account with the values received from the IdP. If the user does not exist in the People module, it will be created automatically. If the user information has been changed on the IdP side, it will be updated in SP as well.</p>
        <p>The available attributes are:</p>
        <ul>
            <li><b>First Name</b> (obligatory field) - an attribute in a user record that corresponds to the user's first name.</li>
            <li><b>Last Name</b> (obligatory field) - an attribute in a user record that corresponds to the user's second name.</li>
            <li><b>Email</b> (obligatory field) - an attribute in a user record that corresponds to the user's email address.</li>
            <li><b>Location</b> - an attribute in a user record that corresponds to the user's location.</li>
            <li><b>Title</b> - an attribute in a user record that corresponds to the user's title.</li>
            <li><b>Phone</b> - an attribute in a user record that corresponds to the user's phone number.</li>
        </ul>
        <h5>Advanced Settings</h5>
        <p>The <b>Hide auth page</b> option allows you to hide default authentication page and automatically redirect to SSO service.</p>
        <p>When all the settings are specified in the <b>Control Panel</b>, click the <b>Save</b> button. The <b>ONLYOFFICE SP Metadata</b> section will open.</p>
        <h2 id="RegisterSP">Registering ONLYOFFICE as a trusted Service Provider in your Identity Provider</h2>
        <p>Now you need to add ONLYOFFICE as a trusted Service Provider in your IdP account specifying the ONLYOFFICE SP metadata in the IdP.</p>
        <p>To receive necessary data, refer to the <b>ONLYOFFICE SP Metadata</b> section of the <b>SSO</b> page. Verify that the SP data is publicly accessible. To do that, click the <b>Download SP Metadata XML</b> button. The XML file contents will be displayed in a new browser tab. Save the data as an XML file to be able to upload it to the IdP.</p>
        <p>Alternatively, you can manually copy separate parameters clicking the <b>Copy to clipboard</b> button in the corresponding fields.</p>
        <p>The following parameters are available:</p>
        <ul>
            <li><b>SP Entity ID</b> (link to metadata XML) - the Service Provider XML URL address which can be downloaded and used by the Identity Provider to unequivocally identify the SP. By default, the file is located at the following address: <span class="param-type">http://example.com/sso/metadata</span> where example.com is your ONLYOFFICE portal domain name or public IP.</li>
            <li><b>SP Assertion Consumer URL</b> (support POST and Redirect binding) - the Service Provider URL address where it receives and processes assertions from the Identity Provider. By default, the following address is used: <span class="param-type">http://example.com/sso/acs</span> where example.com is your ONLYOFFICE portal domain name or public IP.</li>
            <li><b>SP Single Logout URL</b> (support POST and Redirect binding) - the URL used for the single logout on the Identity Provider side. It is the endpoint address in your SP where it receives and processes logout requests/responses from the Identity Provider. By default, the following address is used: <span class="param-type">http://example.com/sso/slo/callback</span> where example.com is your ONLYOFFICE portal domain name or public IP.</li>
        </ul>
        <div class="notehelp">These parameters and XML contents differ depending on you portal configuration, e.g. if you switch your portal to HTTPS or specify a domain name, the parameters will also be changed and you will need to reconfigure your IdP.</div>
        <h2 id="LogIn">Logging in to the ONLYOFFICE SP</h2>
        <p>After the SSO is enabled and configured, the logging in process is performed in the following way:</p>
        <ol>
            <li>A user requests access to ONLYOFFICE by clicking the <b>Single Sign-on</b> button (the caption may differ if you have specified your own text when configuring ONLYOFFICE SP) at the ONLYOFFICE portal Authentication page (SP-initiated SSO).</li>
            <li>If all the IdP and SP settings are set correctly, ONLYOFFICE sends the authentication request to the IdP and redirects the user to the IdP page where he/she is asked for credentials.</li>
            <li>If the user is not already logged in to the IdP, he/she provides credentials in the IdP.</li>
            <li>IdP creates the authentication response that contains user data and sends it to ONLYOFFICE.</li>
            <li>ONLYOFFICE receives the authentication response from the Identity Provider and validates it.</li>
            <li>If the response is validated, ONLYOFFICE allows the user to log in (the user will be created automatically if missing, or the data will be updated if changed in the IdP).</li>
        </ol>
        <p>It's also possible to use the sign-in page on the Identity Provider side (IdP-initiated SSO), enter credentials and then access the ONLYOFFICE portal without re-authentication.</p>
        <h2 id="LogOut">Logging out from the ONLYOFFICE SP</h2>
        <p>Logout can be made using 2 available ways:</p>
        <ol>
            <li>From the ONLYOFFICE portal using the <b>Sign Out</b> menu (in this case the request will be sent from IdP to logout). The user should also be automatically logged out from the IdP in case he/she is logged out from all other applications previously accessed via SSO authentication.</li>
            <li>From the IdP logout page.</li>
        </ol>
        <h2 id="EditUserProfile">Editing user profiles created using SSO</h2>
        <p>The users created using the SSO authentication are marked with the SSO icon in the user list for the portal administrator.</p>
        <p>The possibility to edit such user profiles in the People module is restricted. The user profile fields that have been created using the SSO authentication are disabled for editing from the People module. The user data can be changed on the IdP side only.</p>
    </div>
</div>