SSO Configuration : SAML Gen

You can add SummitAI as SAML app from the OKTA Console.

1. Log into OKTA Admin Console. Click Admin. Click Add Applications under Shortcuts menu.
   
   
   Figure: Okta page: Adding SummitAI app
   
   
2. Click Create a new app. The Create a New Application Integration pop-up is displayed. Select the SAML 2.0 option and click Create.
   
   
   Figure: Okta page: SummitAI app integration
   
   
3. Provide the required details under the General Settings and click Next.
   
   
   Figure: Okta page: SummitAI app details
   
   
4. Provide the SAML details under SAML Settings and click Next.
   
   
   Figure: Okta page: SummitAI SAML details

   
   

5. Provide the feedback details under Feedback and click Finish.
   
   
   Figure: Okta page: Feedback

   
   

6. Click View Setup Instructions. Provide the required details.
   
   
   Figure: Okta setup instructions

IfSummitAI is already added as a SAML app, you can modify the details as required.

1. Log into OKTA Admin Console. Click Admin. Click Add Applications under Shortcuts menu.
   
   
   Figure: Okta page: Editing SummitAI app details
   
   
2. Click Apps you created. Select the SummitAI app that you want to update and click Edit.
   
   
   Figure: Okta page: Editing SummitAI app details
   
   
3. Update the required details under the General Settings and click Next.
   
   
   Figure: Okta page: Editing SummitAI app details
   
   
4. Update the SAML details under SAML Settings and click Next.
   
   
   Figure: Okta page: Editing Feedback details
   
   
5. Update the feedback details under Feedback and click Finish.
   
   
   Figure: Okta page: Editing Feedback details
   
   
6. Click View Setup Instructions. Update the required details.
   
   
   Figure: Okta page: Editing setup instructions

You can add the users for whom SSO will be available for the SummitAI SAML app.

1. Log into OKTA Admin Console. Click Admin. Select People from the Directory menu.
   
   
   Figure: Adding People

   
   

2. Click Add Person. The Add Person pop-up is displayed. Provide the details about the user you are adding and click Add Person. If you want to add more users, click Save and Add Another.
   
   
   Figure: Adding People details

   
   

3. The added user needs to be activated so that the user can use SSO from OKTA for SummitAI . Click Activate. A confirmation pop-up page is displayed. Click Activate User.
   
   
   Figure: Activating the added person

   
   

You can add SummitAI as SAML app from the Google Admin Console.

1. Log into Google Admin Console. Click Apps and select SAML Apps.
   
   
   Figure: Google App Settings page

   
   

2. Click the Plus icon to enable SSO for SAML application. Click SETUP MY OWN CUSTOM APP.
   
   
   Figure: Setting up SummitAI as custom app

   
   

3. Provide the SSO URL, Entity ID, and download the certificate. Click NEXT.
   
   
   Figure: Downloading the certificates
   
   
4. Provide basic information about the SummitAI application and click NEXT.
   
   
   Figure: Basic details
   

   
   

5. Provide the Service Provider details and click NEXT.
   
   
   Figure: Service Provider details

   
   

6. Provide mappings between service provider attributes to available user profile fields. You can also come back later to complete the attribute mapping. Click FINISH.
   
   
   Figure: Attribute mapping

IfSummitAI is already added a SAML app, you can modify the details as required.

1. Log into Google Admin Console. Click Apps and select SAML Apps.
   
   
   Figure: Google App Settings page
   
   

2. Select the SummitAI SAML app that you want to update.
   
   
   Figure: Updating SummitAI details
   
   
   Figure: Updating SummitAI details
   
   
3. Click the Service Provide Details and the Attribute Mapping sections to modify details in the respective sections.
   
   
   Figure: Updating Service Provider details
   
   
   
   Figure: Updating Attribute Mapping

You can enable or disable the SummitAI SAMP app configuration for all the users or for selected organizations.

1. Log into Google Admin Console. Click Apps and select SAML Apps.
   
   
   Figure: Google App Settings page
   
   

2. All the configured SAML apps are displayed. Click the three dots next to the SummitAI SAML app that you want to enable or disable for users. Select the appropriate option from the options. The available options are ON for everyone, ON for some organizations, and OFF.
   
   
   Figure: Enabling SummitAI app
   
   Field Descriptions

   Option	Description
   ON for everyone	If selected, the SAML app is available to all the users.
   ON for some organizations	If selected, the SAML app is available to users of the selected organizations
   OFF	If selected, the SAML app is not available to anybody.

You can add the users for whom SSO will be available for the SummitAI SAML app.

1. Log into Google Admin Console and select Users from the left menu.
   
   
   Figure: Adding Users
   
   
2. Mouse hover on the Add icon, the available icons are: Invite users, Add multiple users, and Add user.
   
   
   Figure: Adding Users
   
   
   Figure: Multiple options to add users
   
   

• Invite users: Select this option to invite users to use the SummitAI SAML app as SSO from Google. Specify the e-mail ids of the users to whom you want to send the invitation.
  
  
  Figure: Inviting users
  
  
  Figure: Inviting users
  
  

• Add multiple users: Select this option to add multiple users. You can upload a Microsoft Excel sheet with the names of the users and other details (download the template AS.CSV).
  
  
  Figure: Adding multiple users
  
  

• Add user: Select this option to a user. Provide the first name, last name, and the e-mail id of the user.
  
  
  Figure: Adding single user

1. Login to Ping Federate server.
   
   
   Figure: Ping Federate Login Screen
   
   
2. On the Identity Provider tab, under SP Connections section, click Create New.
   
   
   Figure: Identity Provider tab
   
   

3. On the SP Connection section, configure the tabs as follows:

    Connection Type

   
   Figure: SP Connection _ Connection Type

    Connection Options

   
   Figure: SP Connection _ Connection Options

    Import Metadata

   If you have a Metadata URL or FILE, select the respective options and provide the information. If you do not have an URL or a FILE, Select NONE.

   
   Figure: SP Connection _ Import Metadata

    General Info

   On the General Info tab, specify the PARTNER'S ENTITY ID, CONNECTION NAME, and the BASE URL. Select the LOGGING MODE as STANDARD.

   
   Figure: SP Connection _ General Info

    Browser SSO

   On the Browse SSO tab, click Configure Browse SSO.

   
   Figure: SP Connection _ Browse SSO

    SAML Profiles

   On the SAML Profiles section, select IDP-INITAIATED SSO.

   
   Figure: SAML PROFILES

    Assertion Lifetime

   
   Figure: Assertion Lifetime tab

    Assertion Creation

   On the Assertion Creation tab, click Configure Assertion Creation.

   
   Figure: Configure Assertion

    Protocol Settings

   On the Protocol Settings tab, click Configure Protocol Settings.

   
   Figure: Protocol Settings tab

    Assertion Consumer Service URL

   Select Binding as POST and specify the Endpoint URL as /Summit_SAMLResponse.aspx.

   
   Figure: Assertion Consumer Service URL

    Signature Policy

   Select ALWAYS SIGN THE SAML ASSERTION and click Next.

   
   Figure: Signature Policy

    Encryption Policy

   
   Figure: Encryption Policy

    Summary

   
   Figure: Summary

    Summary

   On the Summary tab, click Done. You will redirected to SP Connection Page.

   
   Figure: Browser SSO _ Summary

    Credentials

   Click Configure Credentials.

   
   Figure: Credentials

    Digital Signature Settings

   Click Manage Certificates and configure Signing Certificate.

   
   Figure: Digital Signature Settings

    Summary

   On the Summary tab, click Done. You will be redirected to SP Connection page.

   
   Figure: Credentials Summary

    Activation & Summary

   Select the Connection Status as Active and click Save.

   
   Figure: SP Connection _ Summary

4. Click Server Configuration and then click Metadata Export under ADMINISTRATIVE FUNCTIONS.

    Metadata Role

   
   Figure: Metadata Role

    Metadata Mode

   
   Figure: Metadata Mode

    Connection Metadata

   Select the configured SP Connection from the drop-down list.

   
   Figure: Connection Metadata

    Metadata Signing

   Select the Signing Certificate from the drop-down list.

   
   Figure: Metadata Signing

    Export & Summary

   On the Export & Summary tab, click Export and then click Done. An XML file is downloaded.

   
   Figure: Export & Summary

   Note:

   • Redirect URL : Select Identity Provider > SP CONNECTIONS. Click the SP Connection that you have configured. The SSO Application Endpoint displayed here is the Redirect URL to be entered in SummitAI Application. 
     
     Figure: Redirect URL - Sample
     
     

   • Upload Certificate : The Certificate is available in the Metadata file, under the tag <ds:X509Certificate>. Copy this data and enter under Upload Certificate section.

SSO Configuration in SummitAI (For Ping Federate)

To configure SSO in the SummitAI application:

1. Select Admin > Basic > Infrastructure > SSO Configuration. The SSO CONFIGURATION page is displayed. Select SAML and click ADD NEW under ACTIONS panel.
   
   
   Figure: SSO Configuration page: Ping Federate
   
   

2. Type in the SSO configuration details. For more information about the fields on the SSO CONFIGURATION page, see Field Description.
3. Click VALIDATE. The certificate information is displayed if the uploaded certificate is valid. For invalid certificate, an error message is displayed.
4. Click SUBMIT. The SSO is configured successfully.

Field Description

The following table describes the fields on the SSO CONFIGURATION page:

1. Login to your ADFS account. On the Start screen, in the Search bar type in ADFS Management. Click ADFS Management.
   
   
   Figure: ADFS Start screen
   
   
2. Under Trust Relationships, click Relying Party Trusts and then click Add Relying Party Trust.
   
   
   Figure: Add Relying Party Trust
   
   
3. On the Welcome tab of Add Relying Party Trust Wizard, click Start.
   
   
   Figure: Welcome tab
   
   
4. On the Select Data Source tab, select Enter data about the relying party manually.
   
   
   Figure: Select Data Source tab
   
   
5. On the Specify Display Name tab, specify a Display name and click Next.
   
   
   Figure: Specify Display Name tab
   
   
6. On the Choose Profile tab, select ADFS Profile and click Next.
   
   
   Figure: Choose Profile tab
   
   
7. On the Configure Certificate tab, click Next.

8. On the Configure URL tab, Select Enable Support for the SAML 2.0 Web SSO Protocol.
   
   
   Figure: Configure URL tab
   
   

   Note:

   For Mobile App Relying party SAML 2.0 SSO service URL should be:

   https://customer.domain.com/SSO/MobileSAMLResponse.aspx

9. On the Configure Identifiers tab, specify a Relying Party trust identifier and click Next.
   
   
   Figure: Configure Identifiers tab
   
   
10. Configure Multi-factor Authentication Now
    
    
    Figure: Configure Multi-factor Authentication Now
    
    
11. Choose Issuance Authorization Rules
    
    
    Figure: Choose Issuance Authorization Rules tab
    
    
12. Ready to Add Trust
    
    
    Figure: Ready to Add Trust tab
    
    
13. Finish
    
    
    Figure: Finish tab
    
    
14. Click Add Rule and Choose Claim Rule as Send LDSP Attributes as Claims on the Edit Claim Rules for ADFSSAML window.
    
    
    Figure: Add Rule
    
    
15. On the Choose Rule Type section, select Claim Rule Template as Send LDAP Attributes as Claims.
    
    
    Figure: Choose Rule Type
    
    

16. Specify the details in Configure Claim Rule tab as shown in the image below and click Finish.
    
    
    Figure: Configure Claim Rule

    Note::

    SummitAI Application uses Email of the user as a login ID. For this to work, you need to set up the Email as the NameID on the SAML login request. This can be achieved by setting up a Transform Rule.

17. Click Add Rule again, choose Transform an Incoming Claim and click Next.
    
    
    Figure: Choose Rule Type tab
    
    

18. Setup Email ID to be sent as NameID as shown below and click Finish.
    
    
    Figure: Configure Claim Rule
    
    
19. On the ADFS Management window, right click on the Relying Party for SummitAI and choose properties. Under the Advanced tab, choose SHA­-256 as the Secure Hash Algorithm.
    
    
    Figure: Secure hash Algorithm
    
    
20. On the ADFS Management Window, choose Services > Certificates and double click Token Signing Certificate, which will give you an option copy to file. By doing this, you will be able to export the X509 certificate from the raw file.
    
    
    Figure: Certificates Section
    
    
21. Select the format as shown below.
    
    
    Figure: Export File Format

SSO Configuration inSummitAI (For ADFS)

To configure SSO in the SummitAI application:

1. Select Admin > Basic > Infrastructure > SSO Configuration. The SSO CONFIGURATION page is displayed. Select SAML and click ADD NEW under ACTIONS panel.
   
   
   Figure: SSO Configuration page: ADFS
   
   
2. Type in the SSO configuration details. For more information about the fields on the SSO CONFIGURATION page, see Field Description.
3. Click VALIDATE. The certificate information is displayed if the uploaded certificate is valid. For invalid certificate, an error message is displayed.
4. Click SUBMIT. The SSO is configured successfully.

Field Description

The following table describes the fields on the SSO CONFIGURATION page: