The ADFS Connector provides a way for Maverics to interact with an ADFS deployment. The Connector uses SAML to authenticate users and perform session validation.
Configuration options
The following values can be provided to the ADFS Connector via the Maverics configuration file.
Metadata URL
samlMetadataURL is the metadata URL from the application configured in the SAML provider. The samlMetadataURL setting will accept a file:/// URI if the metadata file is saved on a filesystem accessible to the Orchestrator user.
Consumer Service URL
samlConsumerServiceURL is the URL that the SAML provider will use to POST the SAML response back to. The Maverics SAML ACS handler will be served on this URL, as such it should not conflict with the path of any application resources. The samlConsumerServiceURL path can be arbitrary (e.g. /maverics-saml or /saml-handler), but must match the provider's configuration for the specified samlEntityID.
Logout Callback URL
samlLogoutCallbackURL is an optional field used to define the URL to which the SAML provider will call back once logout is successful. This will initialize an endpoint on Maverics to listen for the callback. The URL's domain must match the domain Maverics is on. The samlLogoutCallbackURL path can be arbitrary (e.g. /logout-maverics-saml or /logout-saml-handler), but must match the provider's configuration for the specified samlEntityID.
Entity ID
samlEntityID is the unique application entity ID assigned to the application.
SP Cert Path
samlSPCertPath is an optional configuration to the path to the certificate that will be used to sign SAML authentication requests. Must be used with samlSPKeyPath.
SP Key path
samlSPKeyPath is an optional configuration to the path to the private key that will be used to sign SAML authentication requests. Must be used with samlSPCertPath.
IDP-Initiated Login
samlIDPInitiatedLogin is an optional field used to define the IDP-initiated login settings.
Enabled
enabled defines whether the connector will accept unsolicited SAML responses from the configured IDP. IDP-initiated login is disabled by default as it is inherently less secure than the alternative SP-initiated flow.
Allowed Redirect URLs
allowedRedirectURLs are the set of URLs that the connector can redirect to after processing an IDP-initiated SAML response. The IDP must pass one of the listed URLs via the relay state when it initiates a login. For more info on why a set of URLs are required, please see the OWASP guide on IdP Initiated SSO and the importance of mitigating the Open Redirect attack.
Cache
cache is an optional field that defines the cache settings for the connector. If left undefined, the connector will use the default in-memory cache.
Cache is currently only supported for SAML connectors.
Health Check
healthCheck defines an optional health check for the connector. This option is required when using the connector in an IDP-continuity scenario. For more info on how to define the health check, please see the docs.
Examples
Basic Configuration
connectors:
- name: adfs
type: adfs
samlEntityID: MavericsOrchestrator
samlMetadataURL: https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml
samlConsumerServiceURL: https://orchestrator.example.com/acs
samlLogoutCallbackURL: https://orchestrator.example.com/logout
samlSPCertPath: /etc/maverics/certs/example-sp.crt
samlSPKeyPath: /etc/maverics/certs/example-sp.key
samlIDPInitiatedLogin:
enabled: true
allowedRedirectURLs:
- https://alpha-app.example.com/dashboard
- https://beta-app.example.com/index.html
cache: redis
Configuration with local SAML metadata file
This sample assumes the SAML metadata was downloaded and saved in /etc/maverics/samlmetadata.xml.
connectors:
- name: adfs
type: adfs
samlEntityID: MavericsOrchestrator
samlMetadataURL: file:///etc/maverics/samlmetadata.xml
samlConsumerServiceURL: https://orchestrator.example.com/acs
samlLogoutCallbackURL: https://orchestrator.example.com/logout
samlSPCertPath: /etc/maverics/certs/example-sp.crt
samlSPKeyPath: /etc/maverics/certs/example-sp.key