ADFS

The ADFS Connector provides a way for Maverics to interact with an ADFS deployment. The Connector uses SAML to authenticate users and perform session validation.

Configuration options

The following values can be provided to the ADFS Connector via the Maverics configuration file.

Metadata URL

samlMetadataURL is the metadata URL from the application configured in the SAML provider. The samlMetadataURL setting will accept a file:/// URI if the metadata file is saved on a filesystem accessible to the Orchestrator user.

Consumer Service URL

samlConsumerServiceURL is the URL that the SAML provider will use to POST the SAML response back to. The Maverics SAML ACS handler will be served on this URL, as such it should not conflict with the path of any application resources. The samlConsumerServiceURL path can be arbitrary (e.g. /maverics-saml or /saml-handler), but must match the provider’s configuration for the specified samlEntityID.

Logout Callback URL

samlLogoutCallbackURL is an optional field used to define the URL to which the SAML provider will call back once logout is successful. This will initialize an endpoint on Maverics to listen for the callback. The URL’s domain must match the domain Maverics is on. The samlLogoutCallbackURL path can be arbitrary (e.g. /logout-maverics-saml or /logout-saml-handler), but must match the provider’s configuration for the specified samlEntityID.

Entity ID

samlEntityID is the unique application entity ID assigned to the application.

SP Cert Path

samlSPCertPath is an optional configuration to the path to the certificate that will be used to sign SAML authentication requests. Must be used with samlSPKeyPath.

SP Key path

samlSPKeyPath is an optional configuration to the path to the private key that will be used to sign SAML authentication requests. Must be used with samlSPCertPath.

IDP-Initiated Login

samlIDPInitiatedLogin is an optional field used to define the IDP-initiated login settings.

Enabled

enabled defines whether the connector will accept unsolicited SAML responses from the configured IDP. IDP-initiated login is disabled by default as it is inherently less secure than the alternative SP-initiated flow.

Allowed Redirect URLs

allowedRedirectURLs are the set of URLs that the connector can redirect to after processing an IDP-initiated SAML response. The IDP must pass one of the listed URLs via the relay state when it initiates a login. For more info on why a set of URLs are required, please see the OWASP guide on IdP Initiated SSO and the importance of mitigating the Open Redirect attack.

Cache

cache is an optional field that defines the cache settings for the connector. If left undefined, the connector will use the default in-memory cache.

Examples

Basic Configuration

connectors:
  - name: adfs
    type: adfs
    samlEntityID: MavericsOrchestrator
    samlMetadataURL: https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml
    samlConsumerServiceURL: https://orchestrator.example.com/acs
    samlLogoutCallbackURL: https://orchestrator.example.com/logout
    samlSPCertPath: /etc/maverics/certs/example-sp.crt
    samlSPKeyPath: /etc/maverics/certs/example-sp.key
    samlIDPInitiatedLogin:
      enabled: true
      allowedRedirectURLs:
        - https://alpha-app.example.com/dashboard
        - https://beta-app.example.com/index.html
    cache: redis

Configuration with local SAML metadata file

This sample assumes the SAML metadata was downloaded and saved in /etc/maverics/samlmetadata.xml.

connectors:
  - name: adfs
    type: adfs
    samlEntityID: MavericsOrchestrator
    samlMetadataURL: file:///etc/maverics/samlmetadata.xml
    samlConsumerServiceURL: https://orchestrator.example.com/acs
    samlLogoutCallbackURL: https://orchestrator.example.com/logout
    samlSPCertPath: /etc/maverics/certs/example-sp.crt
    samlSPKeyPath: /etc/maverics/certs/example-sp.key