| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| blocks:sso:adfs [2022-08-05 09:28] – Added note on https and domain name admin | blocks:sso:adfs [2026-11-11 06:52] (current) – Updated according to the newest ADFS changes joao |
|---|
| ===Prerequisites=== | ===Prerequisites=== |
| |
| To be able to follow the steps below you'll need to have Windows Server 2016 or later with the "Active Directory Federation Services (ADFS)" feature enabled. Your Blocks server must use a secure connection (https), which requires a certificate and use of a domain name. | To be able to follow the steps below you'll need to have Windows Server 2016 or later with the "Active Directory Federation Services (ADFS)" feature enabled. |
| |
| ===Add an OpenID Connect configuration to ADFS=== | ===Add an OpenID Connect configuration to ADFS=== |
| - Paste and add the **Client Identifier** (from step 6) as the "Identifier". Click next. | - Paste and add the **Client Identifier** (from step 6) as the "Identifier". Click next. |
| - Select the access control policy you'd like to use and click next. | - Select the access control policy you'd like to use and click next. |
| - Make sure the box next to "openid" is ticked. | - Make sure the boxes next to "openid" and "allatclaims" are ticked. If the "allatclaims" scope is not present in the list, click the "New scope..." button to create it. This scope is needed for sending additional claims such as the user's groups as roles to Blocks after authentication. |
| - Click the "New scope..." button in the bottom and and give it the name "allatclaims", click OK. This scope is needed for sending additional claims such as the user's groups as roles to Blocks after authentication. | |
| - Finish the wizard. | - Finish the wizard. |
| |
| ====Blocks specific steps==== | ====Blocks specific steps==== |
| |
| - Open your Blocks configuration file on your Blocks server and add the "auth" section below to the already existing "server" section. Replace the values of [BLOCKS-DOMAIN], [PROTOCOL], [ADFS-SERVER], [CLIENT-ID] and [CLIENT-SECRET]. [CLIENT-ID] and [CLIENT-SECRET] is the items copied and saved from the **Add a OpenID Connect configuration to ADFS** section above. | - Open your Blocks configuration file on your Blocks server and add the "auth" section below to the already existing "server" section. Replace the values of [BLOCKS-DOMAIN-OR-IP], [PROTOCOL], [ADFS-SERVER], [CLIENT-ID] and [CLIENT-SECRET]. [CLIENT-ID] and [CLIENT-SECRET] is the items copied and saved from the **Add a OpenID Connect configuration to ADFS** section above. |
| * <code> | * <code> |
| server: | server: |
| type: pixilab_server | type: pixilab_server |
| | requireHttps: false |
| auth: | auth: |
| urlResolver: null | |
| ajaxRequestResolver: null | |
| callbackUrl: https://[BLOCKS-DOMAIN]/rest/auth/callback | |
| rolesOwner: attributes | |
| rolesPath: roles | |
| clients: | |
| - org.pac4j.oidc.client.OidcClient: | |
| configuration: | |
| discoveryURI: [PROTOCOL]://[ADFS-SERVER]/adfs/.well-known/openid-configuration | |
| clientId: [CLIENT-ID] | |
| secret: [CLIENT-SECRET] | |
| clientAuthenticationMethod: client_secret_basic | |
| scope: openid | |
| servlet: | servlet: |
| security: | security: |
| - matchers: internalMatcher | - matchers: internalMatcher |
| clients: OidcClient | |
| authorizers: isAuthenticated | authorizers: isAuthenticated |
| | clients: AzureAd2Client |
| | clients: |
| | callbackUrl: http://[BLOCKS-DOMAIN-OR-IP]/rest/auth/callback |
| | rolesOwner: attributes |
| | rolesPath: roles |
| | oidc: |
| | discoveryURI: [PROTOCOL]://[ADFS-SERVER]/adfs/.well-known/openid-configuration |
| | clientId: [CLIENT-ID] |
| | secret: [CLIENT-SECRET] |
| | clientAuthenticationMethod: client_secret_basic |
| | scope: openid |
| | mappedClaims: |
| | upn: preferred_username |
| </code> | </code> |
| | |
| - Start Blocks and go to "/edit" for login. | - Start Blocks and go to "/edit" for login. |
| |
| ===Role Mapping=== | ===Role Mapping=== |
| |
| Since the groups you've configured for your users in your windows server does not match the roles used by Blocks, you have to add role mappings to the Blocks configuration file. Do this by defining a server.auth.rolesMapping parameter where the keys are the group names of your windows server configuration and the values the roles Blocks know about. For example: | Since the groups you've configured for your users in your windows server do not match the roles used by Blocks, you have to add role mappings to the Blocks configuration file. Do this by defining a server.auth.rolesMapping parameter where the keys are the group names of your windows server configuration and the values the roles Blocks know about. For example: |
| <code> | <code> |
| rolesMapping: | rolesMapping: |
| </code> | </code> |
| |
| | However, if you want to fine-tune specific User's roles and what they can access to, utilizing Block's User Groups feature, that is also possible. Once a user logs in with its ADFS account, Blocks will then verify if that user already exists within the Blocks system, mapping the ADFS UPN (**User Principal Name** - typically an email) used to a Blocks respective username. If the user does indeed exist, Blocks will override the User's Role specified above (rolesMapping) and add any Groups it can belong to. |
| | |
| | For example: John belongs to an ADFS group called "SomeGroup5". And rolesMapping above specifies SomeGroup5 as a Contributor. But John in particular we want him as an Editor, and he should only have access to a specific Blocks Group, where he will be responsible on editing a few Blocks. As a Blocks Admin, I just simply need to create a Blocks Account for John, using his email john@mycompany.com (ADFS UPN) as a username. And then in Blocks I add the desired role (Editor) and tie him to a user group with the desired permissions. Those will then take over, next time John logs in into Blocks. |
| |
| ====Filter the groups provided to Blocks==== | ====Filter the groups provided to Blocks==== |