PIXILAB Wiki

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
blocks:sso:adfs [2026-11-10 11:47] – typo "does" to "do" joaoblocks:sso:adfs [2026-11-11 06:52] (current) – Updated according to the newest ADFS changes joao
Line 38: Line 38:
 server: server:
   type: pixilab_server   type: pixilab_server
 +  requireHttps: false
   auth:   auth:
-    urlResolver: null 
-    ajaxRequestResolver: null 
-    callbackUrl: http://[BLOCKS-DOMAIN-OR-IP]/rest/auth/callback 
-    rolesOwner: attributes 
-    rolesPath: roles 
-    clients: 
-      - org.pac4j.oidc.client.OidcClient: 
-          configuration: 
-            discoveryURI: [PROTOCOL]://[ADFS-SERVER]/adfs/.well-known/openid-configuration 
-            clientId: [CLIENT-ID] 
-            secret: [CLIENT-SECRET] 
-            clientAuthenticationMethod: client_secret_basic 
-            scope: openid 
     servlet:     servlet:
       security:       security:
         - matchers: internalMatcher         - matchers: internalMatcher
-          clients: OidcClient 
           authorizers: isAuthenticated           authorizers: isAuthenticated
 +          clients: AzureAd2Client
 +    clients:
 +      callbackUrl: http://[BLOCKS-DOMAIN-OR-IP]/rest/auth/callback
 +    rolesOwner: attributes
 +    rolesPath: roles
 +    oidc:
 +      discoveryURI: [PROTOCOL]://[ADFS-SERVER]/adfs/.well-known/openid-configuration
 +      clientId: [CLIENT-ID]
 +      secret: [CLIENT-SECRET]
 +      clientAuthenticationMethod: client_secret_basic
 +      scope: openid
 +      mappedClaims:
 +        upn: preferred_username
 </code> </code>
 +
   - Start Blocks and go to "/edit" for login.   - Start Blocks and go to "/edit" for login.
  
Line 75: Line 76:
 </code> </code>
  
 +However, if you want to fine-tune specific User's roles and what they can access to, utilizing Block's User Groups feature, that is also possible. Once a user logs in with its ADFS account, Blocks will then verify if that user already exists within the Blocks system, mapping the ADFS UPN (**User Principal Name** - typically an email) used to a Blocks respective username. If the user does indeed exist, Blocks will override the User's Role specified above (rolesMapping) and add any Groups it can belong to.
 +
 +For example: John belongs to an ADFS group called "SomeGroup5". And rolesMapping above specifies SomeGroup5 as a Contributor. But John in particular we want him as an Editor, and he should only have access to a specific Blocks Group, where he will be responsible on editing a few Blocks. As a Blocks Admin, I just simply need to create a Blocks Account for John, using his email john@mycompany.com (ADFS UPN) as a username. And then in Blocks I add the desired role (Editor) and tie him to a user group with the desired permissions. Those will then take over, next time John logs in into Blocks.
  
 ====Filter the groups provided to Blocks==== ====Filter the groups provided to Blocks====