Configuring SAML in Borealis

Profile required: Superuser

Security Assertion Markup Language (SAML) is an open-standard data format for exchanging authentication and authorization data between an identity provider IdP (client) and a service provider SP (Borealis). This standard process makes it possible to log users into applications based on sessions in another context. With SAML, the client manages all aspects of authentication, including username, password, password strength, etc.

Activate SAML for your organization

1. In the navigation menu, go to Users > Authentication settings.
2. In the record menu, select SAML > Connection configuration. If you do not see the SAML section, contact our Help desk. 
3. Click on the Edit icon that appears on the upper-right.
   
    
4. Check the SAML enabled box. 
5. (Optional) Select Allow creation of non-SAML users if you want to allow authentication for users who do not use SAML.
6. Upload the Identity Provider (IdP) certificate.(.cer file).
7. Enter the Entry Point (SingleSignOnService URL) provided by your Identity Provider.
   NOTE: This will switch all the current users to SAML as soon as you save.
8. To enable single logout, select Enable single logout and enter the Single logout URL. Note: SP-initiated single logout only works if the Identity Provider supports SAML Single Logout (SLO) and is configured accordingly.
9. Select the appropriate Signing option.
   • Sign SAML assertion — signs only the assertion within the SAML response (default)
   • Sign SAML response — signs only the response envelope
   • Sign SAML response and assertion — signs both the response and the assertion 
10. Enter the Identifier (Entity ID) provided by your Identity Provider.

    

11. Click on Save to apply the configuration.

12. If you need the service provider certificate, click on the Actions button then on Download service_provider.cer. You will need to upload this to your identity provider. 

    

13. Copy this information to your identity provider
    - Issuer (Entity ID)
    - SAML login URL
    - SAML logout URL
    
    Alternatively, click on the Actions button to download the service_provider.xml file to upload it to your identity provider.

Advanced configuration

This section allows configuring an authentication context. If you need to setup an authentication context, uncheck the box and confirm that the context is the right one in the Authentication context (Authn context) field. At the moment, the only signature algorithm supported is sha256.

User configuration

This section will be automatically filled with the claims that Borealis will expect for the UserID, First name, Lastname and Email. You can change this if they do not fit your structure.

By default, the Auto Create User option is activated. This means that if a user tries to connect to Borealis for the first time, their user will be created automatically. They will not have access to any data however, so they will still need to be assigned to profiles and projects.

Testing your SAML setup

Keep your session open and use a new browser or an incognito/private window to log in to Borealis. You should be redirected to your federation login page and then back to Borealis with your normal access.

Frequent problems

Troubleshooting: If you are unable to complete the SAML configuration or users cannot authenticate successfully, clear the SAML enabled checkbox and save the configuration. This disables SAML authentication and reverts users to standard Borealis login using their existing passwords.