Configure WS-Federation Protocol Application SSO
IDaaS supports integrating applications through the WS-Federation (abbreviated as WS-Fed) protocol to achieve application single sign-on (SSO) with IDaaS as the authentication platform. After logging in to the IDaaS User Center, users can directly jump to log in to the application without logging in again.
Prerequisites
You have administrator permissions for the IDaaS Enterprise Center platform.
Procedure
Configure WS-Federation Protocol Application
Log in to the IDaaS Enterprise Center platform. In the top navigation bar, choose Resources > Applications, click Add Self-built Application, set the application name, save, and enter the application details page.
On the application information page, enable Authentication Integration, set it to WS-Fed, and save.
Click Configure next to Authentication Integration to enter the authentication integration details page, and set the general application authentication configuration.
Switch to the Interface Configuration page to obtain the relevant interface addresses of the current application.
In the top navigation bar, choose Settings > Service Configuration, click WS-Fed Configuration to obtain the corresponding parameters.
TIP
Supports globally enabling WS-Federation authentication mode.
- Enable Active Mode: Enabled by default. WS-Federation protocol applications can achieve single sign-on through browser authentication.
- Enable Passive Mode: Enabled by default. WS-Federation protocol applications can achieve single sign-on through Web Service interface authentication.
- Request Assertion Time Window: Default is 2 minutes. The time window range in the SAML1.0 content returned by the WS-Federation authentication assertion.
- Signing Certificate: The assertion signature verification certificate content that the docking application needs to configure.
Development Integration
After configuration on the IDaaS platform is complete, refer to WS-Federation Protocol to complete the subsequent integration configuration. After configuration is complete, users can single sign-on to the application from User Center.