1

In one of the java struts based web projects, I have implemented SSO (Single-sign-on) using SAML authentication, using picketlink library, deployed on Jboss AS 7.1. Its working without any issues.

I need to implement the SSO in another Struts based web project, running on Tomcat 7. The IDP in this case is Azure AD. I have followed the steps given in the article SAML with Tomcat and PicketLink. I have also configured the application in Azure AD. The IDP and SP URLs are mentioned in the picketlink conif file as follows:

<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1" BindingType="POST">
    <IdentityURL>${idp.url::https://login.microsoftonline.com/29b0-4f33-a90e/saml2}</IdentityURL>
    <ServiceURL>${myapp.url::https://appserver.mydomain.com:10503/myapp/internal/}</ServiceURL>
    <Trust>
        <Domains>localhost,mydomain.com</Domains>
    </Trust>
</PicketLinkSP>
<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler">
        <Option Key="ROLE_KEY" Value="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"/>
    </Handler>
    <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
</Handlers>

I have mentioned the SAML-P endpoint that I got from Azure AD against the configured application in the above file.

${idp.url::https://login.microsoftonline.com/29b0-4f33-a90e/saml2}

Its not working after making all these changes. It looks like I need to get the certificate from the federation-metadata file and follow some steps to enable SSL and to make it ready for SAML to understand. I could not do this. I do not know if my path is correct. Can you please give me a sample program or steps to complete this task.

Anand
  • 727
  • 3
  • 14
  • 39

1 Answers1

1

I was able to fix this on my own. There were 2 issues.

The application was not configured properly in Azure because of which the authentication did not reach Azure. After doing bit of research on the configurations, I was able to achieve this.

Regarding the certificate installation, We can download the certificate from Azure Federation tab and then follow the regular certificate update and then refer the same in the application server.

I am working on document this. Once I am don, I will post them here

Anand
  • 727
  • 3
  • 14
  • 39
  • Hi Anand, can you please share the documented steps to get a java web app work with SAML azure sso ? – vick_4444 May 03 '21 at 09:45
  • @vick_4444, Please see the blog -- https://anandtechie.blogspot.com/2018/01/sso-with-office-365-azure-ad-using-java.html – Anand May 03 '21 at 23:52