Configuring SAML 2.0 Authentication

Use SAML 2.0 to authenticate LicensePredictor users through a SAML-compatible identity provider (IdP).

Requirements

• Configured Authentication Settings with Provider set to Saml
• SAML 2.0 identity provider information and credentials:
  • SP Entity ID — The unique URI that identifies LicensePredictor as the SAML service provider.
  • Public Origin — The publicly accessible URL of LicensePredictor, if different from its internal URL.
  • IdP Enitity ID — The unique URI that identifies the SAML identity provider.
  • IdP Metadata URL — The URL of the identity provider's SAML metadata document, or an accessible metadata file location.
  • (Optional). Service Certificate — A PFX certificate and its password for signing authentication requests.

Configuring SAML 2.0 Authentication Settings

Follow these instructions to configure the SAML authentication settings and register the LicensePredictor service provider endpoints with the identity provider.

Step 1: Open the appsettings.json File

1. Navigate to the LicensePredictor directory.

   By default, this is located at: C:\Program Files\OpeniT\LicensePredictor

2. Open the appsettings.json file.

Step 2: Configure the SAML 2.0 Authentication Settings

1. Locate the Saml section under Authentication in the appsettings.json file.

2. Set EntityId to the absolute URI that identifies LicensePredictor as the SAML service provider.

   This value is required and is normally based on the public application URL.

3. Set IdentityProviderEntityId to the absolute URI that identifies the SAML identity provider.

   Make sure the value matches the entity ID specified in the identity provider metadata.

4. Set MetadataLocation to the URL or file location of the identity provider metadata.

   note

   MetadataLocation is required. Make sure the LicensePredictor application service account can access the specified location.

5. Configure ModulePath to specify the base path for the SAML metadata, Assertion Consumer Service (ACS), and logout endpoints. The default value is /Saml2. The value must begin with /.

6. Configure PublicOrigin when the externally accessible origin differs from the application's internal request URL.

   Example

   https://licensepredictor.example.com

   note

   Use PublicOrigin when LicensePredictor is accessed through a reverse proxy or another configuration where the public HTTPS URL differs from the internal request URL.

Other SAML 2.0 Authentication Settings

Configure the SAML authentication behavior as needed:

Setting	Description	Default value
AllowUnsolicitedAuthnResponse	Set to true to allow identity provider-initiated sign-in. Enable only when required and approved by the deployment security policy.	false
DisableOutboundLogoutRequests	Set to true to prevent LicensePredictor from sending outbound SAML logout requests. Enable only for identity providers that cannot process service provider-initiated logout requests.	false
SignAuthenticationRequests	Set to true to sign outbound authentication requests when required by the identity provider.	false
WantAssertionsSigned	Set to true to require signed SAML assertions. Keep enabled unless the identity provider configuration explicitly requires otherwise.	true

SAML 2.0 Authentication Behavior Settings

If signing is required, configure the service certificate:

Setting	Description
ServiceCertificatePath	Specify the path to the PFX service certificate.
ServiceCertificatePassword	Specify the password used to unlock the PFX certificate. Supply the certificate password through a secret store or environment override when applicable. Avoid storing sensitive credentials directly in configuration files.

SAML 2.0 Service Certificate Settings

Configure the claims used by LicensePredictor:

Setting	Description
NameClaimType	Specify the claim URI used for the user's display name. The default value is the standard XML name claim URI.
RoleClaimType	Specify the claim URI used for the user's role. The default value is the Microsoft role claim URI.

SAML 2.0 Claim Settings

Example: appsettings.json

"Saml": {
  "EntityId": "https://licensepredictor.example.com/saml",
  "IdentityProviderEntityId": "https://idp.example.com/saml/metadata",
  "MetadataLocation": "https://idp.example.com/saml/metadata",
  "ModulePath": "/Saml2",
  "PublicOrigin": "https://licensepredictor.example.com",
  "AllowUnsolicitedAuthnResponse": false,
  "DisableOutboundLogoutRequests": false,
  "SignAuthenticationRequests": false,
  "WantAssertionsSigned": true,
  "ServiceCertificatePath": "",
  "ServiceCertificatePassword": "",
  "NameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
  "RoleClaimType": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
}

7. Save the changes.

Step 3: Restart the LicensePredictor Service

1. Open Task Manager.

2. Under Services, restart the OpeniTLicensePredictor service.