Setting up a SAML Application in Oracle Identity Cloud Service

Prerequisites

Your Prolaborate site should have a valid SSL Certificate.

Incase there isn’t a valid SSL certificate, then a self -signed certificate can be created. Please get in touch with the Prolaborate team to know more about it.

Service Provider Configuration

To configure the Service Provider, click on Menu → SAML Single Sign On

From the top of the page, click on Enable.

Under Service Provider Configuration,

Name	The name will be prefilled
Assertion Consumer URL	Enter a suitable chart nameAssertion Consumer URL will be Prefilled
Certificate File	Choose the .pfx file of your SSL certificate
Certificate Password	Enter the Password of the .pfx file

Configuring Prolaborate in Oracle

The following sections will elaborate the steps involved in setting up Prolaborate in Oracle.

Create a new SAML Application

To create a SAML application, please follow the below steps:

Log in the Oracle account as a user and Click on Menu.

Select Identity & Security and then choose Federation.

Click Federation Name from the list.

Click Oracle Identity Cloud Service Console URL in the page.

User will be redirected to the Admin console page. Now Click Add icon in the Applications and Services Tab

Click SAML Applications from the Add Applications pop-up

User will be redirected to the Applications details page.

Fill the following details and Add SAMl Applications

Field	Description
Name	Enter your Application Name (for eg. Prolaborate).
Description	Enter fewer characters to describe your Prolaborate
Icon	Click Upload to add an icon for your Prolaborate application
Application URL / Relay State field	(leave this field blank)

Click Add to add App Links that are associated with the application. The Link window will appear.

Fill the following details in the given fields.

Name	Enter the App Link name
Link/Relay State	Enter the URL used to access the application. (Copy Assertion Consumer URL (ACU) from Prolaborate Application and paste it into the Link/Relay field)
Application Icon	Add an icon for your Prolaborate application.

Click Add button.

Custom Login URL	leave this field blank
Custom Error URL	leave this field blank
Linking callback	leave this field blank

In the Display Settings section, enable User can request access and click Next at the top right side of the page.

SSO Configuration

Click on SSO Configuration Tab to define SSO attributes.

In Step 1, General section of the SSO Configuration

In the General section of the SSO Configuration page, define the following:

Field	Description
Entity ID	Copy Assertion Consumer URL fields from Prolaborate Service Provider and paste it in Entity ID field.
NameID Format	Select the type of format to use Email address. The service provider and the identity provider use this format to easily identify a subject during their communication.
NameID Value	Select the NameID Value as Primary Email to identify the user that is logged in.
Signing Certificate	Upload the .cer certificate file that is used to encrypt the SAML assertion.

Advanced Settings in SSO Configuration: 

In the Advanced Settings of the SSO Configuration page, define the following:

Field	Description
Signed SSO	Selectem Assertion and Response option from drop down list at Signed SSO field and Enable Include Signing Certificate in Signature.
Enable Single Logout	Select to configure SAML single logout. Single logout enables a user to log out of all participating sites in a federated session almost simultaneously. This check box is selected by default.
Logout binding	Select log out request is sent as POST (transported in HTML form-control content, which uses a base-64 format). This list box appears only if you select the Enable Single Logout check box.
Single Logout URL	Open the Identity Provider Metadata Xml file to copy the Single Logout Service URL with SP configuration like below image.
Logout Response URL	Copy Sign Out URL – Log out Prolaborate when you log out of SSO URL from Prolaborate Service Provider and paste it in Logout Response URL

Attribute Configuration

Expand Attribute Configuration on the SSO Configuration page to add user-specific and group-specific attributes to the SAML assertion. Click on plus(+) symbol to add the attributes.

Attribute Name	Value
firstname	First Name
lastname	Last Name
username	User Name
email	Primary Email

To configure SAML user group in the Prolaborate Application, please choose relevant value from the dropdown and copy the claim from the page and then paste it in Prolaborate Attribute mapping field.

Enter the Attribute Configuration details and Click Save.

Download the certificate file.

Click Activate to activate the Prolaborate application.

In Activate Application window appear and click Activate Application.

Assign Users to the Application

Click Assign Users button.

Select the users to whom to give access to Prolaborate and Click Ok.

The users whom we have selected will now show up in Users tab.

Identity Provider Configuration in Prolaborate

Fill the Identity Provider Configuration as per the instructions below:

Field	Details
Name	Identity Provider Entity id availed from from Identity Provider Metadata Xml.
Sign In URL	Sign in using the SAML application link address at Oracle as per the instructions belowOpen Prolaborate application in an Oracle user account and copy the application link address, then paste to Sign in URL field in your Prolaborate Identity provider configuration.Click on My Apps to log in your Oracle account as a user with User Sign in URL.

Click on Add

Select Application and Click on Add (+) symbol to your Prolaborate application

Give justification as Prolaborate and click on OK.

Copy your Prolaborate application link address.

Paste the URL to Identity Provider Configuration Sign in URL field of your Prolaborate Identity Provider configuration.

Field	Details
Sign Out URL – Log out SSO when you log out of Prolaborate (Optional)	Fill Sign Out URL using Identity Provider Single Logout Service availed from from Identity Provider Metadata Xml file (Refer to section SSO Configuration tab).

Field	Details
Certificate File	Choose the converted .cer Certificate file from Oracle Configuration

Enter the Identity Configuration fields in your Prolaborate SAML Settings and Click on Save.

Log in with Oracle Credentials

Once the configuration is done, your users will start to see a new button on the login page called Login with SSO

When they click on Login with SSO, they will be redirected to an URL as per configuration. They can then give their Oracle credentials to login to Prolaborate.

You will be redirected to Prolaborate successfully if the configuration is done right as per the instructions in the document.

If you’re experiencing challenges signing in using SSO, go at SAML Assertion Validation to debug the SAML configurations.

Note
The Repositories you see will be based on Default Access Control Profile.

Configure Default Access Control Profile in Prolaborate

Access Control Profiles let you define repository access rules and default user group membership for users added via SSO or Sign up. Click here to know more.

To create an Access Control Profile, click on Menu > Access Control Profiles under portal settings.

Access Control Profiles lists profiles which are created earlier.

To create a new profile, click on Create Profile to create a profile

 

When you click on Create Profile you will land on the below page.

Name	Give a suitable name for the profile
Include All Repositories	Choosing this will allow users who are logging in through SSO or Sign up get access to all the repositories
Choose Specific Repositories	This feature lets one the Repository and the corresponding User Group Membership. In addition, the user who is logging in through SSO or Sign will get access based on the user groups they are added to.

Now click on Save.

Now, go back to the SAML Settings page.

Select the newly created profile and click Save.

Logging out from Prolaborate

When a user initiates a logout, the user will be logged out from all applications in the current Identity provider login session.