<commit_before>---
title: UniformSSOSupport
category: feature
authors: ovedo, rnori
wiki_category: Feature
wiki_title: Features/UniformSSOSupport
wiki_revision_count: 30
wiki_last_updated: 2014-10-16
---

# Uniform SSO Support

### Summary

This document describes the new web application SSO infrastructure in the engine core. This infrastructure will enable moving between oVirt web applications, without having to authenticating each one of them separately.

### Owner

*   Feature owner: [ <NAME>](User:Ovedo)
*   Email: <EMAIL>

### Motivation

There were several key points in the motivation for this project:

*   With the upcoming integration between Webadmin and the Reports server, the need to be able to view reports without re-authenticating is crucial.
*   3rd party applications can authenticate using this infrastructure as well, allowing them to perform operations on the different oVirt web applications, without the need to re-authenticate.

### Introduction

Currently, the engine uses LDAP domains, and internal admin domain in order to authenticate (when using the API, Webadmin, UP). When using jasperserver, a whole different infrastructure is used in order to authenticate, as it contains its own set of users. Nowadays, integration of the Webadmin and the reports server is under-way, thus introducing the need to be able to authenticate to Webadmin, and automatically be able to view reports, without the need to re-authenticate.

### Picketlink Integration

#### Basic annotations

*   SAML - Stands for Security Assertion Markup Language is an XML-based open standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions). A service provider relies on an identity provider to identify a principal. At the principal's request, the identity provider passes a SAML assertion to the service provider. On the basis of this assertion, the service provider makes an access control decision.
*   Picketlink - Picketlink is a Jboss project, providing SAML v2.0 based SSO solution for web applications.
*   IDP - Identity provider. The entity which is responsible for identifying a principal trying to connect to the application.
*   SP - Service provider. The service itself, which needs to get information on who is the principal already connected to the system.

![](Picketlink1.png "Picketlink1.png")

#### Solution Architecture

In our solution we have the following players:

*   IDP - web application, part of the engine EAR, which is responsible for authenticating and providing information on the logged-in principal, using SAML.
*   The engine login module - used to perform the authentication process using the existing engine infrastructure. The IDP uses this login module.
*   The SPs - for start, the service providers which will use this infrastructure is the Webadmin, and the reports server.

![](Picketlink_img2.png "Picketlink_img2.png")

#### Login flow

1.  The user will try to contact the Webadmin application
2.  If it is not logged in yet
    1.  Post the request to the IDP, showing a login screen to the user (asking for username, password and domain)
    2.  The user logs in
    3.  The credentials go to the login module, passed to the engine core, and authentication is performed
    4.  If the authentication is succeeded, a session is created in the engine core (as today)

3.  If it is already logged in
    1.  Get the session ID
    2.  Continue working in the session

Same flow goes for the Reports server.

Now, the user would like to view a report:

1.  The browser accesses the Reports server through webadmin (or directly)
2.  It is already logged in (when accessing through webadmin we are already logged in), so no need to authenticate, and the reports server identifies him as the user logged in (e.g, admin@internal, user1@domain1, etc.). This user is an external user in Jasper server, i.e., a user which is being managed by an external application.

#### Logout flow

Picketlink supports "Global logout", i.e. logging out through the IDP, which basically means the user is no longer logged in, and access to any web application will result in requesting the user to login.

For example, if the SP link is <http://host.domain/sp> then the global logout link is at <http://host.domain/sp?GLO=true>. This will go the the IDP, and call the logout method of the login module, clearing the session at the engine core side.

### Current status

*   Target Release:
*   Status: Design Stage
*   Last updated date: Wed November 10 2011

#### Technical details

General configuration files:

*   standalone.xml - define the IDP and SP security domains, by adding them to the "security-domains" section:

      <security-domain name="sp" cache-type="default">
       <authentication>
        <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
       </authentication>
      </security-domain>
      <security-domain name="idp" cache-type="default">
       <authentication>
        <login-module code="org.ovirt.engine.core.idp.EngineLoginModule" flag="required"/>
       </authentication>
      </security-domain>
       

IDP configuration files (all located in the IDP WAR WEB-INF directory):

*   jboss-web.xml

      <jboss-web>
        <security-domain>idp</security-domain>
        <valve>
           <class-name>org.picketlink.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve</class-name>
         </valve>

      </jboss-web>
       

*   picketlink-handlers.xml

                 <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
                      <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
                      <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
                      <Handler class="org.ovirt.engine.core.idp.EngineAttributeHandler" >
                            <Option Key="ATTRIBUTE_ KEYS" Value="picketlink.roles"/>
                      </Handler>
                      <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
                      <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
              </Handlers>
       

*   picketlink-idfed.xml

                <PicketLinkIDP xmlns="urn:picketlink:identity-federation:config:2.1">
                      <IdentityURL>${idp.url::/ovirt-engine/idp/}</IdentityURL>
                      <Trust>
                              <Domains>localhost</Domains>
                      </Trust>
              </PicketLinkIDP>
       

*   in web.xml, add security constraint, security roles. Example for "admin" role:

        <auth-constraint>
           <role-name>admin</role-name>
        </auth-constraint>
        <security-role>
          <role-name>user</role-name>
        </security-role>
       

SP configuration files:

*   context.xml

      <Context><commit_msg>Technical details<commit_after>---
title: UniformSSOSupport
category: feature
authors: ovedo, rnori
wiki_category: Feature
wiki_title: Features/UniformSSOSupport
wiki_revision_count: 30
wiki_last_updated: 2014-10-16
---

# Uniform SSO Support

### Summary

This document describes the new web application SSO infrastructure in the engine core. This infrastructure will enable moving between oVirt web applications, without having to authenticating each one of them separately.

### Owner

*   Feature owner: [ <NAME>](User:Ovedo)
*   Email: <EMAIL>

### Motivation

There were several key points in the motivation for this project:

*   With the upcoming integration between Webadmin and the Reports server, the need to be able to view reports without re-authenticating is crucial.
*   3rd party applications can authenticate using this infrastructure as well, allowing them to perform operations on the different oVirt web applications, without the need to re-authenticate.

### Introduction

Currently, the engine uses LDAP domains, and internal admin domain in order to authenticate (when using the API, Webadmin, UP). When using jasperserver, a whole different infrastructure is used in order to authenticate, as it contains its own set of users. Nowadays, integration of the Webadmin and the reports server is under-way, thus introducing the need to be able to authenticate to Webadmin, and automatically be able to view reports, without the need to re-authenticate.

### Picketlink Integration

#### Basic annotations

*   SAML - Stands for Security Assertion Markup Language is an XML-based open standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions). A service provider relies on an identity provider to identify a principal. At the principal's request, the identity provider passes a SAML assertion to the service provider. On the basis of this assertion, the service provider makes an access control decision.
*   Picketlink - Picketlink is a Jboss project, providing SAML v2.0 based SSO solution for web applications.
*   IDP - Identity provider. The entity which is responsible for identifying a principal trying to connect to the application.
*   SP - Service provider. The service itself, which needs to get information on who is the principal already connected to the system.

![](Picketlink1.png "Picketlink1.png")

#### Solution Architecture

In our solution we have the following players:

*   IDP - web application, part of the engine EAR, which is responsible for authenticating and providing information on the logged-in principal, using SAML.
*   The engine login module - used to perform the authentication process using the existing engine infrastructure. The IDP uses this login module.
*   The SPs - for start, the service providers which will use this infrastructure is the Webadmin, and the reports server.

![](Picketlink_img2.png "Picketlink_img2.png")

#### Login flow

1.  The user will try to contact the Webadmin application
2.  If it is not logged in yet
    1.  Post the request to the IDP, showing a login screen to the user (asking for username, password and domain)
    2.  The user logs in
    3.  The credentials go to the login module, passed to the engine core, and authentication is performed
    4.  If the authentication is succeeded, a session is created in the engine core (as today)

3.  If it is already logged in
    1.  Get the session ID
    2.  Continue working in the session

Same flow goes for the Reports server.

Now, the user would like to view a report:

1.  The browser accesses the Reports server through webadmin (or directly)
2.  It is already logged in (when accessing through webadmin we are already logged in), so no need to authenticate, and the reports server identifies him as the user logged in (e.g, admin@internal, user1@domain1, etc.). This user is an external user in Jasper server, i.e., a user which is being managed by an external application.

#### Logout flow

Picketlink supports "Global logout", i.e. logging out through the IDP, which basically means the user is no longer logged in, and access to any web application will result in requesting the user to login.

For example, if the SP link is <http://host.domain/sp> then the global logout link is at <http://host.domain/sp?GLO=true>. This will go the the IDP, and call the logout method of the login module, clearing the session at the engine core side.

### Current status

*   Target Release:
*   Status: Design Stage
*   Last updated date: Wed November 10 2011

#### Technical details

General configuration files:

*   standalone.xml - define the IDP and SP security domains, by adding them to the "security-domains" section:

      <security-domain name="sp" cache-type="default">
       <authentication>
        <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
       </authentication>
      </security-domain>
      <security-domain name="idp" cache-type="default">
       <authentication>
        <login-module code="org.ovirt.engine.core.idp.EngineLoginModule" flag="required"/>
       </authentication>
      </security-domain>
       

IDP configuration files (all located in the IDP WAR WEB-INF directory):

*   jboss-web.xml

      <jboss-web>
        <security-domain>idp</security-domain>
        <valve>
           <class-name>org.picketlink.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve</class-name>
         </valve>

      </jboss-web>
       

*   picketlink-handlers.xml

         <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
               <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
               <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
                <Handler class="org.ovirt.engine.core.idp.EngineAttributeHandler" >
                        <Option Key="ATTRIBUTE_ KEYS" Value="picketlink.roles"/>
                </Handler>
                 <Handler class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
                 <Handler class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
         </Handlers>
       

*   picketlink-idfed.xml

          <PicketLinkIDP xmlns="urn:picketlink:identity-federation:config:2.1">
               <IdentityURL>${idp.url::/ovirt-engine/idp/}</IdentityURL>
               <Trust>
                        <Domains>localhost</Domains>
                </Trust>
         </PicketLinkIDP>
       

*   in web.xml, add security constraint, security roles. Example for "admin" role:

        <auth-constraint>
           <role-name>admin</role-name>
        </auth-constraint>
        <security-role>
          <role-name>user</role-name>
        </security-role>
       

SP configuration files:

*   context.xml

      <Context>
{'fraction_non_alphanumeric': 0.07618645261230812, 'fraction_numerical': 0.006759611322348965, 'mean_word_length': 3.3460832313341493, 'pattern_counts': {'":': 0, '<': 99, '<?xml version=': 0, '>': 99, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 16}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7545021', 'n_tokens_mistral': 4066, 'n_tokens_neox': 3835, 'n_words': 1558}