SAML support for OktA

[jsandova]

Does PHP IPAM support SAML2 authentication via Okta? I have not been able to find any documentation on how to set that up?

[JasonN3]

phpIPAM supports SAML2. It is an old version of SAML2, but Okta may still support it. They have some instructions at https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html on how to collect the information you will need. I have no idea if their instructions still work.

Make sure that you have mcrypt installed. It was removed in 7.2 so you're going to need an old version of php. If you have a newer version, you'll need to wait for the PR I just submitted (#3055 ) to be merged.

1. Collect the necessary information

• Entity ID (This is your phpIPAM url. Ex: https://phpipam.example.com). You'll need to fill this in on Okta so you can get the rest of the information.
• x.509 Certificate (Follow instructions at https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html)
• x509 Certificate SHA256 Fingerprint (Follow instructions at https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html)
• Login URL (Follow instructions at https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html)
• Logout URL (Follow instructions at https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-General-Information.html)

2. Go to phpIPAM and select Administration (on the right side right below logout) -> Authentication Methods
3. Select Create new -> Create new SAML2 authentication
4. Fill out the form

• Description = Pick a name. It doesn't matter. It's a note to yourself
• Use advanced settings = false (If you need to use the extra settings file, set it true)
• IDP issuer = Okta (This is another note to yourself. Feel free to put whatever)
• IDP login url = Paste the Login URL found in step 1
• IDP logout url = Paste the Logout URL found in step 1
• IDP cert fingerprint = Paste the x509 Certificate SHA256 Fingerprint found in step 1
• Idp cert algorithm = sha256
• Idp cert x509 = Paste the x.509 Certificate found in step 1

5. Click +Add and you should now be able to click the saml login link on the homepage.

[GaryAllan]

Hi,
php-saml has been updated in the development branch (will be v1.5.0) and should support OktA.

[bobot4258]

I was not able to find any documentation on this myself when setting it up so hopefully this can be of help to anyone else looking for some.

Create the app in Okta and make the single sign on URL https://phpipam.example.com/index.php?page=saml2
This same address will be used for Recipient URL, Destination URL and then for Audience restriction I just have https://phpipam.example.com (Change URL to match what you are using)

View the SAML setup config for your app in Okta
Okta----------------------------------------------------phpIPAM
Identity Provider Issuer:----------------------------------IDP issuer
Identity Provider Single Sign-On URL:-------------------IDP login url
X.509 Certificate:------------------------------------------IDP X.509 public cert

I left the default for Client ID
IDP Logout URL I just made https://phpipam.example.com/index.php?page=login
Sign Authn Requests toggled to off

[dukele-taulia]

@bobot4258 Worked great.

For JIT provisioning, I had to add the additional attributes:

ATTRIBUTE STATEMENTS

1. NameID - Unspecified - user.email
2. display_name - Unspecified. - user.displayName
3. email. - Unspecified. - user.email

I am still working to figure how to assign role properly.