Link Groups are a way to segregate linked data for a person. For example you may have a Test and...
Table of Contents
1. Overview
4. Configuration Information: Configuring a Service Provider
5. Configuration Information: Social IDP Integration
Overview
Many applications provide a way to enable login from one of several social identity providers (Google, Microsoft, Facebook, LinkedIn, or others). These solutions tend to only work with a single application, whereas end users rarely use a single application in an organization.
The Cirrus Gateway is a general purpose solution that allows any of a number of social providers to be integrated with any organization application or hosted service that supports the SAML v2.0 authentication protocol. When the Gateway is used in conjunction with the Cirrus Identity Provider Proxy, customers have a central point to manage social logins. This can be used for a suite of applications or services, more protocol options (including CAS), and additional proxy capabilities.
Customers only need to establish API integrations with each social provider. These take the form of keys and secrets shared between the social provider and the Gateway. No other maintenance required. Cirrus Identity maintains the Gateway as a hosted solution. We deploy changes as each social provider updates API integration rules. There is nothing customers run onsite. We’re on top of the integration details so you can forget about them.
The Cirrus Gateway currently supports the following social providers:
|
Provider |
Protocol |
Useful Links |
Notes |
|
|
OpenID Connect |
||
|
|
OpenID Connect |
Cirrus does not recommend new customers enable Facebook. Support by the company has been limited. |
|
|
Microsoft |
OpenID Connect |
This includes Outlook, Hotmail, MSN, Skype, and Windows Live accounts; Office365 domain accounts can also be used if the API integration is properly configured. |
|
|
|
OpenID Connect |
||
|
|
OAuth1 |
||
|
Amazon |
OAuth2 |
||
|
|
OAuth2 |
Cirrus Identity continually evaluates the social login offerings based on social provider API support, customer needs, and changes in end user utilization of different social login platforms.
The following are the steps needed to get started using the Cirrus Gateway:
1) Customers should take a moment and think about their Gateway Deployment. Cirrus Identity can offer generally accepted practices, customer stories, and professional services to help. Reviewing how to select social providers covered by the Cirrus Gateway | Planning Steps is a good place to start.
2) A member of the organization needs to have access to the Cirrus Console and to be granted the “Organization Administrator” (org admin) role for your organization (see Cirrus Console getting started).
3) From the Cirrus Console, an org admin will enable social providers for the organization -- this should be any social providers an organization wants to allow.
4) Cirrus Identity needs the metadata for any service providers (SP) that you want to use with the Gateway. If the SP is registered with one of the eduGAIN federations (InCommon, UK Fed, CAF, or others) we already have it. If not, you can send us the metadata and we will load it (if you anticipate having a high volume of SPs to add, you can set up a metadata aggregate that Cirrus Identity can consume regularly).
5) From the Cirrus Console, an org admin will create the SP in the Console so it can be configured (not for Proxy integration). At this point, the org admin may designate an SP admin to complete the setup.
6) From the Cirrus Console, an admin will enable the desired social providers specific to the SP (this may be a subset of social providers allowed at the org level). The admin will need a developer account for each social provider to complete the API integration. For each enabled social provider, the admin will follow the instructions available in the Console integrate the Social Provider (see Gateway - Social IdP Integration).7) From the Cirrus Console, an admin will configure the Cirrus Discovery Service -- to enable login via social identity providers, the organization’s enterprise identity provider (see Cirrus Discovery - Getting Started), as well as other federated partners and custom IdPs. Note that customers can run their own Discovery Service if they prefer. See #8 below for links to the Cirrus metadata for the social identity provider endpoints.
8) For SPs integrating directly with the gateway (not for Proxy integration), you will need to change the configuration for the SP to consume Cirrus Gateway metadata - the metadata is available at https://md.cirrusidentity.com/metadata/CirrusIdentitySocialProviders-metadata.xml (further details on Gateway - Configuring a Service Provider).
9)Change the configuration for the SP to use the Cirrus Discovery Service - the discovery URL should be set to a value of "https://apps.cirrusidentity.com/console/ds/index" (further details on configuring different service providers).
Once these steps are complete, you are ready to use the Gateway.
Configuration Information: Configuring a Service Provider
Social Provider Metadata Configuration
NOTE - Customers using the Cirrus Identity Provider Proxy
If you are integrating your SP with the Cirrus Identity Provider Proxy then you probably want to be consuming the metadata for your specific proxy, not the Gateway bundle. Proxies are customer specific and you'll want to follow our instructions on consuming customer metadata.
Social Provider Metadata
An aggregate of the social provider metadata is available at the following URL:
https://md.cirrusidentity.com/metadata/CirrusIdentitySocialProviders-metadata.xml
You can also find per entity metadata for each IdP endpoint for the social providers.
Metadata Configuration - Shibboleth SP
<MetadataProvider type="XML" url="https://md.cirrusidentity.com/metadata/CirrusIdentitySocialProviders-metadata.xml" backingFilePath="/<path to local file>/CirrusIdentitySocialProviders-metadata.xml" reloadInterval="86400">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
</MetadataProvider>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
</MetadataProvider>
For details on all of the available configuration options, please see the Shibboleth NativeSPMetadataProvider documentation.
Metadata Configuration - SimpleSAMLphp Service Provider
Metadata for SimpleSAMLphp is best configured using the metarefresh module. An example configuration for the Gateway metadata bundle is as follows:
$config = array(
'sets' => array(
'incommon' => array(
'cron' => array('daily'),
'sources' => array(
array(
'src' => 'https://md.cirrusidentity.com/metadata/CirrusIdentitySocialProviders-metadata.xml',
),
),
'expireAfter' => 60*60*24*4, // Maximum 4 days cache time.
'outputDir' => '<path to local directory>',
'outputFormat' => 'serialize',
),
)
);
Blog comments