SiteVision MFA and SSO with PhenixID Authentication Services

Warning

Please note, this document is using the legacy authenticators - in order to use the new protocol agnostic authenticators, you need to apply relevant modifications to the configuration examples outlined in this article.

Summary

This document will guide you through the steps to enable multi-factor authentication and Single-Sign On for the CMS platform SiteVision (https://www.sitevision.se/in-english.html) using SAML2.

System Requirements

• PhenixID Authentication Server 2.8 or higher
• SiteVision administration rights
• The users to be federated must be present in SiteVision. Use PhenixID Identity Provisiong to provision user accounts to SiteVision: PSD1148 - SiteVision actions for Identity Provisioning

Instruction

Overview

This document will guide you through the steps to enable multi-factor authentication and Single-Sign on for SiteVision .

PhenixID Server acting as SAML IdP

1. Setup PhenixID Authentication Services as a SAML IdP.

2. Fetch the SiteVision userID value from the user store or from the data produced by the authentication (such as a certificate attribute) (depending on your use case).

3. Use the userID as Name ID attribute.

4. Add these attributes as additional attribute:

   urn:oid:0.9.2342.19200300.100.1.1,givenName,sn,mail

5. Add a valve to the execution flow that contains the AssertionProvider. Place it before the AssertionProvider.

   Example:

   

   Change the value to match your configuration.

6. Expand the AssertionProvider.

7. Add a Misc param, signAssertion=true.

   Example:

   

8. Go to Scenarios->Federation-> <newly_added_scenario> -> Identity Provider. Deselect “Require signed requests”. Save.

9. [OPTIONAL] To control SiteVision permissions on the IdP, you can add a Groups attribute to the SAML assertion. Read more about virtual groups in Sitevision here: https://help.sitevision.se/12701414.html

Configure SiteVision

1. Configure SiteVision SAML settings by following the guide at https://help.sitevision.se/12709836.html.

   For the IDP info, point to the IDP Metadata link at https://<YourServerDomainName>/saml/authenticate/<authenticator_alias>?getIDPMeta

   OR

   Select “as text”, then insert the idp meta xml.

2. Browse to <SiteVision_domain>/saml/metadata to fetch the SAML Service Provider metadata

3. Save the Service Provider metadata as a file, sitevisionsp.xml.

Add trust to SiteVision on PhenixID Authentication Services

1. Login to configuration manager
2. Open Scenarios->Federation->SAML Metadata upload
3. Click the plus sign
4. Add SiteVision SAML SP Metadata by uploading the file downloaded in previous step (sitevisionsp.xml)

Test

1. Browse to your SiteVision site
2. This should result in a redirect to PhenixID Authentication Server
3. Authenticate
4. If authentication was successful, a redirect to SiteVision should occur (with SAML assertion)
5. The user should now be logged in.

Troubleshooting

• If error message is presented on PhenixID Authentication Services page, please check server.log for details.
• If error message is presented on SiteVision, please consult SiteVision logs for details.

Tags

SAML 2 Single Sign-On MFA Identity Provider Federation Use Case: Federation of web services Use Case: Integrate with external systems Step by Step