SAML#

The SAML authentication is performed using the “Remote User” module. This means the the web server in front of the VPN portal is taking care of the user authentication. Below, we’ll use Apache.

You can choose from two Apache modules to configure SAML authentication:

• mod_auth_mellon
• mod_shib

If your VPN server only needs to authenticate to one IdP and you want to keep things simple, use mod_auth_mellon. If you are connecting to an identity federation, use mod_shib.

Portal Configuration#

File: /etc/vpn-mini-portal/config.json:

We use the the isMemberOf SAML attribute (urn:oid:1.3.6.1.4.1.5923.1.5.1.1) for determining group membership. We map the attribute to the literal name groups.

{
    "RemoteUser": {
        "attributeMapping": {
            "MELLON_urn:oid:1_3_6_1_4_1_5923_1_5_1_1": "groups"
        },
        "attributeValueDelimiter": ";",
        "logoutUrl": "https://vpn.example.org/saml/logout",
        "returnToParameter": "ReturnTo",
        "userAttributes": [
            "MELLON_urn:oid:1_3_6_1_4_1_5923_1_5_1_1"
        ]
    },
    "authMethod": "RemoteUser"
}

Apache#

We use the pairwise-id (urn:oasis:names:tc:SAML:attribute:pairwise-id) as the REMOTE_USER variable to uniquely identify a user.

<Location />
    MellonEnable "info"
    MellonSecureCookie On
    MellonIdP "IDP"
    MellonMergeEnvVars On
    MellonSPPrivateKeyFile /etc/httpd/saml/sp.key
    MellonSPCertFile /etc/httpd/saml/sp.crt
    MellonSignatureMethod rsa-sha256
    MellonEndpointPath /saml
    MellonIdPMetadataFile /etc/httpd/saml/idp.example.org.xml
    MellonUser "urn:oasis:names:tc:SAML:attribute:pairwise-id"
</Location>

<Location /x_auth>
    MellonEnable "auth"
</Location>