Use Cases
HomeIntegrityControlManagement CenterSolutions
  • Get Started
  • Integrity | Access
    • Auth. methods
      • LDAP (Username/Password)
      • LDAP (Username/Password) + OTP (SMTP)
      • LDAP (Username/Password) + OTP (SMS)
      • Swedish BankID
      • Microsoft Entra ID (SAMLSPBroker)
      • Foregin eID (SAMLSPBroker)
    • Auth. methods (SAML)
      • One-Time Password (OATH)
      • Inera IdP (SITHS) (SAMLSPBroker)
      • ID-porten (Norway) (SAML IdP with OIDC RP)
      • Multiple SAML IdP's configured
        • Multiple JSON files
    • Auth. methods (OIDC)
      • Static values (OIDC) - Test only
      • Swedish BankID (OIDC)
      • UID/PWD (OIDC)
    • Auth. methods (MISC)
      • Selector filtering
      • AuthZ control
      • External links and Cancel location
    • Add a Federation or SAML SP
  • Integrity | Portal
    • Portal
  • Integrity | Enrollment
    • Software token (OATH)
    • Best practice configuration
  • Integrity | Radius
    • UID/OATH token
    • UID/Password/OATH token
    • UID/Password/SMTP
  • Integrity | API
    • Swedish Siths eID
    • Oath Token
  • Control | Applications
    • Password Reset
    • Password Reset for Entra ID
    • Password Reset for Google Workspace
  • OPERATION
    • Rolling upgrade - cluster
  • TROUBLESHOOTING
    • Wrong relaystate
  • Misc
    • Address configuration externally
    • ADFS
      • Protect Fortified ID apps
      • Install and configure Fortified ID ADFS adapter for Siths eID
      • Install and configure Fortified ID ADFS adapter for Oath
    • AWS
      • Protect AWS Cognito with eID MFA
      • Protect AWS IAM Identity Center with eID MFA
    • Customization
      • Overlay - WEB
      • Overlay - Portal
      • Overlay - Password Reset
      • Overlay - Enrollment
      • Logout page
    • Dependency-Track - protect with eID MFA and SSO
    • Digitala Nationella Prov (DNP) / Skolfederation
      • Active Directory Federation Services (ADFS) with BankID as step-up-method
      • Active Directory / LDAP with BankID as step-up-method
      • Entra ID (Azure AD) with BankID as step-up-method
      • Google with BankID as step-up-method
      • Generate eduPersonPrincipalName (eppn) and store in Google
      • Generate eduPersonPrincipalName (eppn) and store in Entra ID
      • Common configuration
    • Encrypt configuration secrets
    • Microsoft Entra
      • Protect Entra ID (Azure AD) with eID MFA
      • Entra External - Support for eID (SAML)
      • Entra External - Support for eID (OIDC)
    • Expressions
    • Google
      • Common configuration for Google Workspace - Directory API
      • Common configuration for Google Workspace - authentication for Fortified ID products
      • Delegated administration for Google Workspace - teacher updates student guardians
      • Delegated administration for Google Workspace - teacher updates student password
      • Protect Google Workspace with eID MFA
    • HTTPS
    • Protect sensitive data, such as social security numbers, through obfuscation
    • Reverse proxy
      • Install Apache Web Server on Windows
      • Add SSL certificate and enable https
      • Add a Fortified ID virtual host
    • Set AuthnContextClassRef
    • Wiki.js - OpenID Connect (OIDC)
Powered by GitBook
On this page
  • Overview
  • Scenario
  • Solution
  • Complete config.json file
  1. Integrity | Access
  2. Auth. methods (SAML)
  3. Multiple SAML IdP's configured

Multiple JSON files

PreviousMultiple SAML IdP's configuredNextAuth. methods (OIDC)

Last updated 6 months ago

Overview

Scenario

Note. This use case is a variant when it comes to structure in the config.json file only. The use case will work but it is explained more in detail of its purpose in "Multiple SAML IdP's configured"

If you have a large config.json file when, for example, multiple IdPs then it could be more convinent to split the JSON file in several files where one file is IdP1 and another IdP2 and the config.json file is the main file.

Solution

config.json support something called includes where you can include JSON content from a separate file. You can either point out one file to include or a folder with several JSON files. There are some use case where we use this technic. See "Portal" use case or "Globals and Includes" use case.

In this scenario we have two IdPs. Each IdP has one authenticator part and one pipes part. So total we have 6 use case files for this use case.

  • config.json (below are addressed from inside the config.json file)

    • globals.json (line 2)

    • IdP_1_AuthN.json (line 99-104)

    • IdP_1_Pipes.json (line 105-109)

    • IdP_2_AuthN.json (line 110-115)

    • IdP_2_Pipes.json (line 116-120)

Complete config.json file

{
    "globals": "@include:globals.json",
    "modules": [
        {
            "name": "CefEventModule",
            "config": {}
        },
        {
            "name": "HttpClient",
            "config": {
                "name": "default",
                "idle_timeout_ms": 5000,
                "connect_timeout_ms": 5000
            }
        },
        {
            "name": "LdapClient",
            "enabled": true,
            "instances": 1,
            "config": {
                "name": "${globals.ldap.ldap1.name}",
                "connection": {
                    "host": "${globals.ldap.ldap1.connection.host}",
                    "port": "${globals.ldap.ldap1.connection.port}",
                    "bind_dn": "${globals.ldap.ldap1.connection.bind_dn}",
                    "bind_password": "${globals.ldap.ldap1.connection.bind_password}",
                    "use_ssl": "${globals.ldap.ldap1.connection.use_ssl}",
                    "ssl_trust_all": "${globals.ldap.ldap1.connection.ssl_trust_all}"
                }
            }
        },
        {
            "name": "SmtpClient",
            "enabled": true,
            "config": {
                "name": "${globals.smtp.smtp1.name}",
                "host": "${globals.smtp.smtp1.host}",
                "port": "${globals.smtp.smtp1.port}",
                "user_name": "${globals.smtp.smtp1.user_name}",
                "password": "${globals.smtp.smtp1.password}",
                "auth_methods": "DIGEST-MD5, CRAM-SHA256, LOGIN"
            }
        },
        {
            "name": "SAML",
            "config": {
                "metadata_cache": "${globals.saml.generic.metadata_cache}",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "enable_http": true,
                "metadata_template": [
                    {
                        "id": "${globals.saml.idp1.metadata_id}",
                        "metadata_file_path": "${globals.saml.idp1.metadata_file_path}",
                        "sign_ref": [
                            {
                                "keystore": {
                                    "alias": "${globals.keystore.saml.sign_ref_keystore_alias}",
                                    "key_password": "${globals.keystore.saml.sign_ref_keystore_key_password}",
                                    "password": "${globals.keystore.saml.sign_ref_keystore_password}",
                                    "path": "${globals.keystore.saml.sign_ref_keystore_path}"
                                }
                            }
                        ]
                    },
                    {
                        "id": "${globals.saml.idp2.metadata_id}",
                        "metadata_file_path": "${globals.saml.idp2.metadata_file_path}",
                        "sign_ref": [
                            {
                                "keystore": {
                                    "alias": "${globals.keystore.saml.sign_ref_keystore_alias}",
                                    "key_password": "${globals.keystore.saml.sign_ref_keystore_key_password}",
                                    "password": "${globals.keystore.saml.sign_ref_keystore_password}",
                                    "path": "${globals.keystore.saml.sign_ref_keystore_path}"
                                }
                            }
                        ]
                    }
                ],
                "metadata": [
                    {
                        "path": "${globals.file_paths.base_dir}/config/resources_internal/saml/sp_metadata_files/sp_portal.xml"
                    },
                    {
                        "path": "${globals.file_paths.base_dir}/config/resources_internal/saml/sp_metadata_files/sp_pwdreset.xml"
                    }
                ]
            }
        },
        {
            "name": "AuthN",
            "_info": "*** This is AuthN for IdP 1 ***",
            "enabled": true,
            "config": "@include:IdP_1_AuthN.json"
        },
        {
            "name": "Pipes",
            "_info": "*** This is Pipes for IdP 1 ***",
            "config": "@include:IdP_1_Pipes.json"
        },
        {
            "name": "AuthN",
            "_info": "*** This is AuthN for IdP 2 ***",
            "enabled": true,
            "config": "@include:IdP_2_AuthN.json"
        },
        {
            "name": "Pipes",
            "_info": "*** This is Pipes for IdP 2 ***",
            "config": "@include:IdP_2_Pipes.json"
        }
    ]
}

You can download the 6 JSON files here

multiple_json.zip