Use Cases
HomeIntegrityControlManagement CenterSolutions
  • Get Started
  • Integrity | Access
    • Auth. methods
      • LDAP (Username/Password)
      • LDAP (Username/Password) + OTP (SMTP)
      • LDAP (Username/Password) + OTP (SMS)
      • Swedish BankID
      • Microsoft Entra ID (SAMLSPBroker)
      • Foregin eID (SAMLSPBroker)
    • Auth. methods (SAML)
      • One-Time Password (OATH)
      • Inera IdP (SITHS) (SAMLSPBroker)
      • ID-porten (Norway) (SAML IdP with OIDC RP)
      • Multiple SAML IdP's configured
        • Multiple JSON files
    • Auth. methods (OIDC)
      • Static values (OIDC) - Test only
      • Swedish BankID (OIDC)
      • UID/PWD (OIDC)
    • Auth. methods (MISC)
      • Selector filtering
      • AuthZ control
      • External links and Cancel location
    • Add a Federation or SAML SP
  • Integrity | Portal
    • Portal
  • Integrity | Enrollment
    • Software token (OATH)
    • Best practice configuration
  • Integrity | Radius
    • UID/OATH token
    • UID/Password/OATH token
    • UID/Password/SMTP
  • Integrity | API
    • Swedish Siths eID
    • Oath Token
  • Control | Applications
    • Password Reset
    • Password Reset for Entra ID
    • Password Reset for Google Workspace
  • OPERATION
    • Rolling upgrade - cluster
  • TROUBLESHOOTING
    • Wrong relaystate
  • Misc
    • Address configuration externally
    • ADFS
      • Protect Fortified ID apps
      • Install and configure Fortified ID ADFS adapter for Siths eID
      • Install and configure Fortified ID ADFS adapter for Oath
    • AWS
      • Protect AWS Cognito with eID MFA
      • Protect AWS IAM Identity Center with eID MFA
    • Customization
      • Overlay - WEB
      • Overlay - Portal
      • Overlay - Password Reset
      • Overlay - Enrollment
      • Logout page
    • Dependency-Track - protect with eID MFA and SSO
    • Digitala Nationella Prov (DNP) / Skolfederation
      • Active Directory Federation Services (ADFS) with BankID as step-up-method
      • Active Directory / LDAP with BankID as step-up-method
      • Entra ID (Azure AD) with BankID as step-up-method
      • Google with BankID as step-up-method
      • Generate eduPersonPrincipalName (eppn) and store in Google
      • Generate eduPersonPrincipalName (eppn) and store in Entra ID
      • Common configuration
    • Encrypt configuration secrets
    • Microsoft Entra
      • Protect Entra ID (Azure AD) with eID MFA
      • Entra External - Support for eID (SAML)
      • Entra External - Support for eID (OIDC)
    • Expressions
    • Google
      • Common configuration for Google Workspace - Directory API
      • Common configuration for Google Workspace - authentication for Fortified ID products
      • Delegated administration for Google Workspace - teacher updates student guardians
      • Delegated administration for Google Workspace - teacher updates student password
      • Protect Google Workspace with eID MFA
    • HTTPS
    • Protect sensitive data, such as social security numbers, through obfuscation
    • Reverse proxy
      • Install Apache Web Server on Windows
      • Add SSL certificate and enable https
      • Add a Fortified ID virtual host
    • Set AuthnContextClassRef
    • Wiki.js - OpenID Connect (OIDC)
Powered by GitBook
On this page
  • Scenario
  • Prerequisite
  • Overview
  • Installation and configuration
  • Install and prepare configuration
  • Update configuration to map your environment
  • Add overlay folder to file system
  • Test your overlays
  • Test the Selector authenticator
  • Overlays
  • Overview of how it works
  • Overlay structure
  • Config.json file
  • Complete config.json file
  1. Misc
  2. Customization

Overlay - WEB

Change look and feel for Integrity WEB. Add new and/or update existing languages.

PreviousCustomizationNextOverlay - Portal

Last updated 1 year ago

Scenario

In this use case we are going to change the look and feel of some of the authenticators in Web. Note 1. We will browse directly to the different authenticators for testing the UI so there will be no SAML service provider (SP) available for authentication. Note 2. To test overlay in this use case we will use SAML as protocol.

Prerequisite

There are some prerequisite for this use case. You will need the following environment:

  • Integrity Web 2.0 or later installed and running.

    • Basic knowledge of Integrity Web.

Overview

If you want to use your own images and/or manage language files, there is a parameter called Overlay. This parameter is added per authenticator. Overlay_dirs was added to version 2.0 of Web to be able to point out multiple overlay folders. The need to be able to point out several folders mainly applies if you want e.g. a place where you have images and can from each authenticator point to it instead of each authenticating overlay folder having its own copy of the images. Overlay_dirs is mainly for convenience and has files in one place instead of several.

Installation and configuration

Install and prepare configuration

  1. Download and install Integrity Web

    1. To install Integrity Web, se installation use case. This is not covered in this use case.

  2. Rename the customer folder from the installation to /customer_ORG. All data in the /customer folder will be replaced with data from this use case.

  3. In the downloaded ZIP-file, add the customer folder to your installation.

    1. Note. The to make it simple you will address Fortified ID Web/SAML Identity Provider (IdP) directly, there is no need for a SAML Service Provider. However, the config.json has configuration to act as a SAML IdP for Fortified ID Password Reset application if you like to see configuration for it.

Update configuration to map your environment

The downloaded folders contains all information needed. For example, a test certificate and files are included and configured to work with the example applications. However, some data needs to be changed to match your environment. Since this example was done on a Windows server you might need to update file paths if you run something else. Also the http ports might need to be changed if they are not available in your environment.

To make it easy to change settings to your local environment. Go to the config folder and edit the file globals.json, that contains the information you need to change. Config.json uses the variables in globals.json.

Configure and update the settings below to match your environment, if needed, and then save the information.

  1. file_paths (see globals section in config.json) Update if needed to map your environment and configuration.

  2. http (see globals section in config.json) Update if needed to map your environment and configuration.

  3. keystore (see globals section in config.json). The keystore is included with certificate for HTTPS purpose. Update if needed to map your environment and configuration.

Add overlay folder to file system

  1. From the downloaded ZIP-file, copy all folders to C:\Program Files\FortifiedID\web\customer\config\resources_external\overlays

  2. Start the Fortified ID Web service. Verify the service is running.

Test your overlays

If you have added the folder structure and also use the example config.json file used in this use case. When you start Web everything should be ready to test.

Test the Selector authenticator

  1. Open a browser

  2. Below screenshot should be the result you should see. Test each option to see each selector option UI

Overlays

Overview of how it works

With overlays you can change the look and feel, add a new language or overwrite keys for the default languages. Integrity Web supports the use of several authenticators, each authenticator has it own settings for overlay, for example you like to change an UI background image on only the Selector authenticator but not the UserNameAndPassword authenticator. Since they have their own overlay configuration that is no problem. You can also choose to have the same overlay configuration for several authenticators, for example, several or all authenticators should have the same background.

In this use case we showcase different authenticators:

  • Selector (used to present authenticators below to end-user)

  • UserName/Password and OTP (used to verify username / password with OTP)

  • Freja OrgID (a swedish e-ID vendor)

  • Microsoft ADFS (integration with Microsoft federation service)

Note. You can use one authenticator several times for different purposes and they each have their own overlay setting. Two or more authenticators can also reference to the same folder, then they will use the same overlay settings.

Location of the overlay parameter in config.json

Open the config.json file. We will use selector_root as an example. Verify the parameter as described below, see screenshot of location:

All other authenticators have their own overlay configuration parameter. If not configured default will be used.

Overlay structure

Explanation of the asset folder structure

In the overlay folder for an authenticator there must be an \asset folder. In that folder you put the overlay files needed for your scenario.

  • ui_config_overrides.json In ui_config_overrides.json file you can for example do the following:

    • Add source and size for different logotypes/images

    • Add link to vendor logo

    • Add new language so the option will be available in the UI to choose.

    • In this file you can also change the tab name in the browser. We have called the tab, Litho Acme IdP.

  • Language files

    • Locales Add new language files to the \locales folder.

    • Custom locales If you like to override an default language (Swedish or English) then you add the file and the key to be replaced to the \custom_locales folder

    • Default languages If you like to verify the default languages and keys then you can look in file system and folder, \..\web\application\web\authenticator. Open an authenticator folder and open asset folder. Note: Do not make any changes here since it will be replaced when upgrade.

  • css_overrides.css This file includes all css overlay settings that you would like to override. For example, background and colors.

:root {
	/*MAIN colors for text and navigation support */	
	--color-primary: #016f92;
	--color-accent: #E19A6F;

	/*CONTENT styling*/
	--color-background: #8a8a8a;
	--color-surface: #ffffff;
	--color-backface: #f5f5f5;
	--color-on-primary: #ffffff;
	--color-on-surface: var(--color-primary);

	/* LINKS styling*/
	--color-link: #045e6c;
	--color-link-hover: #058194;

	/* HEADER banner for Portal, Enrolment, Pwd reset etc*/	
	--color-header-background: #1a3455;
	--color-header-text: #ffffff;

	/* BUTTON styling*/
	--color-button-background: #E19A6F;
	--color-button-background-hover: #1d1d1d;
	--color-button-text: #1d1d1d;
	--color-button-text-hover: #E19A6F;
	--button-border: 1px solid #E19A6F;
    --button-border-hover: 1px solid #E19A6F;
	--button-radius: 3rem;
	
	/* BACKGROUND image for authentication*/	
	--background-image: url("background.svg") no-repeat center center/cover fixed;

	/* SPINNER used for BankID, Freja, Fortified ID app and Passkey. Note, top is transparent*/
	--color-loader-indicator-top: rgba(0, 93, 136, 0.7);
	--color-loader-indicator-middle: #E19A6F;
	--color-loader-indicator-bottom: #016f92;
}
  • Asset folder (the name of the asset folder is the authenticator name, for example 3_main_username_password) All images and the favicon.ico that you like to address or use should be placed in this folder.

Config.json file

Complete config.json file

{
    "globals": "@include:globals.json",
    "modules": [
        {
            "name": "CefEventModule",
            "config": {}
        },
        {
            "name": "HttpClient",
            "config": {
                "name": "default",
                "ssl_trust_all": true,
                "idle_timeout_ms": 5000,
                "connect_timeout_ms": 5000
            }
        },
        {
            "name": "AuthN",
            "enabled": true,
            "config": {
                "context_path": "/authn",
                "webroot_dir": "web",
                "http_port": "${globals.http.port}",
                "http_use_ssl": true,
                "http_keystore_ref": {
                    "type": "${globals.keystore.https.ref.type}",
                    "path": "${globals.keystore.https.ref.path}",
                    "password": "${globals.keystore.https.ref.password}"
                },
                "http_keystore_type": "${globals.keystore.https.type}",
                "http_key_alias": "${globals.keystore.https.http_key_alias}",
                "http_key_password": "${globals.keystore.https.http_key_password}",
                "http_csrf": {
                    "enabled": false
                },
                "authenticators": [
                    {
                        "id": "auth00",
                        "type": "SAMLIDP",
                        "config": {
                            "context_path": "/saml/authn/chain",
                            "base_path": "/saml/authn",
                            "expiry": "PT1S",
                            "force_re_auth": false,
                            "idp": "https://fortifiedid.se/test_idp_1",
                            "chain": [
                                {
                                    "id": "selector_root",
                                    "required": true
                                },
                                {
                                    "id": "person_selector",
                                    "required": true
                                }
                            ],
                            "assertion_config": [
                                {
                                    "target_sp": [
                                        "*"
                                    ],
                                    "nameid_parameter": "mail",
                                    "auth_context_parameter": "AuthnContextClassRef",
                                    "additional_attribute_parameter": [
                                        "email",
                                        "display_name"
                                    ],
                                    "pre_assertion_pipe": "Retrieve_data_for_SAML_response"
                                }
                            ]
                        }
                    },
                    {
                        "id": "selector_root",
                        "type": "Selector",
                        "config": {
                            "base_path": "/saml/authn",
                            "_expiry": "PT1S",
                            "webroot_dir": "web/authenticator/selector",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/1_main_selector_root",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "options": [
                                {
                                    "id": "1",
                                    "target": "employee",
                                    "label": "Employee_label"
                                },
                                {
                                    "id": "2",
                                    "target": "partner",
                                    "label": "Partner_label"
                                },
                                {
                                    "id": "3",
                                    "target": "customer",
                                    "label": "Customer_label"
                                },
                                {
                                    "id": "4",
                                    "target": "password_reset",
                                    "label": "password_reset_demo_label",
                                    "type": "link"
                                }
                            ]
                        }
                    },
                    {
                        "id": "employee",
                        "type": "Selector",
                        "config": {
                            "base_path": "/saml/authn",
                            "webroot_dir": "web/authenticator/selector",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/2_main_selector",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "options": [
                                {
                                    "id": "1",
                                    "target": "uid_pwd",
                                    "label": "uid_generated_otp_label",
                                    "logo": "assets/svg/otp.svg"
                                },
                                {
                                    "id": "2",
                                    "target": "freja_orgid",
                                    "label": "Freja OrgID",
                                    "logo": "assets/svg/freja.svg"
                                },
                                {
                                    "id": "3",
                                    "target": "adfs",
                                    "label": "Microsoft ADFS",
                                    "logo": "assets/svg/adfs.svg"
                                }
                            ]
                        }
                    },
                    {
                        "id": "partner",
                        "type": "Selector",
                        "config": {
                            "base_path": "/saml/authn",
                            "webroot_dir": "web/authenticator/selector",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/2_main_selector",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "options": [
                                {
                                    "id": "1",
                                    "target": "1_0_uid_generated_otp",
                                    "label": "uid_generated_otp_label",
                                    "logo": "assets/svg/otp.svg"
                                },
                                {
                                    "id": "2",
                                    "target": "1_2_uid_freja",
                                    "label": "uid_freja_label",
                                    "logo": "assets/svg/freja.svg"
                                }
                            ]
                        }
                    },
                    {
                        "id": "customer",
                        "type": "Selector",
                        "config": {
                            "base_path": "/saml/authn",
                            "webroot_dir": "web/authenticator/selector",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/2_main_selector",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "options": [
                                {
                                    "id": "1",
                                    "target": "1_1_uid_bankid",
                                    "label": "uid_bankid_label",
                                    "logo": "assets/svg/bankid.svg"
                                },
                                {
                                    "id": "2",
                                    "target": "1_2_uid_freja",
                                    "label": "uid_freja_label",
                                    "logo": "assets/svg/freja.svg"
                                }
                            ]
                        }
                    },
                    {
                        "id": "password_reset",
                        "type": "Chain",
                        "config": {
                            "require_subject": false,
                            "base_path": "/saml/authn",
                            "chain": [
                                {
                                    "id": "1_1_username_validator",
                                    "required": true
                                },
                                {
                                    "id": "1_2_otp_validator",
                                    "required": true
                                }
                            ]
                        }
                    },
                    {
                        "id": "1_1_username_validator",
                        "type": "OTPValidator",
                        "config": {
                            "context_path": "/saml/authn/1_1_username_validator",
                            "proceed_on_error": true,
                            "pipe_id": "1_1_Validate_Username_and_generate_a_OTP",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/4_pwdreset_username_validation",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "webroot_dir": "web/authenticator/otp_validation",
                            "exports": [
                                {
                                    "name": "AuthnContextClassRef",
                                    "value": "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
                                },
                                {
                                    "name": "used_auth",
                                    "value": "un"
                                }
                            ]
                        }
                    },
                    {
                        "id": "1_2_otp_validator",
                        "type": "OTPValidator",
                        "config": {
                            "base_path": "/saml/authn",
                            "context_path": "/saml/authn/1_2_otp_validator",
                            "allowed_otp_retry": 2,
                            "proceed_on_error": true,
                            "pipe_id": "1_2_Validate_the_OTP",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/5_pwdreset_token_validation",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "webroot_dir": "web/authenticator/otp_validation",
                            "exports": [
                                {
                                    "name": "AuthnContextClassRef",
                                    "value": "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"
                                },
                                {
                                    "name": "used_auth",
                                    "value": "otp"
                                }
                            ]
                        }
                    },
                    {
                        "id": "uid_pwd",
                        "type": "UserNameAndPassword",
                        "config": {
                            "base_path": "/saml/authn",
                            "context_path": "/saml/authn/uid_pwd",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/3_main_username_password",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "pipe_id": "Validate_Username_Password",
                            "webroot_dir": "web/authenticator/username_password",
                            "exports": [
                                {
                                    "name": "AuthnContextClassRef",
                                    "value": "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
                                },
                                {
                                    "name": "used_auth",
                                    "value": "unpw"
                                }
                            ]
                        }
                    },
                    {
                        "id": "person_selector",
                        "type": "Impersonate",
                        "config": {
                            "base_path": "/saml/authn",
                            "expiry": "PT1S",
                            "overlay_dirs": [
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/6_main_impersonate_selector",
                                "${globals.file_paths.base_dir}/config/resources_external/overlays/0_look_and_feel"
                            ],
                            "pipe_id": "2_2_impersonate_selector",
                            "values": [
                                {
                                    "key": "displayName",
                                    "label": "label1"
                                },
                                {
                                    "key": "sAMAccountName",
                                    "label": "label2"
                                },
                                {
                                    "key": "mail",
                                    "label": "label3"
                                }
                            ],
                            "show_filtering": true,
                            "include_self": true,
                            "custom_identifier": "FortifiedID_Test",
                            "identifier_attribute": "mail",
                            "selected_id_parameter": "object_id",
                            "webroot_dir": "web/authenticator/impersonate_selector",
                            "execute_key": "spEntityID",
                            "execute_regex": "FortifiedID_OATH_SW|FortifiedID_PWD_Reset"
                        }
                    }
                ]
            }
        },
        {
            "name": "Pipes",
            "config": {
                "pipes": [
                    {
                        "id": "Retrieve_data_for_SAML_response",
                        "config": {
                            "valves": [
                                {
                                    "name": "DumpRequest",
                                    "config": {
                                        "label": "******* DumpRequest BEFORE Retrieve_data_for_SAML_response_for_PWD_Reset *******"
                                    }
                                },
                                {
                                    "name": "ItemPropertyRename",
                                    "config": {
                                        "new_name": "user_name",
                                        "old_name": "sAMAccountName"
                                    }
                                },
                                {
                                    "name": "ItemPropertyRename",
                                    "config": {
                                        "new_name": "email",
                                        "old_name": "mail"
                                    }
                                },
                                {
                                    "name": "ItemPropertyRename",
                                    "config": {
                                        "new_name": "display_name",
                                        "old_name": "displayName"
                                    }
                                },
                                {
                                    "name": "DumpState",
                                    "config": {
                                        "label": "******* DumpState AFTER Retrieve_data_for_SAML_response_for_PWD_Reset *******"
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    ]
}

Download with example overlay data for this use case.

The result should look like:

Browse to

ZIP-file
https://localhost:8443/saml/authn/chain