View
218
Download
2
Category
Preview:
Citation preview
1. Purpose This document describes enterprise group settings on BlueJeans (service provider) and necessary configurations at PingFederate (identity provider) to setup single sign on (SSO) using SAML 2.0. The SAML message flows including auth-‐request, response and few other important parameters are shown to provide in-‐depth understanding of how the 3 entities -‐ Browser, SP (BlueJeans) and IdP (PingFed) interact with each other. Tools such as SAML tracer, Fiddler, etc. could be used in your setup to corroborate the messages with the working scenario. Also provided are the screen shots of the BlueJeans admin group settings and PingFed configuration summary of a working setup for comparison purpose.
2. Configurations
2.1 Turning on SAML SSO Login The SSO login is enabled by the group administrator for the entire enterprise through BlueJeans settings as shown below; BlueJeans Settings
2.2 Auto Provisioning User Account
The auto provisioning feature allows the user account to be created dynamically when the user login through SSO for the first time. The enterprise group admin has to explicitly turn-‐on this option through BlueJeans settings. BlueJeans Settings
2.3 XML Metadata
The SAML 2.0 standards define a metadata exchange schema for conveying XML-‐formatted information between two SAML entities. Metadata includes endpoint URLs, binding types, attributes, and security-‐policy information that service provider gives to identity provider.
The metadata info is published at BlueJeans -‐ http://bluejeans.com/support/saml-‐metadata.xml. Please refer to chapter 5, sec. ‘Importing Metadata’ in PingFederate Admin Manual for how to import the xml metadata on PingFederate. Ensure the metadata is correctly mapped to ‘base url’ and ‘ACS Endpoint URL’ in PingFed’s connection settings. Metadata XML
PingFed Settings
<md:AssertionConsumerService isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0: bindings:HTTP-POST" Location="https://bluejeans.com/sso/saml2/" index="0"/> <md:RequestedAttribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="Email" isRequired="true"> </md:RequestedAttribute>
General Info
Base URL https://bluejeans.com
Assertion Consumer Service URL
Endpoint URL: /sso/saml2/ (POST)
Allowable SAML Bindings
POST true
Attribute Contract
Attribute Email
2.4 Importing IdP provided certificate for SAML signed assertions As the assertion passes through intermediary (such as user’s browser) BlueJeans mandates the SAML assertions to be always signed. Enable the always sign option under Protocol Settings (PingFed Admin Manual – Chapter 5, section ‘Configuring Signature Policy’) PingFed Settings:
Download the certificate from PingFed by following the steps listed in the Admin Manual – Chapter 4, section ‘Digital Signing and Decryption Keys& Certificates’. Import the certificate into BlueJeans through Group Setting as shown below;
BlueJeans Settings
2.5 Configuring Remote IdP URLs
The IdP (PingFederate) allows default or customized URL settings for signing, error page and logout. The application integration setting allows configuring IdP adapters and defining URLs for this purpose. Refer to chapter 5 of PingFed Admin Manual for more information.
After noting these URLs from PingFed settings summary, configure it through BlueJeans admin security page.
BlueJeans Settings
2.6 SAML Attribute Contracts
This is one of the most important steps of the provisioning process. An attribute contract represents an agreement between an SP and an IdP about user attributes sent in a SAML assertion. The contract is a list of case-‐sensitive attribute names. IdPs and SPs must configure attribute contracts to match.
For BlueJeans the ‘Email’ attribute is mandatory. The other used attribute is ‘User Id’. Please note the ‘Auto-‐Configure’ option does not work. The admin has to manually match these two attribute names at both PingFed and BlueJeans end.
PingFed Settings
PingFed Settings Summary
BlueJeans Group Admin Settings:
3. SAML Message Flows The user initiates the SSO login through custom login page, which triggers series of messages between the 3 entities – Browser, BlueJeans (SP), and PingFederate (IdP). The following diagram depicts the end-‐end flow.
In the example above, the user belongs to beta (z2) partition just to illustrate the fact that all SSO requests, responses and assertion are always handled by the live (z1) partition. Each step is discussed in greater detail including sample messages.
bluejeans.com
z2.bluejeans.com
Service Provider Identity Provider
PingFederate
sso.equinix.com
equinix.bluejeans.com CLP
1 2 3 4 5 6
7 8 9
5
10
SP Initiated SSO Processing Flow
BlueJeans Scheduling
Page
User initiates SSO Login from Custom Login Page
1. User clicks the ‘Login’ button on the BlueJeans custom landing page Browser launches the auth request by sending HTTP-‐POST request to the Service Provider (BlueJeans custom landing site; URL: equinix.bluejeans.com) E.g. POST https://equinix.bluejeans.com/sso/saml2/auth_request/?enterpriseId=1853&mode=auth HTTP/1.1
2. Service Provider initiates SAML request for user authentication BlueJeans initiates SAML request by redirecting the browser to IdP’s signing URL. Note the ‘RelayState’ parameter that acts as an opaque token to the state information at BlueJeans end. It is expected that same ‘RelayState’ value be returned back in SAML response. E.g. HTTP/1.1 200 OK Date: Thu, 16 Jan 2014 01:39:06 GMT Server: Apache/2.2.22 (Ubuntu) ..... {"redirectURL": "http://sso.equinix.com/idp/SSO.saml2?SAMLRequest=fZHRTsIwFIbvfYqm99vaMdfRsBHQGDGIBIYX3phuVJlu7ezp0Md3Y5DADZdN%2FvP1%2FN8Zjf%2BqEu2lgUKrGFOXYCRVrreF%2BozxJn1wIjxObkYgqtKv%2BaSxO7WSP40EiyYA0th27k4raCpp1tLsi1xuVvMY76ytgXteVjbySwoFbq4rD0B7B5SH0ew%2Bxu9hGGQ%2BYdktzcIoYCRgWZSRbcgo%2ByAsYMOcChENB20coJEzBVYoG2Of0MAh1KFhSigfDDlhLqH0DaOl0VbnupwWqi%2FRGMW1gAK4EpUEbnO%2BnjzPue8SnvUh4I9punSWL%2Bv0ANgXW2kWbTrG03Z%2F9NQVQAtpf7X5xuj1pMvvdLUCFfBe0PXf6uNqOOl98kMnc064DhAn4zjp%2FLZ6uyGo3QvLI%2B%2Bcnhyfl8dL%2FgE%3D&RelayState=eyJncm91cCI6ICIxODUzIiwgIm1vZGUiOiAiYXV0aCJ9", "message": null,"success": true}
3. Browser sends a SAML request to IdP Browser triggers SAML request on instruction from BlueJeans. The URL content and other parameters are same as received in HTTP response of step 2. E.g. GET http://sso.equinix.com/idp/SSO.saml2?SAMLRequest=fZHRTsIwFIbvfYqm99vaMdfRsBHQGDGIBIYX3phuVJlu7ezp0Md3Y5DADZdN%2FvP1%2FN8Zjf%2BqEu2lgUKrGFOXYCRVrreF%2BozxJn1wIjxObkYgqtKv%2BaSxO7WSP40EiyYA0th27k4raCpp1tLsi1xuVvMY76ytgXteVjbySwoFbq4rD0B7B5SH0ew%2Bxu9hGGQ%2BYdktzcIoYCRgWZSRbcgo%2ByAsYMOcChENB20coJEzBVYoG2Of0MAh1KFhSigfDDlhLqH0DaOl0VbnupwWqi%2FRGMW1gAK4EpUEbnO%2BnjzPue8SnvUh4I9punSWL%2Bv0ANgXW2kWbTrG03Z%2F9NQVQAtpf7X5xuj1pMvvdLUCFfBe0PXf6uNqOOl98kMnc064DhAn4zjp%2FLZ6uyGo3QvLI%2B%2Bcnhyfl8dL%2FgE%3D&RelayState=eyJncm91cCI6ICIxODUzIiwgIm1vZGUiOiAiYXV0aCJ9 HTTP/1.1
4. IdP challenges the user for authentication The PingFederate runtime engine challenges user to provide credentials. A pop-‐up is seen on the browser to enter username and password E.g. HTTP/1.1 401 Unauthorized
5. Browser provides user credentials On the user entering username and password, the browser sends it in authorization header to PingFederate. E.g. GET https://sso.equinix.com/idp/SWQE2/resumeSAML20/idp/SSO.ping HTTP/1.1 ....... Connection: Keep-‐Alive Cookie: JSESSIONID=17w3gkm2m4cce1qoigzwznta2x; PF=grXTPmFEdtVClEFfAysFovJ4qkQ49hR5wdD7wr92Aoi0 Authorization: NTLM TlRMTVNTUAADAAAAGAAYAIYAAAAeAR4BngAAAAwADABYAAAADAAMAGQAAAAWABYAcAAAAAAAAAC8AQAABYKIIgYBsR0AAAAPLph1mEGap9wZd+9XgSgN7kcATABPAEIAQQBMAHIAcwBlAHQAaABpAFUAUwBMAFAAMwBHAFIAWQA0AFEAMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC55oBfZ0s9jjbemAaeQdt7AQEAAAAAAABWHdjCWxLPAe5vMw5mXsjzAAAAAAIADABHAEwATwBCAEEATAABABIAUABJAE4ARwBBAEcARQBOAFQABAAkAGcAbABvAGIAYQBsAC4AZQBxAHUAaQBuAGkAeAAuAGMAbwBtAAMAFABTAFYAMgBQAEcARgBFAEQAMAAxAAgAMAAwAAAAAAAAAAAAAAAAMAAAnwuKqYRp8Cm8TmsXNr9E9ZkQWLfg7JWkC4dmy95a1g4GAAQABAAAAAoAEAA4nfB9tKN0m+HCMcymx1GeCQAwAEgAVABUAFAALwBzAHMAbwAuAHcAaQBwAC4AZQBxAHUAaQBuAGkAeAAuAGMAbwBtAAAAAAAAAAAA Host: sso.equinix.com
6. IdP authenticates and sends back SAML Response Once the user is authenticated, the PingFederate generates a signed SAML assertion to the SP’s (BlueJeans) Assertion Consumer Service (ACS) endpoint (https://bluejeans.com/sso/saml2/ as given in metadata). [Note: It was found in some instances, the ACS URL was missing ‘/’ at the end in the configuration. It could be the PingFederate is dropping it while importing the metadata. This might lead to parameters such as ‘RelayState’ not to be appended correctly in the SAML response leading to login failure] E.g. HTTP/1.1 200 OK ....... <!-‐-‐ template name: form.autopost.template.html -‐-‐> <html> <head> <title>Submit Form</title> </head> <body onload="javascript:document.forms[0].submit()"> <noscript> <p> <strong>Note:</strong> Since your browser does not support JavaScript, you must press the Resume button once to proceed. </p> </noscript> <form method="post" action="https://bluejeans.com/sso/saml2/"> <input type="hidden" name="SAMLResponse" value="PHNhbWxwOlJlc3BvbnNlIEluUmVzcG9uc2VUbz0iXzY2NGIyMDdiNTFiNjg0NzA0N2I4YjBkNjcxN2YwNzQ3OWMxYWE4OTMiIElzc3VlSW5zdGFudD0iMjAxNC0wMS0xNlQwMTozOToxMS44MDhaIiBJRD0iTnlxNWpkWmZaRTFNYlFUbGwtdS40YmVuQmdLIiBWZXJzaW9uPSIyLjAiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sOklzc3VlciB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5FcXVpbml4U1NPPC9zYW1sOklzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48c2FtbDpBc3NlcnRpb24gVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDEtMTZUMDE6Mzk6MTIuNTU4WiIgSUQ9ImhQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI+PHNhbWw6SXNzdWVyPkVxdWluaXhTU088L3NhbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0d HA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgo8ZHM6U2lnbmVkSW5mbz4
KPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPgo8ZHM6UmVmZXJlbmNlIFVSST0iI2hQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSI+CjxkczpUcmFuc2Zvcm1zPgo8ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz4KPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPgo8L2RzOlRyYW5zZm9ybXM+CjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPgo8ZHM6RGlnZXN0VmFsdWU+ajlpbjRTMmw0RTlrbml0OUhJQ042d3NXTFlRPTwvZHM6RGlnZXN0VmFsdWU+CjwvZHM6UmVmZXJlbmNlPgo8L2RzOlNpZ25lZEluZm8+CjxkczpTaWduYXR1cmVWYWx1ZT4KVWJmQ0dlQUhROFRGKytRb2JSYTNBSzdpRXlOMVJzNktybGFLOWp1TFN3THlPT2dUNXR4cVRMODFGQm8wdkRrVm1KNFJ6M01xa3JWZQptRGtkaWY4OHV3ZjVOSFJRbi9iNG1HMW0rc3JuQkpFVE5ZWFkxV2ZzQm9GY3NnWTdkREtMYjBrcDVYWlo3azRGL1lVamJCbVRZaVV3ClNpTzFZb1lkWmFSbzZoSW9qL3ZzRGg0NU8weHNXL3g2cXVPYnIxdDB5eW9MQnovZkZjNHgxV0FwOXVIODR5K2JGbm40NWN2WjFscWUKN3gyUVVIeDlBVjhVV1BhL0ZzVHFXbzRlaTFOZTBha3ZsUTBGRE9kUjZqcjM5OW1jb1E5U2pOUVh4Qy8wSG82YkdjUkJsYTZMTWVtVgpWWWNRT1kwdE05QWZJSWhMSnM3SE1ER2E2ZWx1aTA0MXVGQUkxQT09CjwvZHM6U2lnbmF0dXJlVmFsdWU+CjwvZHM6U2lnbmF0dXJlPjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPnJzZXRoaTwvc2FtbDpOYW1lSUQ+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb25EYXRhIEluUmVzcG9uc2VUbz0iXzY2NGIyMDdiNTFiNjg0NzA0N2I4YjBkNjcxN2YwNzQ3OWMxYWE4OTMiIE5vdE9uT3JBZnRlcj0iMjAxNC0wMS0xNlQwMTo0NDoxMi41NThaIiBSZWNpcGllbnQ9Imh0dHBzOi8vYmx1ZWplYW5zLmNvbS9zc28vc2FtbDIvIi8+PC9zYW1sOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sOlN1YmplY3Q+PHNhbWw6Q29uZGl0aW9ucyBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDEtMTZUMDE6NDQ6MTIuNTU4WiIgTm90QmVmb3JlPSIyMDE0LTAxLTE2VDAxOjM0OjEyLjU1OFoiPjxzYW1sOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWw6QXVkaWVuY2U+aHR0cDovL3NhbWxzcC5ibHVlamVhbnMuY29tPC9zYW1sOkF1ZGllbmNlPjwvc2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1sOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wMS0xNlQwMTozOToxMi41NThaIiBTZXNzaW9uSW5kZXg9ImhQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSI+PHNhbWw6QXV0aG5Db250ZXh0PjxzYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOnVuc3BlY2lmaWVkPC9zYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDpBdXRobkNvbnRleHQ+PC9zYW1sOkF1dGhuU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZVN0YXRlbWVudCB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPjxzYW1sOkF0dHJpYnV0ZSBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIiBOYW1lPSJVc2VyIElkIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIj5yc2V0aGk8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyIgTmFtZT0iRW1haWwiPjxzYW1s
OkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiPnJzZXRoaUBlcXVpbml4LmNvbTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjwvc2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg=="/> <input type="hidden" name="RelayState" value="eyJncm91cCI6ICIxODUzIiwgIm1vZGUiOiAiYXV0aCJ9"/> <noscript><input type="submit" value="Resume"/></noscript> </form> </body> </html>
7. Browser posts the SAML response to the SP The browser constructs the HTTP-‐POST request including the SAML Response as the body. It sends request to action URL given in the previous step (https://bluejeans.com/sso/saml2/ in our case). Please observe if the ‘RelayState’ parameter is appended appropriately at the end of the SAML Response. E.g. POST https://bluejeans.com/sso/saml2/ HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: https://sso.equinix.com/idp/SWQE2/resumeSAML20/idp/SSO.ping User-‐Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Content-‐Type: application/x-‐www-‐form-‐urlencoded …….. SAMLResponse=PHNhbWxwOlJlc3BvbnNlIEluUmVzcG9uc2VUbz0iXzY2NGIyMDdiNTFiNjg0NzA0N2I4YjBkNjcxN2YwNzQ3OWMxYWE4OTMiIElzc3VlSW5zdGFudD0iMjAxNC0wMS0xNlQwMTozOToxMS44MDhaIiBJRD0iTnlxNWpkWmZaRTFNYlFUbGwtdS40YmVuQmdLIiBWZXJzaW9uPSIyLjAiIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPjxzYW1sOklzc3VlciB4bWxuczpzYW1sPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5FcXVpbml4U1NPPC9zYW1sOklzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48L3NhbWxwOlN0YXR1cz48c2FtbDpBc3NlcnRpb24gVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDEtMTZUMDE6Mzk6MTIuNTU4WiIgSUQ9ImhQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiI%2BPHNhbWw6SXNzdWVyPkVxdWluaXhTU088L3NhbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgo8ZHM6U2lnbmVkSW5mbz4KPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4KPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPgo8ZHM6UmVmZXJlbmNlIFVSST0iI2hQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSI%2BCjxkczpUcmFuc2Zvcm1zPgo8ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz4KPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPgo8L2RzOlRyYW5zZm9ybXM%2BCjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPgo8ZHM6RGlnZXN0VmFsdWU%2BajlpbjRTMmw0RTlrbml0OUhJQ042d3NXTFlRPTwvZHM6RGlnZXN0VmFsdWU%2BCjwvZHM6UmVmZXJlbmNlPgo8L2RzOlNpZ25lZEluZm8%2BCjxkczpTaWduYXR1cmVWYWx1ZT4KVWJmQ0dlQUhROFRGKytRb2JSYTNBSzdpRXlOMVJzNktybGFLOWp1TFN3THlPT2dUNXR4cVRMODFGQm8wdkRrVm1KNFJ6M01xa3JWZQptRGtkaWY4OHV3ZjVOSFJRbi9iNG1HMW0rc3JuQkpFVE5ZWFkxV2ZzQm9GY3NnWTdkREtM
YjBrcDVYWlo3azRGL1lVamJCbVRZaVV3ClNpTzFZb1lkWmFSbzZoSW9qL3ZzRGg0NU8weHNXL3g2cXVPYnIxdDB5eW9MQnovZkZjNHgxV0FwOXVIODR5K2JGbm40NWN2WjFscWUKN3gyUVVIeDlBVjhVV1BhL0ZzVHFXbzRlaTFOZTBha3ZsUTBGRE9kUjZqcjM5OW1jb1E5U2pOUVh4Qy8wSG82YkdjUkJsYTZMTWVtVgpWWWNRT1kwdE05QWZJSWhMSnM3SE1ER2E2ZWx1aTA0MXVGQUkxQT09CjwvZHM6U2lnbmF0dXJlVmFsdWU%2BCjwvZHM6U2lnbmF0dXJlPjxzYW1sOlN1YmplY3Q%2BPHNhbWw6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPnJzZXRoaTwvc2FtbDpOYW1lSUQ%2BPHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb25EYXRhIEluUmVzcG9uc2VUbz0iXzY2NGIyMDdiNTFiNjg0NzA0N2I4YjBkNjcxN2YwNzQ3OWMxYWE4OTMiIE5vdE9uT3JBZnRlcj0iMjAxNC0wMS0xNlQwMTo0NDoxMi41NThaIiBSZWNpcGllbnQ9Imh0dHBzOi8vYmx1ZWplYW5zLmNvbS9zc28vc2FtbDIvIi8%2BPC9zYW1sOlN1YmplY3RDb25maXJtYXRpb24%2BPC9zYW1sOlN1YmplY3Q%2BPHNhbWw6Q29uZGl0aW9ucyBOb3RPbk9yQWZ0ZXI9IjIwMTQtMDEtMTZUMDE6NDQ6MTIuNTU4WiIgTm90QmVmb3JlPSIyMDE0LTAxLTE2VDAxOjM0OjEyLjU1OFoiPjxzYW1sOkF1ZGllbmNlUmVzdHJpY3Rpb24%2BPHNhbWw6QXVkaWVuY2U%2BaHR0cDovL3NhbWxzcC5ibHVlamVhbnMuY29tPC9zYW1sOkF1ZGllbmNlPjwvc2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjwvc2FtbDpDb25kaXRpb25zPjxzYW1sOkF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxNC0wMS0xNlQwMTozOToxMi41NThaIiBTZXNzaW9uSW5kZXg9ImhQUVpha1BoXzkxU3FIaVF5dXA5aTRrV2tUNSI%2BPHNhbWw6QXV0aG5Db250ZXh0PjxzYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOnVuc3BlY2lmaWVkPC9zYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDpBdXRobkNvbnRleHQ%2BPC9zYW1sOkF1dGhuU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZVN0YXRlbWVudCB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPjxzYW1sOkF0dHJpYnV0ZSBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIiBOYW1lPSJVc2VyIElkIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIj5yc2V0aGk8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyIgTmFtZT0iRW1haWwiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiPnJzZXRoaUBlcXVpbml4LmNvbTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjwvc2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PC9zYW1sOkFzc2VydGlvbj48L3NhbWxwOlJlc3BvbnNlPg%3D%3D&RelayState=eyJncm91cCI6ICIxODUzIiwgIm1vZGUiOiAiYXV0aCJ9
8. SP validates the assertion and accepts user login. SSO flow is complete The SAML response comes back to live partition (z1) of blueJeans.com. On decoding the SAML response, it looks for the attributes of interest (mapped previously). In this case ‘Email’ and ‘User Id’. The signed assertion is validated and login is allowed. E.g. Decoded SAML Response <samlp:Response InResponseTo="_d684b9a68631aa191ae193197afa9acbc7146cac" IssueInstant="2014-‐01-‐15T23:35:44.959Z" ID="H-‐Ffase7vMRsSxGN6Mpb2Iq5-‐O-‐" Version="2.0> …. <saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-‐format:basic" Name="User Id"> <saml:AttributeValue xsi:type="xs:string">rsethi</saml:AttributeValue></saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-‐format:basic" Name="Email"><saml:AttributeValue xsi:type="xs:string">rsethi@equinix.com</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response> In the call flow shown above the user belongs to beta partition (z2), thus redirects the browser to z2.bluejeans.com. E.g. Redirecting user to appropriate partition HTTP/1.1 302 FOUND Date: Thu, 16 Jan 2014 01:39:13 GMT Server: Apache/2.2.22 (Ubuntu) Vary: Cookie,Accept-‐Encoding Location: https://z2.bluejeans.com/scheduling?auth_token=01402f827e4f11e3aadc00266cf42948 Cache-‐Control: no-‐cache, no-‐store, must-‐revalidate, max-‐age=0 P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-‐Cookie: sessionid=dfd48092be3ee734f1bfece82bff16da; httponly; Path=/;HttpOnly; secure Set-‐Cookie: xd_sessionid=cc655f29bcf58343c0afe7485c2e36c6; Domain=.bluejeans.com; expires=Thu, 16-‐Jan-‐2014 01:41:13 GMT; httponly; Max-‐Age=120; Path=/;HttpOnly; secure Content-‐Length: 0 Keep-‐Alive: timeout=15, max=98 Connection: Keep-‐Alive Content-‐Type: text/html; charset=utf-‐8
9, 10. Browser sends request to beta partition and scheduling page is rendered This step is optional and depends on if the user is located in live or beta partition. If the user is in live partition, the scheduling page is rendered at step 8 itself. At this point the SSO flow is already complete. E.g. GET https://z2.bluejeans.com/scheduling/?auth_token=01402f827e4f11e3aadc00266cf42948 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: https://sso.equinix.com/idp/SWQE2/resumeSAML20/idp/SSO.ping Accept-‐Language: en-‐US User-‐Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Accept-‐Encoding: gzip, deflate Host: z2.bluejeans.com Cookie: sessionid=dfd48092be3ee734f1bfece82bff16da; xd_sessionid=cc655f29bcf58343c0afe7485c2e36c6 Connection: Keep-‐Alive Cache-‐Control: no-‐cache Scheduling page is rendered HTTP/1.1 200 OK ... <!DOCTYPE html PUBLIC "-‐//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-‐transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" class="snowy "><head> <meta name="viewport" content="width=device-‐width, initial-‐scale=1.0, maximum-‐scale=1.0"> <meta name="robots" content="noindex, nofollow"> <title>Meetings -‐ Blue Jeans Network | Video Collaboration in the Cloud </title>
Recommended