TracCloudTechSSO: Difference between revisions

From Redrock Wiki

No edit summary
No edit summary
 
(7 intermediate revisions by the same user not shown)
Line 1: Line 1:
{| style="width:100%; vertical-align:top; "
{{TracCloudGuideTabs}}
| style="width:250px; vertical-align:top; padding:2px 15px 2px 2px;" | {{TracCloudTechTOC}}
<div class="tcWidgetPage">
| style="vertical-align:top; padding:20px 20px 20px 2px;" |
<div class="category">
{| style="width:100%; vertical-align:top; "
{{TracCloudTechTOC}}
</div>
<big><b>TracCloud Single Sign-on Configuration</b></big><br>
<big><b>TracCloud Single Sign-on Configuration</b></big><br>


Line 8: Line 9:


We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]
We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]
<hr>
<div class="line"></div>
'''With Redrock Software's Assistance'''
'''With Redrock Software's Assistance'''
<hr>
<div class="line"></div>
==SAML==
==SAML==
To setup SAML authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span>
To setup SAML authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span>
Line 60: Line 61:
<div style="float: left; margin-top: 0em; margin-bottom: 1em"><big>SAML Configuration</big></div><div class="mw-collapsible mw-collapsed"><br><br>
<div style="float: left; margin-top: 0em; margin-bottom: 1em"><big>SAML Configuration</big></div><div class="mw-collapsible mw-collapsed"><br><br>
<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>
<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>
[[File:5868886.png|800px]]<br><br>
[[File:8589517.png|800px]]


<big>1. Install our Metadata</big>
<big>1. Install our Metadata</big>
::Redrock Metadata: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml
::Redrock Metadata: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml<br><br>
 


<big>2. Fill out SAML settings</big>
<big>2. Fill out SAML settings</big>
Line 80: Line 80:
:::Your staff may have more than one account type in the Trac System. You can use the "Authentication Order" preference to determine which account type authenticates first.
:::Your staff may have more than one account type in the Trac System. You can use the "Authentication Order" preference to determine which account type authenticates first.


:* <b>Install your Metadata</b>
:* <b>Install your Metadata in the Primary Metadata field</b>
:::[[File:6tuk56hyttkl68.png|500px]]
:::[[File:2807471.png|500px]]
:::After submitting, your Entity ID field will be populated automatically.
:::After submitting, your Entity ID field will be populated automatically. If you require a duel-tenant configuration, reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] for assistance.<br><br>
 


<big>3. Retrieve your attributes</big>
<big>3. Retrieve your attributes</big>
:[[File:6556j67k657kuy.png|500px]]
:[[File:6978515.png|500px]]
:Navigate to the provided URL in a Private/Incognito browser and login, you will be provided with a list of attributes and their value for the account that you used. Find the attribute that works for your system (e.g., first part of email address) and copy the name of that attribute into the "Attribute containing unique ID" field in TracCloud. This will need to correspond to the Username fields of accounts in the system.
:Navigate to the provided URL in a Private/Incognito browser and login, you will be provided with a list of attributes and their value for the account that you used. Find the attribute that works for your system (e.g., first part of email address) and copy the name of that attribute into the "Attribute containing unique ID" field in TracCloud. This will need to correspond to the Username fields of accounts in the system.<br><br>
 


<big>4. Enable SAML</big>
<big>4. Enable SAML</big>
:Enable the toggle option in the top-right corner of your SAML window to enable SAML authentication for future logins.
:Enable the toggle option in the top-right corner of your SAML window to enable SAML authentication for future logins.
:[[File:75kj5yh56j56kj5ryh.png|800px]]
:[[File:75kj5yh56j56kj5ryh.png|800px]]<br><br>
 


<big>(Optional) 5. Custom Logout URL</big>
:Directly below your SSO options, you will find a field to input a custom logout URL. This is the URL that users will be taken to when exiting the Trac System, typically used to also end their SSO session.
:[[File:4h546ik5rh56k5j5.png|800px]]
</div>
</div>
<HR>
<HR>
Line 103: Line 97:


<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>
<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>
[[File:53754iu576h4j343.png|800px]]
[[File:6231962.png|800px]]
<br><br>
<br><br>
<big>1. Add Redrock as an authorized service</big>
<big>1. Add Redrock as an authorized service</big>
Line 130: Line 124:
:*<b>Trac Return URL</b>
:*<b>Trac Return URL</b>
:::Place your CAS Logout URL here.
:::Place your CAS Logout URL here.
:* <b>Deauth when visiting KIOSK</b>
:::Kiosks are typically student-facing. If this is checked, it ends the SSO session to prevent a user from navigating to other campus services or even logging back into TracCloud.


<big>3. Enable CAS</big>
<big>3. Enable CAS</big>
Line 136: Line 133:
</div>
</div>
<HR>
<HR>
|}
<div style="float: left; margin-top: 0em; margin-bottom: 1em"><big>Additional Login/Logout Settings</big></div><div class="mw-collapsible mw-collapsed"><br><br>
 
After setting up the SSO protocol, there are a few optional settings to configure, detailed below.
 
[[File:1811987.png|800px]]<br><br>
 
* <b>Log Off Redirect URL</b>
::This is the URL that users will be taken to when logging out of the Trac System, typically used to redirect users to a page that ends their single sign-on session.<br><br>
 
* <b>Custom "No Access" Page URL</b>
::By default, if a user attempts to access a page that they don't have access to, a generic "Access Denied" page will display from TracCloud. If you would prefer to override this with a different page, enter that URL here.<br><br>
 
* <b>Block SSO users from kiosk</b>
::If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.
 
</div>
<hr>
 
[[Category:TracCloud]]
</div>

Latest revision as of 10:54, 15 November 2023

TracCloud Single Sign-on Configuration

TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below.

We can be reached at helpdesk@go-redrock.com

With Redrock Software's Assistance

SAML

To setup SAML authentication, the following steps will need to be completed. At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.

1. Install our Metadata

Available here: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml

2. Send us your Metadata

Either a URL or an XML file.

3. Send us a test account

This makes implementing SAML on your system significantly faster, but isn't required.

CAS

To setup CAS authentication:

1. Add Redrock as an authorized service

Here is our URL: https://sso.trac.cloud/cas_return.php

2. Send us your CAS settings

  • CAS Login URL
  • CAS Validate URL
  • CAS Logout URL


LDAP

To setup LDAP authentication:

1. Send us your LDAP settings

  • Server Address
  • Port Number
  • Service account name (if applicable)
  • Service account password (if applicable)
  • Base DN

Multiple base DN searches can be performed if needed.


Without Redrock Software's Assistance

If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at helpdesk@go-redrock.com or by submitting a helpdesk ticket. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.


SAML Configuration


Other > Other Options > Preferences > Login & Security Settings > SAML 8589517.png

1. Install our Metadata

Redrock Metadata: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml

2. Fill out SAML settings

  • Trac Return URL
"https://traccloud.go-redrock.com/campuscode/trac/ajax.php?proc=sso_validate"
Replace 'campus code' with your campus code, as seen in your URL. Otherwise static. Must be lowercase.
If using a custom URL, use that in place of traccloud.go-redrock.com/campuscode
  • SAML Relay URL
"https://saml2.go-redrock.com/relay.php"
This is static and never changes.
  • Authentication Order
Your staff may have more than one account type in the Trac System. You can use the "Authentication Order" preference to determine which account type authenticates first.
  • Install your Metadata in the Primary Metadata field
2807471.png
After submitting, your Entity ID field will be populated automatically. If you require a duel-tenant configuration, reach out to us at helpdesk@go-redrock.com for assistance.

3. Retrieve your attributes

6978515.png
Navigate to the provided URL in a Private/Incognito browser and login, you will be provided with a list of attributes and their value for the account that you used. Find the attribute that works for your system (e.g., first part of email address) and copy the name of that attribute into the "Attribute containing unique ID" field in TracCloud. This will need to correspond to the Username fields of accounts in the system.

4. Enable SAML

Enable the toggle option in the top-right corner of your SAML window to enable SAML authentication for future logins.
75kj5yh56j56kj5ryh.png


CAS Configuration


Other > Other Options > Preferences > Login & Security Settings > CAS 6231962.png

1. Add Redrock as an authorized service

Here is our URL: https://sso.trac.cloud/cas_return.php

2. Fill out CAS settings

  • CAS Relay URL
"https://sso.trac.cloud/relay.php"
This value is static and should not be changed.
  • Ticket URL
Place your CAS Login URL here.
  • Ticket Param
Typically "ticket"
  • Validate URL
Place your CAS Validate URL here.
  • CAS Version
Typically "2.0"
  • User Name Attribute
Typically "cas:user"
  • Trac Return URL
Place your CAS Logout URL here.
  • Deauth when visiting KIOSK
Kiosks are typically student-facing. If this is checked, it ends the SSO session to prevent a user from navigating to other campus services or even logging back into TracCloud.

3. Enable CAS

Enable the toggle option in the top-right corner of your CAS window to enable CAS authentication for future logins.
J54yh545m56j5j.png

Additional Login/Logout Settings


After setting up the SSO protocol, there are a few optional settings to configure, detailed below.

1811987.png

  • Log Off Redirect URL
This is the URL that users will be taken to when logging out of the Trac System, typically used to redirect users to a page that ends their single sign-on session.

  • Custom "No Access" Page URL
By default, if a user attempts to access a page that they don't have access to, a generic "Access Denied" page will display from TracCloud. If you would prefer to override this with a different page, enter that URL here.

  • Block SSO users from kiosk
If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.