SAML - Configuring Swedish BankID as an authentication method for PhenixID server
The purpose of this document is to describe how to configure PhenixID server for federation with SAML2 using Swedish BankID as an authentication method for PhenixID server.
Prerequisites
- PhenixID Server configured according to this instruction: "Federation - Username and password"
- BankID test client certificate (FPTestcert2_20150818_102329.pfx will be used for test environments)
- BankID customer client certificate (for production environments)
- Access to BankIDs infrastructure from the PhenixID Server
Add the BankID certificate to the configuration
Convert the Federation - Username and Password scenario to SAML2BankID
Open the Advanced tab and locate the Authentication - HTTP entry that was configured in the previous "Federation - Username and password" scenario.
Change the value of the name parameter from "PostUidAndPasswordSAML" to "SAML2BankID"
Click the plus sign next to "configuration" to add new parameters
Set "keyStore" = "<reference to the prevously uploaded BankID Keystore>"
Set "mode" = "test" (This parameter should be removed if production environment)
Click Stage changes
Click Commit changes
Example how this could look once completed
Configure the execution flow used for the SAML assertion to suit your needs
- Open the Execution flow tab and expand the flow.
- Delete the valve #1 (InputParameterExistsValidatorValve) and valve #3 (LDAPBindValve)
- Expand (Show) the LDAPSearchValve and modify the search filter to fetch users where serialNumber=<PersonalIdentificationNumber From BankID>: filter_template = serialNumber={{request.userPersonalNumber}}
- Add a parameter for attributes to fetch for the matched LDAP entry: attributes = serialNumber,sAMAccountName
- Expand (Show) the AssertionProvider and modify nameIDAttribute parameter: nameIDAttribute = serialNumber
- Click Save