SAML Authentication

Voyager can use SAML authentication where available.  To enable it, you will need to:

• Configure SAML Authentication
• Configure the ADFS Server
• Configure Groups

Configuring SAML authentication

To configure SAML authentication:

1. Go to Manage > Authentication > SAML
   
   
2. Enter your identity provider metadata
   
   
   
   
3. Click Save to save the configuration
4. Select the KeyStore tab to install or create a new certificate
   
   
   
   
5. Enter the Keystore and Private Key passwords
6. Click Save
7. Once the key store is created, click Download Metadata to import the federated data into your server. Alternatively you can upload an already existing key store.

Configuring the ADFS Server

1. Open the AD FS management console and select Relying Party Trusts
   
   
   
2. Click Add Relying Party Trust...
3. Click Start and follow the steps
   
   
   
   
4. Select the metadata file exported from Voyager
   
   
   
   
5. Click Next
6. Enter the Display Name
   
   
   
   
7. Configure the Issuance Authorization Rules
   
   
   
   
8. Review the configuration and click Next
   
   
   
   
9. Open the Claim Rules editor
   
   
   
   
10. Add a new rule
    
    
    
    
11. Open the Send LDAP Attributes as Claims template
    
    
    
    
12. Specify the Name ID (required)
    
    
    
    
13. Specify the Group and Display-Name attributes (optional)
    
    
14. If you generated a Self-signed certificate you must install it into the Trusted Root Certification Authorities store.
15. Important: Make sure that SHA-1 is selected as secure hash algorithm
    
    
    
    
16. Double-click on the recently added Relaying Party Trust and select the Encryption tab
    
    
    
    
17. Click View.. and select Install Certificate...
18. Select the Certificate Store
    
    
    
    
19. Click OK
20. Click Next to store the Certificate
    
    
    
    
21. Make sure SAML authentication is enabled and restart Voyager
22. Sign in to Voyager
    
    

Managing groups

1. You can add existing groups and grant them administrator rights
   
   
   
   
2. Click Add and optionally grant administration access