AD-login med SAML i Skyfish
Setup steps
By default AD will be using Controlled Group version, where assigned groups is matched with Skyfish Groups and is used to define which folders permissions exist in Skyfish.
If you only need AD to permit access via one default group, that permits a set of folder permissions, refer to the section here:
Step 1: Connect your Active Directory with your Skyfish
- Visit Azure Portal. Login.
- Go to Entra ID.
- In the top menu, click Add and choose App registration.
- In the textbox titled Name, enter a fitting name, e.g. Skyfish Login.
- Leave the option as Accounts in this organizational directory only (Default Directory only – Single tenant).
- At the bottom of the form, fill in the Redirect URI textbox with:
https://auth.colourbox.com/saml2/idpresponse, leave the drop-down box to the left set as Web. - Click Register to save the registration.
- Navigate to Manifest and look into the editor.
- Navigate to where it says “knownClientApplications”: [], add this line of code on the next row: “requestedAccessTokenVersion”: 2,. (If this line already exist, instead change its value from Null to 2).
- Now save the changes.
- Navigate back to Overview in the left menu.
- Click Add an Application ID URI.
- Click Add next to Application ID URI.
- Fill in the textbox that appears titled Application ID URI with:
urn:amazon:cognito:sp:eu-west-1_95snzYZYv. - Click Save.
- In the side menu, click Token configuration.
- Click Add groups claim. A submenu appears.
- Checkmark Security groups (If limiting groups or using enterprise app) checkmark only Groups assigned to the application.
- Click Save.
- In the side menu, click Overview.
- Click Endpoints. A submenu appears.
- Copy the URL titled: Federation Metadata Document.
- Visit Skyfish’s Settings page for AD Integration.
- Paste the Federation Metadata Document URL into the input field titled Federation Metadata Document URL.
If you are using an Enterprise app
If you are using an Enterprise app remember to assign the needed Skyfish groups to the application.
Do the following:
- Enter Enterprise apps
- Select the Skyfish application
- Select users and groups
- Choose add group
- Now select the Skyfish affiliated groups you want assigned to the Skyfish application
Step 1 is now complete. Continue with Step 2.
Step 2: Align your Active Directory groups with your Skyfish Groups.
- Visit Skyfish’s Settings page for AD Integration.
- Go to Groups in Skyfish.
- Click Add new AD Security Group.
- Visit Entra ID Groups. (If the link does not work, navigate to Entra ID in Azure Portal and open groups).
- Select a group in your Active Directory that you want to align with a Skyfish Group.(Usually security groups).
- Copy the group’s Object ID.
- Go back to Skyfish’s Groups in Skyfish settings page.
- In the textbox titled AD Security Group ID, paste the Object ID.
- Select the Skyfish User Role the group’s users will have.
- Select the wanted ekstra Skyfish features the user should have access to.
- If the user has Colourbox access, the user role can be set here(Optional).
- Assign the group to one or more Skyfish Groups: create and/or use existing ones.
- Click Save access rights, to complete aligning the Active Directory group and Skyfish Group.
- Repeat this Step 2 process for each of your Active Directory’s groups that you wish to integrate with Skyfish.
Troubleshooting the integration
Error:
Invalid SAML response received: The value of the attribute custom:cbx_groups must have a length less than or equal to 2048 characters
Limit the groups being sent to Skyfish:
The best option is to limit the groups you send to Skyfish, so you only expose the groups relevant to the Skyfish integration. This should bring the groups field under 2048 characters.
Alternative Solution: Setup a default AD Security Group
If limiting the amount of groups sent to Skyfish is not an option, we have the option to give your users a default AD Security Group when they login via your AD.
This will change the AD login slightly. The default behavior for AD login is to strip the user from its rights first, then give them the access according to the AD Security Groups you setup in Step 2, we call this strict mode. When using a default AD Security Group we relax this by not stripping the user of its right before giving the rights the default AD Security Group allows the user.
To setup a default AD Security Group:
- In step 2 you have aligned one or more AD Security Groups with Skyfish. Find the AD Security Group you want to be the default.
- Send an email to info@colourbox.com with the AD Security Group and ask them to set it as the default AD Security Group in your integration.
Error:
Got groups [] but no groups map to access in Skyfish.
This error comes in one of two forms:
If no groups are shown in the brackets
If the brackets are empty, Skyfish has not received any security groups from your Active Directory.
When Skyfish does not receive any AD Security Groups, it cannot assign access rights to the user, and the login attempt is therefore rejected.
Review Step 1 to ensure that your Active Directory has been configured correctly.
If groups are shown in the brackets
If groups are shown in the brackets, it means that Skyfish is receiving AD Security Groups, but they do not match any access rights configured in Skyfish.
Review Step 2 to ensure that your AD Security Groups are correctly mapped to access rights in Skyfish.
Example:
Got groups [7EA05961-86F4-45CD-8134-E3FFB9B4C22B]