OpenSSO
You can post comments and questions regarding the documentation provided below on the Documentation Feedback Wiki Page. The page will open in a new window.

SAML2 session upgrade setup

How to Setup SAMLv2 Session Upgrade with J2EE Policy Agent

Systems to setup:

- agentsample(url resources) installed on a web container which is protected by J2EE policy agent
- Opensso SP
- Opensso IDP

Setup steps:

Step 1: Setup Opensso server, j2ee policy agent and agentsample as John Domenichini specified in his blogs:
http://blogs.sun.com/JohnD/entry/glassfish_domain1_opensso_domain2_policy

and http://blogs.sun.com/JohnD/entry/policy_agent_3_0_learning

After this step, agentsample should work.

Step 2: Setup SAML2 Opensso IDP and Opensso SP.

2.1 Install Opensso server in another machine/web container, let this one be Opensso IDP. 
Use the instructions specified in http://OpenssoIDP:port/idp_deploy_uri/samples/saml2/idp/configure.jsp to configure it as SAML2 IDP.

2.2 Create a user "chris" on Opensso IDP.
Login to Opensso IDP admin console, navigate to Access Control -> /(Top Level Realm) -> Subjects
Click "New" to create a new user,
enter "chris" for all the fields
Click "OK" to create user chris

Logout of Opensso IDP admin console.

2.3 The Opensso server used in step 1 will become Opensso SP.

Use http://OpenssoSP:port/sp_deploy_uri/samples/saml2/sp/configure.jsp to configure it as SAML2 SP.

Logout of Opensso SP admin console.

After this setup, samples/saml2/useCaseDemo should work for user chris.

Step 3: Modify agent LoginURL and LogoutURL to use saml2 sso/slo with agent.

Login to Opensso SP admin console using amadmin;
Navigate to Access Control -> / (Top Level Realm) -> Agents -> J2EE -> glassfishagent -> OpenSSO Services:
Under section "Login URL", change attribute "OpenSSO Login URL" from
http://openssoSP:port/sp_deploy_rui/UI/Login to
http://openssoSP:port/sp_deploy_uri/saml2/jsp/spSSOInit.jsp?metaAlias=/sp&idpEntityID=http://openssoIDP:port/idp_deploy_uri

Under section "Logout URL", change attribute "OpenSSO Logout URL" from
http://openssoSP:port/sp_deploy_uri/UI/Logout to
http://openssoSP:port/sp_deploy_uri/saml2/jsp/spSingleLogoutInit.jsp?metaAlias=/sp&idpEntityID=http://openssoIDP:port/idp_deploy_uri

Click "Save" to save the changes.

Logout from Opensso SP admin console.

After this setup, agentsample should work with saml2 sso/slo.
Access to http://agentHost:port/agentsample, invoke URL Policy Enforcement, will redirect to Opensso IDP's login page.
Access to http://agentHost:port/agentsample/logout will log you out from agent sample, Opensso SP and Opensso IDP.

Step 4: Setup session upgrade

4.1 Setup authncontext mapping on Opensso SP and Opensso IDP, create a new auth
module instance on Opensso IDP.

4.1.1 Login to Opensso IDP admin console using amadmin

4.1.1.1 Navigate to Access Control -> /(Top Level Realm) -> Authentication

Under Module Instances, click on "New",
Under "New Module Instance" page, enter "TestModule" for "Name", select the rado button next to "Data Store". Note: this module is created for testing only. For real deployment, you should pick a module that coresponding to authncontext "X.509", such as certificate, and setup that authentication appropriately.
Click "OK" to create this module instance.
Under "Module Instances" section, click on the newly created auth module "TestModule",
Change "Authentication Level" from "0" to "1".
Click "Save" to save the changes.
go back to Authentication tab, click "Save" to save the changes.

4.1.1.2 Navigate to Federation

Under section "Entity providers", click on the hosted IDP link
Under "Assertion Content" tab, section "Authentication Context", for attribute "Authentication Context",
- the check box next to "PasswordProtectedTransport" should be selected. Select
"Module" from the drop down box for its "Key", enter "DataStore" for its "Value". Leave
"Level" as "0".
- select the check box next to "X.509", select "Module" from the
drop down box for its "Key", enter "TestModule" for its "Value", change its "Level" from "0" to "1".
- Click on "Save" to save the changes

Logout from Opensso IDP admin console.

4.1.2 Login to Opensso SP admin console using amadmin.

Navigate to Federation
Under section "Entity providers", click on the hosted SP link
Under "Assertion Content" tab, section "Authentication Context",
For attribute "Authentication Context", select the check box next to "X.509", change the "Level" from "0" to "1".
Click "Save" to save the changes.

4.2 Modify policy to add a AuthenticationLevel condition

Login to Opensso SP admin console using amadmin;
Navigate to Access Control -> /(Top Level Realm) -> Policies -> The policy you created in step 1 for agentsample;
Under section "Conditions", click on "New" to create a new condition:
Select "Authentication Level (greater than or equal to)" radio button,click next;
for "Name" of the condition: enter any name, say "con1";
for "Authentication Level" of the condition: enter "1";
Click "Finish" to go back to the policy page;
Click "Save" to save the policy.


4.3 Enable attribute based session notification for AuthLevel on OpenSSO SP.

Login to SP admin console using amadmin;
Navigate to Configuration -> Global -> Session;
Under section "Global Attributes", change the value for "Enable Property Change
Notifications" from "OFF" to "ON";
Add "AuthLevel" to attribute "Notification Properties".
Click on "Save" to save the changes.

Note: The agent must use notification (instead of polling) to receive session updates. By default, notification mechanism is used. To verify:
Login to SP admin console using amadmin;
Navigate to Access Control -> /(Top Level Realm) -> Agents -> J2EE -> glassfishagent -> OpenSSO Services:
Under section "Session Client Service", make sure the check box for attribute "Enable Client Polling" is not checked.

Logout from Opensso SP admin console.

After this setup, agentsample should work with saml2 sso/slo with session upgrade.

To test:

Test single sign on:
- On a browser, access to http://agentHost:port/agentsample, page http://agentHost:port/agentsample/public/welcome.html will be displayed
- Click "URL Policy Enforcement" from the left panel, then "Invoke a Servlet Protected by URL Policy"
- The browser is redirected to http://openssoIDP:port/idp_deploy_uri/UI/Login?realm=/&module=DataStore...
enter chris/chris
- now the browser is redirected to http://openssoIDP:port/idp_deploy_uri/UI/Login?realm=/&module=TestModule&ForceAuth=true...
enter chris/chris
- Now the brower shows "Successful Invocation: Please Verify". This means sso is successful.

Test single log out:
- access http://agentHost:port/agentsample/logout, all sessions on agent, opensso SP and opensso IDP should be logged out.