Versions Compared

Old Version 3

changes.mady.by.user XCALLY Knowledge (Unlicensed)

Saved on

compared with

New Version 4

changes.mady.by.user XCALLY Knowledge (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

ON THIS PAGE

Table of Contents
minLevel1
maxLevel2

What it's about

SAML is an acronym used to describe the Security Assertion Markup Language (SAML). Its primary role in online security is that it enables you to access multiple web applications using one set of login credentials. It works by passing authentication information in a particular format between two parties, usually an identity provider (IDP) and a web application (in our case, XCALLY).

The technology industry created SAML to simplify the authentication process where users needed to access multiple, independent web applications across domains. Prior to SAML, single sign-on (SSO) was achievable but relied on cookies that were only viable within the same domain. It achieves this objective by centralizing user authentication with an identity provider. Web applications can then leverage SAML via the identity provider to grant access to their users. This SAML authentication approach means users do not need to remember multiple usernames and passwords. It also benefits service providers as it increases security of their own platform, primarily by avoiding the need to store (often weak and insecure) passwords and not having to address forgotten password issues. (Reference: https://www.onelogin.com/learn)

Single sign-on is an authentication method that allows users to sign in using one set of credentials to multiple independent software systems. Using SSO means a user doesn't have to sign in to every application they use. With SSO, users can access all needed applications without being required to authenticate using different credentials.

XCALLY gives the possibility to plan a single sign-on deployment when using Azure Active Directory (Azure AD).

How to set up

To activate the login with SAML on XCALLY, you need to: 

A. Configure Azure AD

B. Configure XCALLY Server

C. Enable SAML login for Administrator, Users and Agents

Requirements

The SAML SSO feature requires:

  • Azure Account with XY admin privileges

  • XCALLY Motion version 3.2.0 or higher

Configure Azure AD

A SAML identity provider is a system entity that issues authentication assertions in conjunction with a single sign-on profile of the Security Assertion Markup Language (SAML).

SAML assertions are the messages that are exchanged between an identity provider (IDP) and XCALLY that confidentially identify who a user is, what pertinent information exists about them, and what they’re authorized or entitled to access.

Azure AD account is an identity provider option for your self-service sign-up user flows

Image Removed

Need to make these steps:

  • create enterprise application

  • select create your own application

  • assign users and group

  • set up single sign on → SAML

  • edit basic SAML COnfiguration

    add identifier

Image Added

  • Create your own app

Image Added

  • Enter the App Overview

Image Added

Properties

  • Copy: Application ID

  • Select SAML

Image Added

  • Edit SSO with SAML

Image AddedImage AddedImage Added

Basic SAML Configuration

  • Identifier: Choose an Entity ID (unique name in the tenant)

add reply

  • Reply URL

(
)

edit Attribute source

Attributes & Claims

  • add new claim

  • name → email

    • Verify you have a claim with:

      • Name identifier format → Email address

      • Source attribute → user.userprincipalname

    download the certificate

    Image Added

    SAML Certificate

    • Download Certificate (Base64)

    to obtain the key

    • From the IDP Settings, retrieve:

      • SAML Endpoint (HTTP)

      • IDP Certificate

      • Issuer URL

      • Single Logout URL (HTTP), if available in IDP

    • When configuring SAML Assertions, add the custom attribute (or parameter) that defines the connector field. Set email as value, so that the provider will consider the XCALLY user email as connector field.

    Set up TEST APP

    Copy:

    • Login URL

    • Logout URL

    Info

    Emails registered on the identity provider must be already set on XCALLY.

    Retrieve XCALLY Certificate

    Certificates in SAML are used as a convenient way to handle the signing and encryption keys. The keys are usually either exchanged through metadata, or by some secure transfer of the certificate to the parties involved in the SAML exchange.

    To retrieve the XCALLY certificate from the SAML metadata, go to the API:

    Code Block
    https://<XCALLY DOMAIN>/api/auth/saml/metadata

    (enter your XCALLY domain in the string)

    Below, you can find an example:

    Image Removed

    Configure XCALLY Server

    Follow these steps to configure the XCALLY server:

    1. Use SSH to connect to your XCALLY server

    2. Login with motion user

    3. Set SAML strings for activating the connection between XCALLY and the IDP in /var/opt/motion/.env :

      Code Block
      XC_SAML_ENTRYPOINT -> IDPLogin SAMLURL
Endpoint
XC_SAML_CERT -> Certificate IDP'sdownloaded publicfrom signingAzure certificateAD
XC_SAML_ISSUER -> Issuer string to retrieve from the IDPApplication ID
XC_SAML_LOGOUT_URL (optional) -> IDPLogout Single LogoutURL

    4. At the end, stop the application and run initialize command

    Below, you can find an example:

    Image RemovedImage Added

    To edit the file .env, follow the instructions recommended here.

    Enable SAML login for Administrator, Users and Agents

    Enable login in General Settings

    The Login with SAML must be enabled under Settings → General:

    Users and Agents (WebRTC and External) will be able to connect to XCALLY using identity provider credentials.

    Info

    Staff emails on XCALLY must be equal to the Staff emails registered on the identity provider.

    Login for XCALLY users

    On the Login page, the button Login with SAML is available:

    Clicking on Login with SAML, XCALLY Users will be redirected on the identity provider portal.

    After entering the provider credentials on the provider portal, XCALLY Interface will be opened as usual.

    If configured, from the second login on, each time Users click on Login with SAML, they will directly access to XCALLY, without entering credentials again.