Wiki source code of Single Sign-On (SSO) via SAML
Last modified by Mark Kohlmann on 2025/05/10 00:45
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
1.1 | 1 | ShowRunner version 4.0 adds support for Single Sign-On (SSO) using SAML. This capability allows ShowRunner to integrate with 3rd party authentication and authorization systems commonly used to unify access to corporate information systems. |
| 2 | |||
| 3 | ==== Requirements: ==== | ||
| 4 | |||
| 5 | * ShowRunner 4.0 or later | ||
| 6 | * SSO License enabled in the processor's ShowRunner license | ||
| 7 | * A 3rd party identity provider that supports SAML 2.0 (Okta, Microsoft EntraID, etc) | ||
| 8 | |||
| 9 | ==== Features: ==== | ||
| 10 | |||
| 11 | * Authenticate users using 3rd party identity provider which may support Multi-Factor Authentication | ||
| 12 | * User authorization group mapped to ShowRunner group | ||
| 13 | * Apply user's PIN code | ||
| 14 | * Apply user's touchscreen access level: user or technician | ||
| 15 | * Set how a user can login: username and/or PIN | ||
| 16 | * Set where a user can login: touchpanel or web | ||
| 17 | |||
| 18 | ==== SAML IdP Claim Mapping: ==== | ||
| 19 | |||
| 20 | |=Function|=Attribute Name|=Required|=Expected Value|=Sample Values|=Notes | ||
| |
3.2 | 21 | |User Id|{{{http://schemas.microsoft.com/identity/claims/objectidentifier}}}|Y|GUID or unique identifier within the IdP system|{{{101507cb-90da-473d-bfa7-9967979824e7 00ab9c907defGhIJ1697}}}|If a GUID is not returned then the value is hashed and converted to a GUID |
| 22 | |Username|{{{http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier}}}|Y|username or email address|{{{john.doe jane.doe@example.com}}}| | ||
| 23 | |Display Name|{{{http://schemas.microsoft.com/identity/claims/displayname}}}|Y|User's name|Example: John|{{{John Doe}}}| | ||
| 24 | |User Group|{{{http://schemas.microsoft.com/ws/2008/06/identity/claims/role}}}|Y|User's Group Name|{{{Administrators End Users General Users}}}|Must match a ShowRunner User Group name | ||
| 25 | |PIN|pin|N|User's passcode/PIN code for touchscreen|{{{123456}}}| | ||
| 26 | |Touchscreen Access Level|touchscreenAccessLevel|N|Access level for the user when access a touchscreen|{{{Valid Values: None, Technician, User Example: Technician}}}| | ||
| 27 | |Login Permitted|userLoginPermitted|N|Locations where a user can login. Multiple values are supported|{{{Valid Values: None, Touchpanel, Web Example: Touchpanel,Web}}}|Comma separated listed of valid values | ||
| 28 | |Login Method|userLoginMethod|N|How a user can login|{{{Valid Values: None, Username, PIN Example: Username,PIN}}}|Comma separated listed of valid values | ||
| |
1.1 | 29 | |
| 30 | ==== Notes: ==== | ||
| 31 | |||
| 32 | * Value mapping must be done on IdP side | ||
| 33 | * A successful authentication with the IdP will add the user to ShowRunner's user database if they don't exist | ||
| 34 | * User matches occurs based on the User Id, ensure that the User Id is unique within your IdP | ||
| 35 | * All user values will be updated if they change within the IdP system | ||
| |
2.1 | 36 | * Non-Required values that are not sent with the SAML assertion will not update the ShowRunner's users equivalent value |
| |
1.1 | 37 | |
| 38 | ==== Example Integrations: ==== | ||
| 39 | |||
| 40 | * [[Microsoft Entra ID>>xwiki:SHOWRUNNER™ User Guide & Wiki.SHOWRUNNER™ Appendix.Single Sign-On (SSO) via SAML.Microsoft Entra ID.WebHome]] | ||
| 41 | * [[Okta>>xwiki:SHOWRUNNER™ User Guide & Wiki.SHOWRUNNER™ Appendix.Single Sign-On (SSO) via SAML.Okta.WebHome]] |