Configure GAS to support SAML SSO

Follow these steps to setup Genero SAML service.

Before you can use SAML Single sign-on (SSO) with the GAS, a circle of trust must be established between the service providers (the Genero Application Server) and one or more SAML identity providers (an entity in charge of managing and authenticating the users). This is established via SAML metadata exchange, where each party imports the metadata from the other party. Each party's metadata defines how to communicate with it.
Note: An X509 certificate authority file can also be exchanged in order to validate SAML signatures. See Certificate authority.
  1. If the GAS is located behind a proxy, configure the proxy in the SAML FGLPROFILE.
    Uncomment and set correct values for the entries proxy.http.location and proxy.https.location.
  2. Create an X509 Certificate and its private key.
    SAML requires digital signatures. See the Genero Business Development Language User Guide for information on creating the certificate and its private key.
  3. Modify the SAML configuration file and enter the X509 certificate and private key information.
    The SAML configuration file is located in $FGLDIR/web_utilities/services/saml/res.
    Remove the comment and set correct values for the entries xml.saml_signature.x509 and xml.saml_signature.key.
    If your Genero Web application must be accessible in HTTP, you must also use that key and certificate for XML-Encryption to be fully secure. Uncomment and set the same values for the entries xml.saml_encryption.x509 and xml.saml_encryption.key.
  4. Create a circle of trust between the GAS and a SAML provider. Import the IdP metadata file into the GAS SAML service provider.
    1. Go to $FGLDIR/web_utilities/services/saml.
    2. Set SAML environment via envsaml.bat or envsaml.sh.
    3. Launch the ImportIdP application using the SAML Provider URL.
      Refer to the IdP documentation for information on generating the metadata file (or the URL) from the SAML identity provider.
      $fglrun ImportIdP http[s]://host:port/openam_954/saml2/jsp/exportmetadata.jsp
    4. Retrieve the SAML provider Certificate and add it as a trusted certificate in the SAML configuration file (if needed).
      Uncomment and set the correct values for the entry xml.keystore.calist. Refer to the Genero Business Development Language User Guide for more information.
      Refer to the SAML Identity Provider (IdP) documentation for information about retrieving its X509 certificate.
  5. Create a circle of trust between the SAML provider and the GAS.
    1. Start the dispatcher (if needed).
    2. Log in to your SAML provider and create a circle of trust based on the GAS SAML metadata.
      Generate the metadata from this URL: 
      http[s]://host:port/gas/ws/r/services/SAMLServiceProvider/Metadata
      Refer to the SAML Identity Provider (IdP) documentation for information about importing the Genero Application Server SAML metadata.

The GAS is ready to support SAML SSO.