Authentication in Studio

Standard / Username and Password#

No extra actions needed to use it, it is available by default.

SAML#

Configuration steps:

Configure Tomcat to use HTTPS (if needed).
Fill properties:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


#Required properties:
  
higson.studio.security.token.generation.authentication.type=saml
#Specifies the URL of the Studio backend application, e.g.: http://yourdomain.com:38080/higson/api
higson.studio.security.token.generation.authentication.saml.base-url=
#Specifies entity identifier, e.g.: higson
higson.studio.security.token.generation.authentication.saml.entity-id=
#Specifies the path to the IDP metadata file, e.g.: file:/home/user/metadata.xml
higson.studio.security.token.generation.authentication.saml.idp-metadata-file-path=
#Specifies maximum difference between clocks of the identity provider and Studio machines, e.g.: 60
higson.studio.security.token.generation.authentication.saml.response-skew=
#Specifies the source of the roles, possible values: saml / internal
higson.studio.security.token.generation.authentication.saml.roles-origin=
#Specifies the path to the keystore with certificate and private key used to sign and decrypt data, e.g.: file:/home/user/higson.jks
higson.studio.security.token.generation.authentication.saml.key-store.path=
#Specifies the keystore password
higson.studio.security.token.generation.authentication.saml.key-store.pass=
#Specifies an alias for the certificate in the keystore
higson.studio.security.token.generation.authentication.saml.key-store.alias=
#Specifies the private key password
higson.studio.security.token.generation.authentication.saml.key-store.key-pass=
#Specifies the URL of the Studio frontend application, e.g.: http://yourdomain.com:38080/higson/app
higson.studio.security.token.generation.authentication.saml.token-destination-url=

#Optional properties:
  
#Specifies the attribute names
higson.studio.security.token.generation.authentication.saml.attributes.firstname=firstname
higson.studio.security.token.generation.authentication.saml.attributes.lastname=lastname
higson.studio.security.token.generation.authentication.saml.attributes.mail=mail
higson.studio.security.token.generation.authentication.saml.attributes.roles=roles
#Specifies the endpoint that returns SP metadata 
higson.studio.security.token.generation.authentication.saml.sp-metadata-endpoint=/saml2/metadata
#Specifies the endpoint that accepts login response from the IDP
higson.studio.security.token.generation.authentication.saml.assertion-consumer-service-endpoint=/login/saml2/sso/higson
#Specifies the endpoint that accepts logout request
higson.studio.security.token.generation.authentication.saml.single-logout-service-endpoint=/saml2/logout

Generate Studio metadata and import in your Identity Provider

On your IDP:

Configure Identity Provider to send attributes with assertion response.
Check that Identity Provider configuration for Assertion Consumer Service URL and Logout Service URL is correct.

Important! SAML Response signature must include message and assertions!

Attributes Mapping#

SAML Response must contain following attributes:

Name ID (this is used as user login)
firstname
lastname
mail
roles

When a user logs into Higson Studio, their account is automatically created in the system with an external status.

Roles#

if higson.studio.security.token.generation.authentication.saml.roles-origin=saml is specified roles are taken from assertion response therefore Identity Provider must be configured to send it with response. internal means Studio will take roles from database instead of SAML assertion response to authorize user.

Active Directory#

Fill properties:

1
2
3
4
5
6
7
8
9


#Required properties:

higson.studio.security.token.generation.authentication.type=active-directory
#Specifies Active Directory main root, e.g.: domain.local
higson.studio.security.token.generation.authentication.active-directory.domain=
#Specifies Active Directory server url, e.g.: ldap://10.111.22.156:389/
higson.studio.security.token.generation.authentication.active-directory.url=
#Specifies Active Directory root domain, e.g.: DC=domain,DC=local
higson.studio.security.token.generation.authentication.active-directory.root-dn=

Requirements for Access Directory User#

Login - not empty, min size: 1, max size: 200
First name - not empty, min size: 1
Last name - not empty, min size: 1
E-mail address - if empty Higson generates default e-mail consistent with schema: ’login@local.com’
Roles - min one role consistent with Higson role.

Roles defined in Active Directory must be compatible with roles in Higson structure. When a user logs into Higson Studio, their account is automatically created in the system with an external status.

Hierarchy of Roles in Higson#

MPP_ADMIN - Higson Administrator
MPP_USER - Higson User
MPP_USER_READONLY - Readonly Higson User \

It is possible to create own roles in AD but remember to create same roles in Higson structure. It’s necessary to proper authentication process.

CAS#

Configuration steps:

Configure Tomcat to use HTTPS.
Fill properties:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


#Required properties:

higson.studio.security.token.generation.authentication.type=cas
#Specifies the URL of the Studio backend application, e.g.: https://yourdomain.com:38080/higson/api
higson.studio.security.token.generation.authentication.cas.base-url=
#Specifies CAS server url, e.g.: https://cas_server_adress:9443/cas/p3
higson.studio.security.token.generation.authentication.cas.server-url=
#Specifies CAS login endpoint, e.g.: https://cas_server_adress:9443/cas/login
higson.studio.security.token.generation.authentication.cas.login-url=
#Specifies CAS logout endpoint, e.g.: https://cas_server_adress:9443/cas/logout
higson.studio.security.token.generation.authentication.cas.logout-url=
#Specifies the URL of the Studio frontend application, e.g.: http://yourdomain.com:38080/higson/app
higson.studio.security.token.generation.authentication.cas.token-destination-url=

When logging in using CAS, you must configure the corresponding users on the Higson Studio side. Roles are defined and managed on the Higson Studio side.