auth.admin.saml.groovy-permission-mapper
Specify the location of the Groovy class which maps SAML users to their permissions.
Key: auth.admin.saml.groovy-permission-mapper
Type: File
Can be set in: global.cfg
Description
Sets the path to a groovy script implementing a mapping from SAML credentials provided by the identify provider to objects representing Funnelback Users.
The following example script provides a simple example in which the groovy script simply loads the 'admin.ini' file for all valid SAML users. In practice a script would likely interrogate the given SAMLCredential, and load or create a suitable user object which grants permissions appropriate for the user.
import java.util.Arrays;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.saml.SAMLCredential;
import com.funnelback.springmvc.api.config.security.saml.SamlFunnelbackUserMapper;
import com.funnelback.springmvc.api.config.security.saml.user.shared.SAMLConfiguredUser;
import com.funnelback.springmvc.api.config.security.user.model.RoleId;
public class ExampleGroovySamlFunnelbackUserMapper implements SamlFunnelbackUserMapper {
@Override
public SAMLConfiguredUser getSAMLDerivedUser(SAMLCredential credential, SAMLConfiguredUser emptyUser, File searchHome)
throws UsernameNotFoundException {
String username = "admin"; // Derive this from the SAMLCredential
return emptyUser.withUserInfoDetails(emptyUser.getUserInfoDetails()
.withId(username)
.withFullName("")
.withEmail("")
.withInfo(""))
.withRoleDetails(emptyUser.getRoleDetails()
// These roles should be mapped to ones that exist on disk, depending on
// attributes that are provided by the SAMLCredential.
.withInRoles(Arrays.asList(new RoleId("default-super-user"))));
}
}
The file containing the script can be located anywhere so long as it is readable by the Funnelback jetty web server. Further detail about the provided SAMLCredential object is available within the spring security SAML documentation.
⚠ Caveats
This setting requires Jetty to be restarted to take effect.
See Also
- SAML authentication
- Enable SAML authentication (Admin interface).
- Specify the SAML identity provider's metadata URL (file:// or http://) (Admin interface).
- Specify the URL to log users out of the IdP (Admin interface).
- Specify the prefix for the SAML entity ID (Admin interface).
- Specify the location of the SAML keystore (Admin interface).
- Specify the password for SAML keystore (Admin interface).
- Specify the alias of private key to use in SAML keystore (Admin interface).
- Specify the password for private key in SAML keystore (Admin interface).
- Specify the default URL to navigate to after an IdP initiated SSO login. (Admin interface)