Quick Connection Guide

Transcription

1 Egnyte Connector Version 1.0 Quick Connection Guide

2 2015 Ping I dentity Corporation. A ll rights reserved. PingFederate Egnyte Connector Quick Connection Guide Version 1.0 February, 2015 Ping Identity Corporation th Street, Suite 100 Denver, CO U.S.A. Phone: ( outside North A merica) Fax: Web Site: Trademarks Ping Identity, the Ping Identit y logo, PingFederate, PingOne, PingConnect, and PingEnable are registered trademarks of Ping Identity Corporation ("Ping I dentity"). A ll other trademarks or registered trademarks are the property of their respective owners. Disclaimer The information provided in this document is provided "as is" without warranty of any kind. Ping Identity disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Ping Identity or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Ping Identity or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Document Lifetime Ping Identity may occasionally update online documentation between releases of the related software. Consequently, if this PDF was not downloaded recently, it may not contain the most up-to-date information. Please refer to documentation.pingidentity.com for the most current information. From the Web site, you may also download and refresh this PDF if it has been updated, as indicated by a change in this date: February 24, PingFederate Egnyte Connector 2 Quick Connection Guide

3 Contents Introduction... 4 Supported Features... 4 System Requirements... 4 ZIP Manifest... 4 Installation and Setup... 4 Getting Started... 4 Installing the Connector Configuring Server Settings Configuring a Connection Finish Configuring Your Egnyte Subdomain for SAML SSO Attribute Index PingFederate Egnyte Connector 3 User Guide

4 Introduction This document assumes you have read the Introduction sect i on of the SaaS Connector User Guide. ( Supported Features Outbound U ser Provisioning IDP-initiated and SP-initiated SSO System Requirements The Egnyte Connector requires installation of PingFederate or higher and the Common Provisioning Layer or higher (prov-cpl jar). ZIP M anifest The distribution ZIP file for the Connector contains the following: ReadMeFirst.pdf -- contains links to this online documentation. egnyte-saml-metadata.xml -- The metadata used for Browser SSO /legal: -- Legal.pdf -- copyright and license information. /dist -- contains libraries needed for the Connector: -- pf-egnyte-quickconnection jar -- PingFederate Egnyte Connector -- prov-cpl jar -- PingFederate Common Provisioning Layer -- gson jar -- Used to serialize and de-serialize objects in the Egnyte Connector Installation and Setup The following sections explain how to obtain the necessary information required for installing and configuring this SaaS Connector. Please follow these sections completely and in order. Getting Started Before you can configure this Connector, you will need to complete the following st eps. Tip: Some of the following steps result in information to be used at a later time in this User Guide. It is recommended that you copy this information to a secure location to reference in later steps. PingFederate Egnyte Connector 4 Quick Connection Guide

5 Obtain Your Egnyte Subdomain This Connector requires the subdomain to access your Egnyte account for SSO and Outbound Provisioning. Example: YourSubDomain.Egnyte.com Obtain Your Egnyte Access Token The Egnyte Connectors Outbound Provisioning functionality is built using Egnyte s REST A PI, which requires an authorized OA uth 2.0 Access Token. To generate your A ccess Token you first need to obtain an A PI key. Once you have your A PI key, you will need to run a curl command to obtain your A ccess Token. Note: You only require this information if you are configuring this Connector for Outbound Provisioning. To Obtain Your API Key: To obtain an A PI key, you will need to have a registered account on Egnyte s developers site. ( Once signed into the developer site, you will need to create an Application, which once created, will contain the API key. The following steps should be used to create your A pplication to obtain your A PI key: Note: After creating your application you will have to wait for Egnyte to approve it before you can use the API Key to generate your Access Token in the next section. 1. Log in to Egnyte s developer site with an Administrative developer account. ( 2. Go to the A pplications tab. ( 3. Click the Create A New Application button. 4. Complete the form to register your new application with the following options: Enter any name you choose for the new application. Set the Type to Internal Application (own company use only). Set the Current User Base to New App. Set the Platform to Other. Set the Egnyte domain you will use for testing to your Egnyte subdomain, which you obtained in the Obtain Your Egnyte Subdomain section above. Leave the App Icon URL field blank. Leave the Please describe what your application will do field blank. Leave the Registered OAuth Redirect URI field blank. Ensure the Issue a new key for Egnyte REST API checkbox is enabled. PingFederate Egnyte Connector 5 User Guide

6 Enable the checkbox, indicating that you have read and agree to the Egnyte A PI Terms of Service and click the Register Application button. 5. Once your A pplication is registsted make note of the Key that appears on the confirmation screen: PingFederate Egnyte Connector 6 Quick Connection Guide

7 To Obtain Your Access Token: PingFederate Egnyte Connector 7 User Guide

8 Once you have obtained your A PI key, you are able to use it to generate an A ccess Token using curl. From an app or terminal capable of running curl commands, please run the following curl command: curl -v --request POST -H "Content-Type: application/x-www-form-urlencoded" -d grant_type=password -d username=your_username -d password=your_password -d client_id=your_api_key Where: YOUR_USERNAME is the username of an administrative user on the Egnyte subdomain you wish to provision users on. Note: The administrative user for you Egnyte subdomain is not the same account that you used to generate the Application on Egnyte s developer site. YOUR_PASSWORD is the password for the administrative user of your Egnyte subdomain. YOUR_API_KEY is the A PI Key you obtained in the step above. YOUR_SUBDOMAIN is the subdomain you wish to provision users on, which you identified in the first part of Getting Started. PingFederate Egnyte Connector 8 Quick Connection Guide

9 Obtain Your Egnyte SAML 2.0 Metadata XML This Connectors quick-connection template uses a metadata XML file to assist in configuring many settings in the SP Connection. Before configuring your SP Connection, you must first prepare the egnyte-saml-metadata.xml that comes packaged with the Connector. Note: For Single Sign-on, you will need to configure Single Sign-on Authentication on your Egnyte domain under Security Settings. When configuring these settings, choose PingFederate as the Identity Provider (instead of PingIdentity). To Prepare egnyte-saml-metadata.xml: 1. Open the egnyte-saml-metadata.xml file that came packaged with the Connector in the text editor of your choice. 2. Replace all instances of SUBDOMAIN with your Egnyte Sub Domain value: For example: PingFederate Egnyte Connector 9 User Guide

10 If your Egnyte Sub Domain is pingidentity then SUBDOMAIN.Egnyte.com would become pingidentity egnyte.com. 3. Save your changes. Synchronizing Existing Egnyte Users Important: If your Egnyte account already has Users you wish to provision with the Egnyte connector, this is possible by following the steps below. To provision existing User accounts on Egnyte Ensure that the value mapped to the attribute, (when configuring the connector) matches the existing Egnyte U sers address exactly as it appears in Egnyte. For example, on the A ttribute Mapping screen, the User attribute on Egnyte is mapped to the U ser mail attribute in your LDAP. This will synchronize a User that already exists on Egnyte with an address i n Egnyte of john.smith@mydomain.com. In this case, t he U sers mail attribute in LDA P would also have to be john.smith@mydomain.com. When the Egnyte connector provisions for the first time, this address will be used to synchronize the User in your LDA P data store with the User in Egnyte. Installing the Connector To install the Egnyte Connector, please follow the instructions in the Installing the Connector sect i on of the SaaS Connector User Guide. ( InstallationandSetup-pID0E0SC0HA) Configuring Server Settings To configure Server Settings in preparation of configuring the Egnyte Connector, please follow the instructions in the Configuring Server Settings section of the SaaS Connector Guide. ( ings#configuringserversettings-pid0e0fc0ha) Configuring a Connection Important: This section directs you to the SaaS Connector User Guide for most of the steps to configure this Connector but contains additional steps that need to be followed to successfully configure this Connector. Ensure you follow the additional steps below as directed. To Configure a Connection usi ng t he Egnyte Connector, please follow the instructions in the Configuring a Connection section of the SaaS Connector U ser Gui de, making the adjustments listed in the following section. ( n#configuringaconnection-pid0e0vb0ha) PingFederate Egnyte Connector 10 Quick Connection Guide

11 Additional Steps On the Connection Template screen, select Egnyte as the Connection Template t o use for t hi s SP Connection. You will be asked to provide the Metadata File you edited earlier in the Getting Started sect i on of t hi s U ser Guide. On the General Info screen, the default values are taken from the metadata file you selected in an earlier step. We recommend using these default values. PingFederate Egnyte Connector 11 User Guide

12 On the Target screen when configuring provisioning, enter the A ccess Token and subdomain you obtained in the Getting Started section of this User Guide and click Done. PingFederate Egnyte Connector 12 Quick Connection Guide

13 Finish Configuring Your Egnyte Subdomain for SAML SSO Once you have finished the Configuring a Connection section of t hi s user guide, you must configure your Egnyte Subdomain to enable SA ML based Single Sign-on (SSO). Note: For users to sign in through SAML SSO, their authtype must be set to sso. To configure Egnyte for SAML SSO: 1. Log into your Egnyte Subdomain as an administrative user. 2. Go to the administrative Configuration Settings for your subdomain. 3. Select the Security tab. 4. Under the Single Sign-on A uthentication section of the Security tab: Select SAML 2.0 as t he Single sign-on authentication type. Select PingFederate as t he Identity provider type. Set the Identity provider login URL, Identity provider entity ID, Identity provider certificate and Default user mapping based on how you configured your SP Connection in the Configuring a Connection section of this user guide. Tip: The Identity provider login URL is the SAML login request URL for your Identity provider. The Identity provider entity ID is the SAML Entity ID of your Identity provider. The Identity provider certificate is the PEM-encoded x.509 certificate for your Identity provider. Paste the entire certificate, but remove the BEGIN and END CERTIFICATE lines. The Default user mapping should match the value of the SAML_SUBJECT sent in your SP Connection s Attribute Contract. (Optional) Set the User domain-specific Issuer value based on your business use. Click the Save button. PingFederate Egnyte Connector 13 User Guide

14 The following figure is a sample configuration: Attribute Index The following table consists of the attributes that can be mapped on a User during provisioning. Attribute username givenname familyname usertype role Description The address of the User. The Egnyte username for the User. N ote: U sernames must start with a letter or digit. Special characters are not supported (with the exception of periods, hyphens, and underscores). Important: It is not possible to change a user s username after they are created. The first name of the User. The last name of the User. The type of the User. A cceptable options include admin, power and standard. The role assigned to the User. Available options include default or other existing custom role names. N ote: This option is only available to Power type Users ( who s PingFederate Egnyte Connector 14 Quick Connection Guide

15 sendinvite externalid authtype usertype i s set t o power). If set to true when creating a user, an invitation will be sent if the user is created in active state in the LDAP data store. I f t he user i s disabled in the LDA P data store when they are created no is sent. A cceptable options include true and false. A n immutable unique identifier for the User. This can be any plain text value identifier. W arning: This field is immutable meaning once set it can never be updated. The authentication type for the user. A cceptable options include: ad, sso and egnyte. ad -- Users with their authtype set to this option will be able to authenticate through A ctive Directory. This requires that your Egnyte domain is already configured for A ctive Directory A uthentication under the A dmin Security Settings. When setting this option on a User, the user must also have a userprincipalname set. sso -- Users with their authtype set to this option will be able to authenticate through Single Sign-on (SSO). This requires that your Egnyte domain is already configured for Single Sign-on Authentication under the Admin Security Settings. When setting this option on a User, the user must also have an idpuserid set. T ip: When configuring the Single Sign-on Authentication Security Settings on your Egnyte domain, choose PingFederate as your Identity provider (not PingIdentity). idpuserid userprincipalname egnyte -- Users with their authtype set to this option will be able to log into Egnyte using their Egnyte account credentials. Only required if the User s authtype i s set t o sso. This is the way the user is identified within the SA ML Response from an SSO Identity Provider, i.e. the SA ML Subject (e.g. jsmith or j smi t h@example.com). T ip: The idpuserid of a User should match the option chosen as the Default user mapping when configuring Single Sign-on Authentication under the A dmin Security Settings on the Egnyte domain. Only required if the User s authtype i s set t o ad. This field is used to bind child authentication policies to a User when using A ctive Directory authentication in a multi-domain setup (e.g. jmiller@example.com). PingFederate Egnyte Connector 15 User Guide