Setting up Liferay as both IDP and SP (SAML)

Issue

This article outlines how to configure two Liferay DXP bundles for SAML authentication with one functioning as the Service Provider (SP) and the second as the Identity Provider (IdP).

Environment

DXP 7.4

Resolution

Note: The below steps are for testing purposes only.

Extract two 7.4 bundles to folders titled SP and IdP and put DXP activation keys in both deploy folders.
Add 127.0.0.1 liferaytest.com in the local environment’s 'hosts' file to make liferaytest.com viable. (User can refer to: Modify your hosts file or How to Edit Hosts File in Windows, MacOS and Linux)
Create a file called com.liferay.portal.search.elasticsearch7.configuration.ElasticsearchConfiguration.config in both bundles’ osgi/config folders and add the following content:
```
sidecarHttpPort="AUTO"
```

In the IdP bundle, navigate to [tomcat home]/conf and open server.xml and change the port numbers to the following:

 <Server port="9005" shutdown="SHUTDOWN">
<Connector port="9080" protocol="HTTP/1.1"
connectionTimeout="20000"
 redirectPort="8443" URIEncoding="UTF-8" />

Start the bundles.

Configuring the Liferay DXP (SP) bundle as the SP:
1. Access the SP bundle.
2. Sign in as the Administrator
3. Navigate to the Open Menu icon > Control Panel > Security > SAML Admin.
4. On the General tab:
  - Select - SAML Role: Service Provider
  - Enter - Entity Id: samlsp
5. Click On Save
6. Under Certificate and Private Key, click on Create Certificate
  - Common Name: test
  - Organization: test
  - Organization Unit: test
  - Locality: test
  - State: test
  - Country: test
  - Validity (days): 356
  - Key Algorithm: RSA
  - Key Length (Bits): 2048
  - Key Password: liferaysp
7. Check the box next to Enabled and click on Save

Configuring the Liferay DXP (IDP) bundle as the IdP:
1. Access the IDP bundle.
2. Sign in as the Administrator
3. Configure the bundle to use a virtual host of liferaytest.com:-
  --> Navigate to the Control Panel > Virtual Instances > Click three dots > then, Edit
  --> Under Virtual Host, enter 'liferaytest.com' and save it.
4. Navigate to the Control Panel > Security > SAML Admin.
5. On the General tab:
  - Select - SAML Role: Identity Provider
  - Enter - Entity Id: samlidp
6. Click On Save
7. Under Certificate and Private Key, click on Create Certificate
  - Common Name: test
  - Organization: test
  - Organization Unit: test
  - Locality: test
  - State: test
  - Country: test
  - Validity (days): 356
  - Key Algorithm: RSA
  - Key Length (Bits): 2048
  - Key Password: liferayidp
8. On the General tab click the box next to Enabled and then click on Save
9. Select the Service Provider Connections tab then Add Service Provider
  - Name: samlsp
  - Entity Id: samlsp
  - Enabled: Checked
  - Metadata URL: http://localhost:8080/c/portal/saml/metadata
  - Name Identifier Format: Email Address
  - Name Identifier Attribute Name: emailAddress
  - Attributes Enabled: Checked
  - Under the 'Attributes' section, enter values as below:
```
firstName
lastName
screenName
emailAddress
```

9. Click on Save, you should return to the Service Provider Connections tab if the configurations are saved successfully.

Return to the Service Provider Liferay DXP bundle:
1. Sign in as the Administrator if the account was signed out.
2. Return to the SAML Admin menu
3. Select the Identity Provider Connections then click on Add Identity Provider
- Name: samlidp
- Entity ID: samlidp
- Enabled: Checked
- Metadata URL: http://liferaytest.com:9080/c/portal/saml/metadata
- Name Identifier Format: Email Address
- Under the 'Attribute Mapping' section, Click on the '+' icon and add four 'Basic User Fields'
- Enter the values as shown in below image:
Click on Save.
Now, drag and drop one 'Sign In' widget to the Home Page of the Service Provider and Publish it. (In case the SAML configurations are incorrect this will allow for a direct login to the Service Provider bypassing the SAML authentication entirely)
Testing the SAML authentication:
1. Sign out of the SP bundle or use a different browser.
2. Access the SP bundle.
3. Click on the Sign In button in the top right corner.
4. The user should be redirected to the IDP, in this case: http://liferaytest.com:9080/web/guest/home?...
5. Sign in using the provided portlet.
6. The user should be redirected to the SP and logged in there.

You have Successfully Configured Liferay as both SP and IdP.

Setting up Liferay as both IDP and SP (SAML)

Issue

Environment

Resolution

Additional Information