/
SAML Integration

SAML Integration

How to configure SAML in FIXICC H2 1.3.0 and below

SAML addon is used for FIXICC H2 integration with SAML. Information about this addon configuration can be found here: CUBA SAML addon

SSOCircle SAML provider

This example describes FIXICC H2 integration with SSOCircle SAML provider.

Go to SSOCircle and create an account.

If you work without any proxy or load balancer, add the following properties to local.app.properties file:

cuba.webHostName = <your_ip_or_dns_name> cuba.webAppUrl = https://<your_ip_or_dns_name>:8443/app fixicch2.saml.ssoPath = <SSO_path_which_will_be_used_on_saml_connection_editor_screen>

If you use proxy or load balancer, add the following properties to local.app.properties file:

cuba.addon.saml.proxy.enabled=true cuba.addon.saml.proxy.serverUrl= <your_proxy_url>/app fixicch2.saml.ssoPath = <SSO_path_which_will_be_used_on_saml_connection_editor_screen>

Run FIXICC H2 application.

Log in as Administrator and go to Administration → SAML menu option.

Click Keystore button and enter your keystore details:

image-20250709-120427.png

Return to SAML Connection Editor and click Create button to add new SAML Connection. Check Active checkbox, enter some strings as Name and SSO Path, select Company as Default Access Group and Default as Processing service, choose your keystore in Keystore field. Enter https://<your_ip_or_dns_name>:8443/app/saml (if the proxy is not used) or <your_proxy_url>/app/saml (if the proxy is used)  in Server Provider Identity field and https://idp.ssocircle.com/idp-meta.xml in Identity Provider Metadata URL field. Click Refresh buttons.

image-20250709-120441.png

Copy XML under Server Provider Identity field. Go to https://idp.ssocircle.com/, log in, select Manage Metadata in the left side menu, click Add new Service Provider link, enter some FQDN and paste your copied SAML metadata information. Click Submit button.

Click Logout button. As a result, Login screen with Login By field will be displayed. If you select your provider in this filed, you will be redirected to SSOCircle for authentication. 

How to configure SAML in FIXICC H2 1.4.0 and above

Update the following section in local.app.properties, add actual values:

############################################################################### # SAML 2.0 SP (Spring Security, e.g. Okta) # ############################################################################### # The property defines whether SAML 2.0 SP authentication will be enabled. Default value: false # fixicch2.auth.saml.enabled = false # IdP metadata URL (e.g. Okta application SAML metadata). Used by the web tier to load the identity provider and build the relying party registration. # fixicch2.auth.saml.metadataUrl = https://your-org.okta.com/app/xxxxxxxxxxxxx/sso/saml/metadata # Spring Security registration id (path segment in SSO and ACS URLs). Default value: okta # fixicch2.auth.saml.registrationId = okta # Optional relying party entity id override. Default value: empty (metadata default is used when not set) # fixicch2.auth.saml.entityId = # SAML assertion attribute name for the user's email (user matching and CUBA external login). Default value: email # fixicch2.auth.saml.emailAttribute = email # SAML assertion attribute name for the user's first name when creating a new user. Default value: firstName # fixicch2.auth.saml.firstNameAttribute = firstName # SAML assertion attribute name for the user's last name when creating a new user. Default value: lastName # fixicch2.auth.saml.lastNameAttribute = lastName # SAML assertion attribute name for the user's display name when creating a new user. Default value: displayName # fixicch2.auth.saml.displayNameAttribute = displayName # The property defines whether SAML group attributes should be read from the assertion and used to sync user roles. Default value: false # fixicch2.auth.saml.groupsAttributeEnabled = false # SAML assertion attribute name that contains the user's group memberships for role synchronization. Default value: groups # fixicch2.auth.saml.groupsAttribute = groups

Example:

fixicch2.auth.saml.enabled = true fixicch2.auth.saml.metadataUrl = https://integrator-xxxxxxx.okta.com/app/exu17be6zmkJZ6XKz611/sso/saml/metadata fixicch2.auth.saml.registrationId = okta fixicch2.auth.saml.entityId = fixicch2 fixicch2.auth.saml.groupsAttributeEnabled = true fixicch2.auth.saml.groupsAttribute = groups

After restarting the application, “Login with SSO“ button appears on the login page.

Okta SAML Provider Configuration

Create a New Application in Okta

  1. In the Okta Admin Console, go to Applications > Application.

  2. Click the Create App Integration button.

  3. Select SAML 2.0 and click Next.

Configure SAML Integration

  1. App Name: Provide a meaningful name for the application (e.g., FIXICCH2 SAML).

  2. Single Sign-On URL (ACS URL):

    • Define the URL your application will use to receive SAML responses.

      • Example for FIXICC H2 1.3.0 or below:  https://<host_or_dns_name>:8443/app/saml/SSO.

      • Example for FIXICC H2 1.4.0 and above:  https://<host_or_dns_name>:8443/app/dispatch/login/saml2/sso/okta.

  3. Audience URI (SP Entity ID):

    • Enter a unique identifier for your application. Example: fixicch2.

  4. Click Next to proceed with the setup.

View Your SAML Settings

  1. Once you complete the setup, Okta will give you key information:

    • Identity Provider Single Sign-On URL (IdP SSO URL): Use this as your SAML endpoint.

    • Identity Provider Issuer: This is the entity ID used by Okta.

    • Download the Identity Provider metadata.

Assign Users to the Application

  1. Under the Assignments tab, assign users or groups to this SAML application in Okta.

  2. Ensure the users you assign are active.

Configure Groups

  1. Go to Directory > Groups in Okta Admin Console.

  2. Click Add Group.

  3. Provide a group name and description.
    IMPORTANT: Group names must correspond to user roles configured in FIXICC H2.

  4. Save the group.

  5. Add users to the group (Manage People).

  6. Go to Applications > Your App > Assignments.

  7. Click Assign → Assign to Groups and select the created groups.

  8. To pass groups in SAML assertion.

  9. Go to Sign On → Edit SAML Settings

  10. Add Group Attribute Statement:

    • Name: groups

    • Filter: Matches regex → .*