SAML Service Provider

SAML Service Provider

Issue

How can I use a 3rd Party service (such as ADFS, Office365, or OneLogin) to SSO into UW?



Solution

The SAML Service Provider (SP) features allows another Identity Provider (IDP) to single sign-on into Unified Workspace using SAML for a seamless sign-on experience.


Please see the SAML Service Provider Documentation for information on enabling SAML SP inside of UW:


Please see the following Articles on how to configure the following 3rd Party IDPs:


Once you have UW configured for SAML SP, you will want to configure UW to force users to use your 3rd Party IDP login page.

Create a redirect file and place it in the webserv folder on your relays.

We've used the redirectSamlSP.zip file, attached to this article.
  1. Edit the redirectSamlSP.jsp and change the redirect URL to point to your IDP SAML login.
  2. Copy the file to your relay servers: c:\UnifiedWorkspace\webserv\custom\redirectSamlSP.jsp
  3. Create a Virtual Host entry on relay object's Options tab that redirects user to the redirectSamlSP.jsp
    Such as: <YOUR_UW_URL>/custom/redirectSamlSP.jsp

    Note: Adding the Virtual Host requires restarting UW.
Now when the user browses to <YOUR_UW_URL>, they are redirected to the login page you set in your redirect jsp.


It is also a good idea to set the the Redirect URL After Logout option, on the tenant, so that it redirects the user back to the SAML login page when the user logs out of UW.
  1. Expand Customization Center
  2. Expand Tenants
  3. Expand [Default] tenant object
  4. Select Global Settings
  5. Choose Redirect URL After Logout
  6. Change the value to the URL you go to, to log out of your IDP.
  7. For example: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
  8. Click Save

To prevent users from going directly to https://<YOUR_UA_URL>/LoginPolicy.jsp, rename c:\UnifiedWorkspace\webserv\LoginPolicy.jsp and c:\UnifiedWorkspace\webserv\NoLoginPolicy.jsp to something unique, that you can remember.  This gives you an alternative login method if there is a problem with the IDP.
Note: When you perform an upgrade, these two files will be recreated, so you'll have to rename them again afterwards.


If you missed this part, under the SAML SP Advanced Concepts:
Login Script on the profile, to sync the users password

    Can't find the KB

    Unable to find the KB to address your issue ?  

      • Recent Articles

      • Change Reset Password Button Text

        Change the text of the "Reset Password" button on the UW Login Page How to change the text of the Reset Password button on the Login Page. Login to webNetwork and open webAdmin on your Relay Central Server Expand Customization Center Expand Tenants ...

      • Remove Reset Password Button From Login Page

        Remove the Reset Password Button from the Login Page How to remove the Reset Password button from the Unified Workspace login page. Login to webNetwork and open webAdmin on your Relay Central Server Expand Customization Center Expand Tenants Expand ...

      • Lenovo Unified Workspace End-of-Life Questions and Answers

        As of January 31st 2024, Lenovo Unified Workspace (formerly Stoneware WebNetwork) is no longer supported. This means that we no longer provide licenses, downloads, updates, patches, or technical assistance for this product. If you have any questions ...

      • How do I determine my Unified Workspace license expiration date?

        The best method for determining the licensing information including the expiration date of your Unified Workspace license: Login to your 8090 management console on each server This may take remoting into each LUW server and relay, opening a browser, ...

      • Lenovo Unified Workspace 7.0.2.13 Released

        Highlights of Unified Workspace 7.0.2.13 Before you install: Please view the installation notes here. 7.0.2.13 requires a 7.0 license file. Below is a list of enhancements and fixes released in Unified Workspace 7.0.2.13 Fixed external storage ...

      • Related Articles

      • SAML SP - Office365

        General Setup Go to Azure AD (https://aad.portal.azure.com/) Click on "Enterprise applications" Click "New Application" Click "Non-gallery application" IMPORTANT - Office365 requires Azure AD and premium subscription, you may see an alternate screen ...

      • SAML SP - OneLogin

        General Setup Go to OneLogin administrator page (/admin) Click on "Apps" Click "Company Apps" Click "Add App" Search for "SAML" Select "SAML Test Connector (Advanced)" Recommended to add "LUW" into Display Name Click "SAVE" button Click ...

      • SAML SP - ADFS

        Pre-requisites Download the metadata file from https://YOUR-LUW-INSTALL/swSamlSp/metadata XML file Make sure ADFS has EnableIdpInitiatedSignonPage enabled MS article how to enable ...

      • SAML Identity Provider options

        Problem:  Customer or 3rd party vendor needs to know configuration options for setting up Identity Provider (IDP) initiated SAML. Cause:  As opposed to Service Provider (SP) initiated SAML, Identity Provider (IDP) needs more information from vendor ...

      • SAML Identity Provider general configuration

        This webapplication will be made up of a webapplication link and a public webapplication object. It will not have a host object like many other webapps.  In this example we will use the following settings:  Application type : public  Context path ...