SAML Single Sign On (SSO) Into Fisheye Using Ping One

Pre-requisites

To integrate your Identity Provider(IDP) with Fisheye/Crucible, you need the following items:

• Fisheye/Crucible should be installed and configured.
• Fisheye/Crucible Server is https enabled (optional).
• Admin credentials are set up in Fisheye/Crucible.
• Valid Fisheye/Crucible Server Licence.

Download And Installation

• Log into your Fisheye/Crucible instance as an admin.
• Navigate to the settings menu and Click Add-ons.
• Click on Find new add-ons from the left-hand side of the page.
• Locate Fisheye/Crucible SAML Single Sign On/SSO via search.
• Click Try free to begin a new trial or Buy now to purchase a license for Fisheye/Crucible SAML Single Sign On/SSO.
• Enter your information and click Generate license when redirected to MyAtlassian.
• Click Apply license.

Step 1: Setup Ping One as Identity Provider

All the information required to configure the Ping One as IDP i.e. plugin’s metadata is given in the Service Provider Info tab of the miniOrange SAML plugin.

• Login to your Ping One environment as the administrator. Click on your ProfileAdmin.
• Go to ApplicationsAdd ApplicationNew SAML Application.
• Enter the application details and click Continue. Application Name, Application Description, and Category are required fields. For logos and icons, PNG is the only supported graphics format.


 Provide the SAML configuration details for the application.




1.Signing. In the dropdown list, select the signing certificate you want to use.

2.SAML Metadata. Click Download to retrieve the SAML metadata for Ping One. This supplies the Ping    One connection information to the application.

3.Protocol Version. Select the SAML protocol version appropriate for your application.

4.Upload Metadata. Click Choose File to upload the application’s metadata file. The entries for ACS URL    and Entity ID will then be supplied for you. If you do not upload the application metadata, you will need    to enter this information manually. When you are manually assigning an Entity ID value, the Entity ID    must be unique, unless you are assigning the Entity ID value for a private, managed application (an    application that is supplied and configured by a PingOne for Enterprise administrator, rather than by    an SP.

5.Single Logout Endpoint. The URL to which our service will send the SAML Single Logout (SLO) request    using the Single Logout Binding Type that you select.

6.Single Logout Response Endpoint. The URL to which your service will send the SLO Response.

7.Single Logout Binding Type. Select the binding type (Redirect or POST) to use for SLO.

8.Primary Verification Certificate. Click Choose File to upload the primary public verification certificate    to use for verifying the SP signatures on SLO requests and responses.

9.Signing Algorithm. Use the default value or select the algorithm to use from the dropdown list.



 Optional:

I.Encrypt Assertion. If selected, the assertions PingOne sends to the SP for the application will   be encrypted.

II.Encryption Certificate: Upload the certificate from miniOrange plugin to use to encrypt the    assertions.

III.Encryption Algorithm: Choose the algorithm to use for encrypting the assertions. We     recommend AES_256 (the default), but you can select AES_128 instead.

IV.Transport Algorithm: The algorithm used for securely transporting the encryption key.     Currently, RSA-OAEP is the only transport algorithm supported.

V.Force Re-authentication. If selected, users having a current, active SSO session will be    re- authenticated by the identity bridge to establish a connection to this application.



• Click Continue to Next Step. The SSO Attribute Mapping page is displayed.

• In the Attribute Mapping, Modify or add any attribute mappings as necessary for the application.

• The summary information for the application configuration is then displayed on a new page and the new SAML application is added to your My Applications list.

Step 2: Setup Fisheye/Crucible as Service Provider

Step 3: Redirection on Login Page

• If you have only one IDP configured, then you can use the features provided on the SSO Settings tab and Redirection tab of the plugin to manage the redirection on the login page.
• Enable the Auto Redirect to IDP option on the SSO Settings tab if you want to allow users to log in only using IDP.
• Use the Emergency/Backdoor Login URL to allow all admins to access the Atlassian Application's default login page and log in using Atlassian Application's local credentials. You can also Restrict the access of this URL to some specific set of users (i.e users of particular groups).
• Use the settings given on Redirection Rules tab to redirect the users on login page based on their email domains, groups and directories. This feature is more useful in case you have multiple IDPs configured. Please refer to the next section.

Step 4: Multiple IDPs

Step 4.1: Configuring Multiple IDPs

• If your use case requires multiple IDPs to be configured on your SP, the plugin supports that as well. You can add another IDP by going to the Configured IDPs section and using the Add New IDP button.


Step 4.2: Managing SSO with multiple IDPs

• If you have multiple IDPs configured, you can choose how you want your end users to use these IDPs to perform SSO. IDPs to perform SSO.
• For example you can show the buttons for the different IDPs configured on the login page nad let the users decide which IDP to use for SSO.
• Or you could force certain users to user a specific IDP based on the domain of their username/email.
• You will be able to configure these rules in the Redirection Rules section, under the Redirection Rules tab.
• By default one rule is always configured that will be applicable to all the users, irrespective of their user domains.
• For instance, if you want to display the login page with SSO buttons for each of the IDPs then your Default Rule will be as follows :

• Based on the default rule mentioned above, the login form will contain buttons for each IDP. The users will be free to choose whichever IDP they want to use to initiate SSO.

• You can also configure a rule so that your users will automatically be redirected to an IDP based on their email domains.
• For example, if you want users with example.com as domain to be redirected to IDP 1 you can add a rule by :
  
  
  1. Click on the Add Rule button in the Redirection Rules tab
  2. Enter a name for your rule in Rule Name
  3. In the IF statement select Email Domain in the first drop-down
  4. For the same statement select equals in the second drop-down.
  5. In the last field of the IF statement, enter the email domain(example.com for the purpose of this example)
  6. In the Then Redirect To drop-down, select the IDP you want the users with example.com to be redirected to(IDP 1 in this case)
  7. Click on Save
  
• When a rule such as an example given above is configured, a login form will be displayed to the users where they will have to input their email address.

• In this section you will also configure an emergency URL to by-pass SSO. This setting can be found under the Sign-In Settings tab in the left side menu.