Establish Connection
On Entra
Click on Enterprise Application:
Click New Application:
Click Create your own Application:
Choose a distinct name,
Choose "Integrate any other application you don't find in the gallery.
Click Create.
This might take a while.
Choose "Single Sign-On":
Choose SAML:
Edit Basic Configuration:
Add Identifier and Reply URL and click save and close the sidebar:
Scroll Down to SAML Certificates and donwload Metadata XML:
On Application(BlueSpice):
This metadata XML file has to be saved in the persitent storage of your Dockers under $DATADIR/wiki/simplesamlphp/ as saml_idp_metadata.xml
Open Browser to URL:
https://my.cool.bluespice.url/_sp/module.php/saml/sp/metadata.php/default-sp
and your Browser downloads a File named default-sp.xml
On Entra:
Upload File here:
On Wiki:
Check Connection in Browser under URL:
https://my.cool.bluespice.url/_sp/module.php/admin
You can find the password in the persitent storage of your Dockers under $DATADIR/wiki/.wikienv
Choose Test:
Choose default-sp:
Now you should see your Azure Users Basic Claims or be forwarded to Login to Azure and see your BasicClaims afterwards.
Please compare your claim pathes with this given string and change values where needed:
{"emailAttribute":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress","realNameAttribute":"http://schemas.microsoft.com/identity/claims/displayname","usernameAttribute":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name","authSourceId":"default-sp"}
Go to Wiki SpecialPage BlueSpiceConfigmanager:
https://my.cool.bluespice.url/wiki/Special:BlueSpiceConfigManager
| Name | Value | Usage |
|---|---|---|
| Button Label | Free String | Just a Identifier for the Login Button. Usefull if you have several Authentication Providers |
| PluginName | "SimpleSAMLphp" | Tells BlueSpice what plugin to use |
| Data object | json-string | Tells BlueSpice the Sources of the UserInformation |
| Group object string | json-string | Tells BlueSpice about groupsync configuration |
Click Add , check the Chekbox"Should login occur automatically when a user visits the wiki?", and after that click Save.
Open Wiki in a New Browser or Private Session:
Enable Auto-Login:
Step 1: Enable AutoForwarding to LoginPage
Step2: Disable LocalLogin:
Set:
<?php
$GLOBALS['wgPluggableAuth_EnableLocalLogin'] = false;
in post-init-settings.php
GroupSync
On Entra:
Go Back to Basic-Configuration Step and Edit Attribute and Claims: File:Setup Draft Setup Azure-SAML-Connection Attribute.png Click add GroupClaim: File:Setup Draft Setup Azure-SAML-Connection GroupClaim.png
Decide wich groups to add and choose SamaccountName as sourceAttribute: File:Setup Draft Setup Azure-SAML-Connection GroupClaim 2.png Wether you can assign groups directly to the Enterprise Application depends on the Active Directory plan level(License).
So mostly its All or Security Click save.
If you now return to the https://my.cool.bluespice.url/_sp/module.php/admin/test/default-sp
you should see also groups:
If not please retry in different Browser/Private Tab, clear cookies. Might be a problem with cache here.
Final Step: Check and Add Groupclaim to Configuration:
[{"groupAttributeName":"http://schemas.microsoft.com/ws/2008/06/identity/claims/groups","type":"syncall"}]
File:Setup Draft Setup Azure-SAML-Connection group4.png
Save and Finished. Remember that Groups are not created Automaticly in Wiki and Must be named identical To the Name in Azure.
See also:
