Validating your SAML2 metadata for SAFIRE

SAFIRE publishes detailed technical requirements for metadata (detailed here: idp; sp). When on-boarding a new provider or making changes, it is helpful to be able to check your metadata against these requirements before sending them to the Federation Operator. The metadata validator allows you to do this, and provides useful insight into issues that might prevent your metadata from being imported into SAFIRE’s registry.

To ensure broad compatibility with commonly used SAML identity providers, SAFIRE’s federation hub can adjust its behaviour to handle specific quirks in some implementations. This is mainly intended for proprietary SAML software stacks that do not fully support our deployment profiles. It is not a substitute for correcting misconfigurations.

Quirks are signalled in identity provider metadata by setting the x-safire.ac.za:quirks EntityAttribute as follows:

<mdattr:EntityAttributes>
  <saml:Attribute FriendlyName="quirks" Name="urn:x-safire.ac.za:quirks" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    <saml:AttributeValue>quirk1</saml:AttributeValue>
    <saml:AttributeValue>quirk2</saml:AttributeValue>
  </saml:Attribute>
</mdattr:EntityAttributes>

Note that is is only supported for identity providers that are directly registered in SAFIRE.

This documentation will guide you through the Microsoft Entra ID (Azure AD) configuration process as an authentication source in SimpleSAMLphp. By integrating Entra ID in this way, you can retain your users’ familiar login experience while leveraging SimpleSAMLphp’s flexibility to fetch and/or manipulate attributes from Entra ID and other sources.

While SAFIRE can directly work with Entra ID or SimpleSAMLphp (as explained in our Configuring Entra ID SAML-based SSO for SAFIRE and Configuring SimpleSAMLphp for SAFIRE documentation), you may find yourself in a situation where this approach better fits your use case.

Microsoft does not recommend deploying new instances of AD FS. Instead, they encourage you to consider Entra ID (formerly Azure AD). This raises a common question: can you migrate an existing SAFIRE identity provider from AD FS to Entra ID?

Unfortunately, the answer is not straightforward. This document outlines the main challenges, along with some approaches you might consider.

No direct migration path

In Entra ID, SAML identity providers are configured as “Enterprise Applications”. However, the cloud SAML provider does not offer feature parity with AD FS and has some fundamental limitations. We’ve previously documented how to integrate Entra ID with SAFIRE for a new identity provider and highlighted some of the caveats.

Changes have been made to SAFIRE’s attribute release policy and supported attributes to provide support for two additional REFEDS attribute release profiles: Anonymous Access and Pseudonymous Access.

While it is possible to connect Microsoft Entra ID directly into SAFIRE, this has several caveats you need to be aware of. To help you make an informed decision, the info boxes in this document highlight some of the things you need to consider. Read through it carefully before starting your implementation.

Microsoft recommends integrating Entra ID into SAFIRE via a SAML Proxy such as Shibboleth, which mirror’s the R&E federation communty’s guidence. (Some SAFIRE providers opt to use SimpleSAMLphp for this instead.) Doing this avoids many of the caveats highlighted below.

Types of certificates

SAML installations typically use at least two¹ different certificates: one of the public facing portions of a website, and one to establish a private trust relationship between providers. Whilst it is possible to use the same certificate for these two roles, this is not best practice nor is it recommended.

There is considerable interest in leveraging SAFIRE and eduGAIN to integrate with the various library information providers, such as academic content, journal, and database publishers. Information providers variously term this “Shibboleth”, “SAML” or “Institutional” logins, and in most cases are already integrated with other federations around the world.

The following documents the integration status of various providers in SAFIRE.

On Friday 30 June we’ll be performing a major version upgrade of the software that’s at the core of SAFIRE’s federation hub. Although no downtime is expected, you can expect the following:

• All users will need to re-authenticate the first time they access a service after the upgrade;
• There will be cosmetic changes to the user interface, particularly in the information transfer notice.

This theme generator has been updated for SimpleSAMLphp 2.0.x

A number of people seem to find SimpleSAMLphp’s theming system intimidating. To aid with this, we’ve written a simple theme generator for SimpleSAMLphp.

The generator takes SSP’s stock templates and massages them to include some branding – amongst other things, a logo on the top left of the page and corporate colours in the header bar.

The generator is a bash script, and is available here. It takes a number of command line options which can be used to manipulate the resulting theme: