| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:saml_joomla [2025/04/27 10:10] – [Configuring the Service Provider (Joomla)] kainhofer | en:2.0:single_sign_on:saml_joomla [2026/09/04 18:49] (current) – [Setting up the Client (SP) in Admidio] kainhofer |
|---|
| Throughout the document we will assume you have both Admidio and Joomla already set up properly at https://admidio.local/ and https://joomla.local/. Please modify these URLs to your actual installation. | Throughout the document we will assume you have both Admidio and Joomla already set up properly at https://admidio.local/ and https://joomla.local/. Please modify these URLs to your actual installation. |
| | |
| As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]] | As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to any client. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]]. |
| {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} |
| |
| Basically, one (1) needs to **create a cryptographic key** to sign message and **choose a unique EntityID**. | Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**. |
| The page preferences https://admidio.local/adm_program/modules/preferences.php?panel=sso also provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. | |
| | The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. |
| |
| ===== TL;DR; - Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up a client (SAML "Service Provider" - short SP) to use Admidio's user accounts for logging in consists of two steps. If both the IdP (Admidio in our case) and the SP (Joomla in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either. | Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Joomla in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward. |
| |
| * At the **Service Provider (SP)** - Joomla in our case - **install the extension** to support SAML login. | * At the **Service Provider (SP)** - Joomla in our case - **install the extension** to support SAML login. |
| * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. | * Choose whether sent messages **should be signed and/or encrypted** (these features require an additional private key and certificate for the SP!), and whether received messages are checked for signatures or encryption is expected. |
| * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. | * In **Admidio**, **create a new SAML client**. If the SP provides a **metadata URL**, paste it and let Admidio automatically load the configuration from the SP. One can also manually paste these settings. |
| * Choose an easily understood **label for the client** (only used in Admidio's list of clients, but has no technical use) | * Choose an easily understood **label for the client** (only used in Admidio's list of clients as visual identifier, but has no technical use) |
| * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. | * Enter the **ClientID from the SP**, as well as the ACS URL and the SLO response URL. These values must be provided by the client. |
| * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. | * In Admidio, also choose whether sent messages should be **signed or encrypted**. The crypto key generated in the general SAML setup will be used. |
| |
| |
| Paste the metadata URL copied from Nextcloud into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Nextcloud and pre-fill the following fields correctly. Only the Client Name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. | Paste the metadata URL copied from Joomla into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Joomla and pre-fill the following fields correctly. Only the Client Name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. |
| {{ :en:2.0:sso:sso_saml_02-05_nc_admidio_clientsetup1.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_joomla_05_saml_client.png?direct&600 |}} |
| | {{ :en:2.0:sso:sso_saml_joomla_05_saml_client1.png?direct&600 |}} |
| |
| | The only other setting that is relevant for the limited features of the free Joomla plugin is the User ID field. The Joomla plugin insists on matching only E-Mail Addresses, so make sure to select it: |
| | {{ :en:2.0:sso:sso_saml_joomla_06_saml_userid.png?direct&600 |}} |
| |
| In addition to the Entity ID and URLs to connect SP and IdP and the certificate, which are configured automatically, one also needs to define the attribute and role mapping. The username is the most relevant. To use Admidio's group memberships as Nextcloud groups, make sure to include the "Roles" field and provide the correct field name in Nextcloud. Internally, Nextcloud will add a prefix to the role names, which makes it impossible to assign admin rights to SAML groups (Nextcloud uses the group with internal name "admin" for administrators). If you want to assign admin rights through SAML, too, then you must enter a single space into the prefix field. This causes Nextcloud to take the role names verbatim as Nextcloud group names, including "admin". | The other advanded features like fields or group mapping can be ignored or cleared in the client config. The restriction to certain groups, however, is implemented in Admidio and works with Joomla, too. |
| |
| {{ :en:2.0:sso:sso_saml_02-06_nc_admidio_clientsetup1.png?direct&600 |}} | |
| |
| <WRAP center round todo 60%> | ==== Setup completed, test Single-Sign-On ==== |
| TODO: Describe signing and encryption settings (synced) | Admidio and Joomla should now be set up to use Admidio for logging in to Nextcloud. To check, you can go back to the plugin config page and use the "Test Configuration" button at the bottom of the page. |
| </WRAP> | |
| {{ :en:2.0:sso:sso_saml_02-07_nc_admidio_clientsetup3.png?direct&600 |}} | |
| |
| | If you log out of Joomla (or open the page in an incognito browser window), you should see the login screen with the choice of logging in with password or via SAML. |
| ==== Setup completed, test Single-Sign-On ==== | {{ :en:2.0:sso:sso_saml_joomla_07_login_form.png?direct |}} |
| Admidio and Nextcloud should now be set up to use Admidio for logging in to Nextcloud. If you log out of Nextcloud, you should see the login screen with the choice of logging in with password or via SAML. | |
| {{ :en:2.0:sso:sso_saml_02-08_nc_saml_login.png?direct&400 |}} | |
| |
| After choosing SAML login and loggin in with a user from Admidio, you should be logged in to Nextcloud. | After choosing SAML login and loggin in with a user from Admidio, you should be logged in to Nextcloud. |
| {{:en:2.0:sso:sso_saml_02-09_nc_saml_loggedin.png?direct&200|}} | {{ :en:2.0:sso:sso_saml_joomla_08_joomla_login_form.png?direct |}}{{ :en:2.0:sso:sso_saml_joomla_09_logged_in.png?direct |}} |
| {{:en:2.0:sso:sso_saml_02-10_nc_saml_users.png?direct&600|}} | |
| |
| |
| ==== Caveats and Things to Consider ==== | ==== Caveats and Things to Consider ==== |
| |
| * For security reasons, Nextcloud will prepend **SAML_ prefix to the group names** obtained from the SAML IdP. This makes hybrid environments quite hard in practice, where some users authenticate via SAML, others via local accounts or other network accounts. In these hybrid cases, the SAML-generated groups will be different than the local groups and all group permissions need to be set twice! As a **workaround**, one can **enter a single space into the prefix input box**. This will cause Nextcloud's SAML extension to clear the prefix, but the input field will appear empty in the future, so it is not clarly visible whether the prefix was "cleared" or the default prefix will be applied! | * The miniOrange Joomla plugin requires the email address to be used as the user ID, so only users with a valid email in Admidio can log in! One also has to make sure the Admidio SAML client is configured to use the email as the user ID. |
| | * The miniOrange SAML plugin for Joomla does not support single-log-out in its free version (and the paid version is several hundreds of Euros for every installation, even for a test system or a staging clone) |
| |
