Single Sign-On

Single sign-on (SSO) is an authentication process that allows a user to access multiple applications with a single set of log in credentials. GigaVUE‑FM provides the following Single sign-on options, which are discussed in this topic:

First, check out this video from Gigamon Basics as a primer: Understanding how to configure user access to GigaVUE-FM using Single Sign-On and SAML helps you meet your security, compliance, and password management requirements. This video provides a primer on SSO, discusses SAML flows, and then shows you how to configure Single Sign-On via GigaVUE-FM.

Enabling Single Sign-On into GigaVUE-FM (SAML) [12:42]
Find more Gigamon Basics videos on Gigamon TV!

GigaVUE‑FM uses Shibboleth SAML 2.0 identity provider (open source leader in a bidirectional clock relationship (formerly master) IdP ) as an internal IdP for authentication and authorization. Shibboleth reads the data from GigaVUE‑FM’s local database and performs the authentication based on the authentication mechanism selected in the Authentication Type settings. GigaVUE‑FM is independent of the authentication mechanism (as Shibboleth takes care of authentication and authorization).

Notes:

  • GigaVUE‑FM starts with internal IdP, by default.
  • When you access GigaVUE‑FM, you will be navigated to the IdP's URL. You must then log in with your user name and password.
  • If you cannot access GigaVUE‑FM (due to server issues or any other issues), you can use the special access provided (https://<fm ip address/dns name>/admin). This access is applicable only for local users with super admin privileges.
  • You must restart GigaVUE‑FM every time you configure IdP.

The following external IdPs are qualified to be operational with GigaVUE‑FM:

To configure ADFS as external IdP you must perform the following:

  1. To configure GigaVUE‑FM in ADFS. Refer to Configure GigaVUE‑FM in ADFS for details.
  2. Configure external IdP, that is ADFS, in GigaVUE‑FM. Refer to Configure External IdP in GigaVUE‑FM for details.
  3. Refer to the "Trust Store" on page 1.

Note:  When you access GigaVUE‑FM using the external IdP, you will be navigated to the external IdP URL (Microsoft ADFS). You must then log in using the external IdP user name and password for logging in to GigaVUE‑FM.

Figure 1 External IdP Login Screen (ADFS):

Configure GigaVUE‑FM in ADFS

Prerequisite:

You must retrieve the Service Provider metadata (which is GigaVUE‑FM’s metadata) from https://<FM IP Address>/saml/metadata. This will serve as the service provider metadata file to configure in IDP.

To configure GigaVUE‑FM in ADFS as Relying Party:

  1. From the windows server, select Start > Administrative Tools > ADFS Management. The ADFS administrative console appears.
  2. Select ADFS folder. Go to the Actions menu and select Add Relying Party Trusts.

  1. Select Data Source: Select the Import Data About the Relying Party from a File option. Browse for the SAML metadata file as mentioned in the prerequisites.

  1. Specify a Display Name that identifies the application, example, FM.gigamon.com. Click Next.

  1. Select the option I do not want to configure MFA and click Next.

  1. Select Permit all users to access this relying party. Click Next.

  1. Review the data available in preview section and add the relying party.
  2. Open Edit Claim rules to grant user access:
  1. Add a New claim rule to transform UserPrincipalName as NameId:
    1. Choose the option send LDAP Attributes as claims.
    2. Specify claim rule name and choose the required LDAP store.
    3. Select LDAP Attribute as UserPrincipalName and outgoing claim type as NameId.
  2. Add a New Claim Rule to specify user specific access:
    1. Choose the option send Group Membership as claim.
    2. Specify claim rule name and select AD user group for which FM roles/user Groups must be assigned.
    3. Enter outgoing claim type as SAML User Group value configured in GigaVUE‑FM (default value is eduPersonAffiliation) and outgoing claim value as one of the following:
      • GigaVUE‑FM specific user groups (Super Admin Group or Admin Group or User Group)
      • Organizational specific user group. If organizational specific user group is provided, then you must enable Organizational Group Mapping.

To configure OKTA as external IdP you must perform the following:

  1. Configure GigaVUE‑FM in OKTA. Refer to Configure GigaVUE‑FM in OKTA for details.
  2. Configure external IdP, that is OKTA, in GigaVUE‑FM. Refer to Configure External IdP in GigaVUE‑FM for details.
  3. Install IdP signing certificates (OKTA) in GigaVUE‑FM. Refer to the "Trust Store" on page 1.

Note:  When you access GigaVUE‑FM using the external IdP, you will be navigated to the external IdP URL (OKTA). You must then log in using the external IdP user name and password for logging in to GigaVUE‑FM.

Configure GigaVUE‑FM in OKTA

Prerequisite:

You must retrieve the Service Provider metadata (which is GigaVUE‑FM’s metadata) from https://<FM IP Address>/saml/metadata. This will serve as the sp metadata file to configure in IDP.

Watch the video for configuring OKTA here: Gigamon Basics: Enabling Single sign-on into Fabric Manager (SAML).

To configure GigaVUE‑FM in OKTA as External IdP:

  1. Login to Okta.
  2. Enter the following details:

    3. Field

    Description
    New Application
    Platform Web
    Sign on Method SAML 2.0
    General Settings  

    App Name

    Fabric Manager

    Configure SAML

     

    Single Sign on URL

    Assertion Consumer Service URL from the service provider metadata.

    Enable the Use this for Recipient and Destination Address check box.

    Entity ID

    Paste the entity id copied from the Authentication Type page.

    Name ID Format

    Enter Email Address as name id format.

    Authentication User Name

    OKTA User Name

    Attributes

    Name

    SAML User Group Name

    Name Format

    Basic

    Value

    Email

    Group Attribute Statements

    Configure the proper Group Attribute Statements in OKTA

    Create SAML Integration

     

    Enable the check box I am on OKTA Customer adding an internal app.

     

     

Note:  Click Identity Provider Metadata and copy the URL in the address bar and paste it under third party authentication URL.

Note:  Ensure to download the OKTA Certificate for uploading in Trust Store.

Microsoft Azure

To configure Microsoft Azure as an external IdP you must perform the following:

  1. Configure GigaVUE‑FM in Azure. Refer to Configure GigaVUE‑FM in Microsoft Azure section for details.
  2. Configure external IdP, that is Azure, in GigaVUE‑FM. Refer to Configure External IdP in GigaVUE‑FM for details.
  3. Install IdP signing certificates in GigaVUE‑FM. Refer to the "Trust Store" on page 1.

Note:  When you access GigaVUE‑FM using the external IdP, you will be navigated to the external IdP URL (Microsoft Azure). You must then log in using the external IdP user name and password for logging in to GigaVUE‑FM.

Configure GigaVUE‑FM in Microsoft Azure

Prerequisite:

You must retrieve the Service Provider metadata (which is GigaVUE‑FM’s metadata) from https://<FM IP Address>/saml/metadata. This will serve as the sp metadata file to configure in IDP.

To configure GigaVUE‑FM in Microsoft Azure as External IdP:

  1. Log in to Microsoft Azure.
  2. Create a new non-gallery application under non Enterprise applications.
  3. From the application, access the single sign on option.

    4. Note:  To configure the SSO url and certificates: you can either perform the manual configuration or upload the metadata file directly using the Upload Metadata File option. The following steps are based on uploading the metadata file option.

  4. Select Upload Metadata file. Upload the metadata taken from GigaVUE-FM. The SSO attributes will be retrieved by default, except the Unique User Identifier field.

    5. Field

    Description
    Basic SAML Configuration
    Identifier (Entity ID) azure-sso
    Reply URL (Assertion Consumer Service URL) https://xx.xx.xx.xx:xxx/saml/sso
    Sign on URL Optional
    Relay State Optional

    Logout URL

    https://xx.xx.xx.xx:xxx/saml/singlelogout

    User Attributes and Claims

    givenname user.givenname
    surname user.surname
    emailaddress user.mail
    name user.userprincipalname
    mugesh user.groups
    Unique User Identifier Enter user.userprincipalname.

    SAML Signing Certificate

    Status Active
    Thumbprint  
    Expiration  
    Notification Email  

    App Federation Metadata URL

     
    Certificate (Base64) Download
    Certificate (Raw) Download
    Federation Metadata XML Download

    Set up FM SSO

    You'll need to configure the application to link with Azure AD.

    Login URL

     
    Azure Identifier  

Note:  To configure GigaVUE-FM to link with Azure AD, copy the login URL and paste it in the Third Party Authentication URL in the Authentication Type page.

Note:  Download the certificate (Base64) from Azure and upload in the trust store. Trust store is available under Administration -> System -> Certificates -> Trust store.