Overview
Bizagi supports integration with an Identity provider featuring federation services.
This way, in Bizagi you may rely on Single Sign-On capabilities and entrust the authentication to your corporate Identity provider (i.e Active Directory Federation Services, Ping Federate).
Benefits
When using Federated authentication, outstanding benefits for your organization are:
1. Presenting a single and unified login screen to your end users, when these access any application of your corporate domain (avoiding multiple login screens of different applications).
Similarly, end users will need to remember a single login account and its password (avoiding multiple login accounts and multiple corresponding passwords).
2. Centralizing your users repository and its authentication system.
This automatically reduces the administration overhead produced when you have multiple authentication systems due to the periodical tasks needed (handle idle accounts, reset passwords, etc).
3. Enforcing security policies.
By having a central user repository and authentication system, you may enhance security measures in it and strict security policies (i.e for passwords, account characteristics and profiles, etc), and rely on the secure protocols such as HTTPS for the communication between your corporate domain applications.
4. Providing a best user experience for end users that access applications in your corporate domain from any location or device.
Through federated authentication in Bizagi, desktop, tablets and mobile devices rely on standard protocols to enable a Single Sign-On experience.
Federated authentication architecture
The following image illustrates the system architecture involved when using federated authentication.
Notice in the above scheme:
•That your Identity provider (or Identity Assertion Provider) is responsible of providing the authentication through standard assertions and security tokens.
•Bizagi is set up as a Service provider, which entrusts the authentication to the Identity provider by having a predefined trust relationship with it (Bizagi becomes in this scheme what is known as a relying party).
•While using Federated authentication, passwords are not stored in Bizagi and the system architecture relies on HTTPS secure protocols to send assertions.
For HTTPS, you need at least 2 valid certificates (one for your identity provider and one for your service provider).
Certificates for this use, are referred to, as SSL server certificates (and from this point on as such they will be mentioned).
Valid certificates (i.e for your production environment) need to correspond to server certificates as issued/recognized by a valid Certificate Authority (CA).
•You would use the same server certificates employed for an SSL/TLS protocol, to sign off assertions.
Sequence diagram
Federated authentication works in detail, as explained below:
1. End users access Bizagi through any given device.
2. Identity provider service is identified, by having such endpoints configured in Bizagi.
3. Bizagi redirects the authentication against the identity provider.
4. The end user sees a login page and authenticates to the entrusted identity provider (when not authenticated yet).
5. Proper identification of that user for a registered domain takes place.
6. The identity provider responds with an XHTML form (sends an assertion with token).
7. The end user's request will proceed to go back to Bizagi this time with a token that certifies its authentication.
8. Bizagi redirects to the initial requested resource/page.
9 -10. The end user accesses that resource page.
Prerequisites
Before you move on, make sure:
1. You have a setup Identity provider which supports the WS-Federation Passive Protocol such as Microsoft ADFS.
While using the WS-Federation protocol, Bizagi will rely on a SAML 1.1 token.
2. Both your Identity provider and your Bizagi Work portal is setup using the HTTPS protocol.
You will need to have the corresponding valid SSL/TLS server certificate for this (up-to-date and issued by a Certificate authority).
When signing off the certificate to send it off to Bizagi, Bizagi supports using the SHA-256 algorithm.
|
The recommended version to use Federated Authentication in Bizagi is ADFS version 3.0. |
What you need to do
To configure federated authentication for your Bizagi project, follow these steps:
1. Configure the Identity provider to work with Bizagi
For more information about this step, refer to Configure the Identity provider to work with Bizagi.
2. Configure the authentication parameters in Bizagi
For more information about this step, refer to Configure the authentication parameters in Bizagi.
Important
For any type of authentication, you will need to make sure that users are created at Bizagi Work portal.
Disregarding the selected Authentication type for your Work Portal login at runtime, you will need to have imported/synchronized users from your user AD repository and into Bizagi (this task may be scheduled in Bizagi).
For more information about this option, refer to Importing LDAP Users.
Last Updated 8/29/2022 9:02:51 PM