SAML

SAML is aan complicatedin-depth topic, however it represents the best option for securing users, and providing a centralisedcentralized user management platform.management. There are many SAML providers, and unfortunatelyno theysingle allconvention seem to have different terms for the manyon configuration optionsand available.implementation. Knocknoc is tried and tested with a few of them, and no doubt the configuration cancustomizable enough to be adapted to work with any standard SAML2 implementation.

SAML is the preferred authentication provider with Knocknoc, asif useryou secretsare neverunfamiliar passwith throughSAML here is an overview on the server,general principles and managementterms.

of the users

SAML and groups to ACLs is very simple. 

Knocknoc SAML Notes

Knocknoc can havesupport 2 separateIdPs, IDPsone for the user loginlogins and one for the /admin interface login. This lets MSPs or security teams be able to manage the users, without havingbeing granted ACLs granted.to the services being protected.

YouIn cansingle alsoIdP simplyenvironments useKnocknoc the same IDP forsupports users and admins,admins addfrom onlya assignsingle authentication source. Admin access can be authorized using groups or other keys within the SAMLIdP admin application to admins.response.

Groups in SAML

YourTo groupsutilize ingroup assignment via SAML the group names provided by the IdP need to be matched tomatch the groupsgroup name configured in Knocknoc,Knocknoc asand the IDP sends them on login, and KnocknocIdP needs to matchbe themconfigured to see what ACLs to grantsend the user.group Youon simplylogin.

create

Implementing a groupSAML in Knocknoc

that

When matchesconfiguring SAML in Knocknoc:

1. Identify the nameIdP ofand SP: Knocknoc is the SP, and your provider is the IdP (e.g OKTA, EntraID, Jumpcloud).
2. Configure Assertions: Customize the assertions to include the necessary user information, this can include sending group information and/or static assertions.
3. Select Bindings and Profiles: Choose appropriate bindings and profiles based on your use case.
4. Test the SAML IDPFlow: groupEnsure -that egthe "AWSDevs"authentication flow works as expected and thenis assignsecure, SAML responses can be tested using tools like SAML trace.
5. Monitor and Update: Regularly monitor the ACLsSAML yousetup wantand  that group to have. Members of the group will get the ACL on signin,update as thenecessary, IDPconsidering sendsany whichnew groupssecurity thepatches useror iscompliance arequirements.
member of.