You are viewing limited content. For full access, please sign in.

Question

Question

Options remove SAML user's license in LFDS automatically

SDK Directory Server Licensing
Updated September 29, 2022
asked on January 11, 2022

Use case: allow new employees to have temporary access to complete onboarding in Laserfiche Forms.

 

I believe this can be done through the LFDS SDK (https://support.laserfiche.com/download/4131/laserfiche-directory-server-sdk-for-10-4), so this is looking for alternatives to present to client. Anyone have SAML examples would be greatly appreciated (e.g. SDK only had exampled with Active Directory users).

 

Step 1 Add license: Use Self Registration (https://doc.laserfiche.com/laserfiche.documentation/11/administration/en-us/Default.htm#../Subsystems/LFDS/Content/self-registration.htm?TocPath=Directory%2520Server%257CSelf-Registration%257C_____0).

Step 2 Grant Access: User SAML Group with a matching LFDS Group 

Step 3 Remove users: ?

 

I understand the documentation have discussed Proxied Provider (https://doc.laserfiche.com/laserfiche.documentation/11/administration/en-us/Default.htm#../Subsystems/LFDS/Content/ProxiedProviders.htm?Highlight=proxied) but there doesn't seem to be any design/functionality notes on what it's capable of doing. Does it have the same functionality as "Rules" with the Identity Provider?

Your help with ideas and experience would be appreciated.

0 0

Replies

replied on January 11, 2022

I can elaborate on the Proxied Provider functionality. It's a weird name and easier to think about as "Linked Identity Providers".

Imagine the scenario where the "source of truth" identity provider for users is Active Directory, but you want to use a SAML provider sync'd with AD for authentication (Azure AD, Okta, etc.). The Proxied Providers feature lets you do the following:

  1. Add your AD IdP (if not added automatically)
  2. Add your SAML IdP, and link it to the AD IdP. Do not register anyone as a SAML user.
  3. When users log in via SAML, the identity claims in their SAML token are mapped to the associated AD/Windows user, and Laserfiche recognizes them as an AD user.
  4. Manage license provisioning with sync "Rules" on the AD IdP

 

This approach is typically the best option if the user accounts are in AD.

If they're not, the LFDS SDK is currently the only option. We're looking into adding certain time-based license deprovisioning features for SAML users in LFDS, but I don't have a timeline for if and when that would be available.

 

0 0
View 6 previous replies
replied on March 29, 2022 • Show version history

Thanks Samuel. We're looking at the LFDS SDK with our client now and cannot find the linkage for non-Full licenses to the members available in WellKnownLicenseType.

Besides Full and None, there is AuthenitcatedSubmitter, Restricted, and Retrieval.

Is this something we need to open a ticket as it depends on Avante/Rio?

0 0
replied on March 29, 2022

What license type are you trying to assign? Describe in terms of the license model (Subscription/Rio/Avante) and the name of the license as it appears in the LFDS admin UI.

0 0
replied on April 5, 2022

Our client is trying to add Education User.

0 0
replied on April 5, 2022

Also I want to confirm, SAML users may have certain field auto-populated when added manually (e.g. name, department, we're using Azure Active Directory). When we add a user using the LFDS SDK, can it also look up those values from SAML (either automatically or through some refresh)?

0 0
replied on April 12, 2022

Hi Michael,

My colleague on the LFDS team tells me that to get the GUID for Education user licenses:

They may need to get the MasterLicense, then look for the matching guid under licenses. It doesn't sound like there's a direct lookup. It sounds like LMO can do it, they won't need to grab the license manually.

 

When you add SAML users manually, you have to provide all those extra (non-required) attribute values. When a user logs in and their SAML token includes those attributes in its claims, LFDS will update its side with the values in the token at that time.

The SAML specification doesn't have a "look up" attributes function - it's purely for authentication. However, the complementary SCIM protocol does. It's designed to sync users/groups/attributes to provide functionality similar to LFDS AD Group Sync.

There are two versions of SCIM:

v1.1, used by Okta and others, which LFDS has implemented, and v 2.0, used by Azure Active Directory and others, which is tentatively on the LFDS implementation roadmap by the end of the year. SCIM the "right" way to address the "syncing SAML users and attributes" scenario, so I'd recommend implementing whatever stopgap functionality you need in LMO now and then waiting for official AAD SCIM 2.0 support in LFDS.

Note that LFDS SCIM support does require the Laserfiche Enterprise Identity Management (EIM) add-on license.

Cheers,
Sam

0 0
replied on September 29, 2022

Follow-up questions: 

1. Does SCIM protocol in conjunction with Laserfiche have the ability to remove user licenses?  I may have missed it but I did not see if that question was answered above.

2. Is there a way to leverage SCIM to sync users that might need different licenses? When using AD sync you can create multiple rules that can give users participant/educational or full licenses depending on the AD group they are a part of.  Based on what I see in the instructions below, it seems like you can only set one license type and all users provisioned through SCIM will be given this specified license type.

https://doc.laserfiche.com/laserfiche.documentation/11/administration/en-us/Subsystems/LFDS/Content/ConfiguringSCIMinDirectoryServer.htm

0 0
replied on September 29, 2022

Hi Isaac,

  1. Yes, my understanding is that it deprovisions users as well. If it didn't, there would be no real reason to use it over Just-in-Time (JIT) provisioning.
  2. Not currently. We're aware this is a significant functionality gap and hope to address it Soon™. For the moment, I believe you can use JIT and SCIM together, with the latter for the license type it's most important to have deprovisioning for.
0 0
replied on September 29, 2022

Understood, thank you Samuel.

0 0
replied on September 29, 2022

Soon™ laugh I see what you did there. WoW!

1 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...