ARTIFACTORY: How do I configure Artifactory SAML SSO with PingFederate

PingFederate is an enterprise federation server that enables user authentication and single sign-on. The JFrog Platform offers a SAML-based Single Sign-On service allowing identity providers full control over the authentication process. Using SAML, the JFrog Platform acts as a service provider that receives users' authentication information from external identity providers like PingFederate.

To integrate the PingFederate with Artifactory using SAML SSO, following actions included.

• Set up an IDP Adapter for managing users or Identities
• Configure an SP connection to authorize access to the Artifactory
• Configure Artifactory SAML SSO with Authentication Provider information

Set up a simple IDP Adapter instance
If you already have an IDP adapter, please ignore the steps below and go to the next action.

1. Go to PingFederate UI and then IdP Adapters 
2. Create a new Instance and add Name, ID
3. Select suitable adapter, ex: HTML Form ID Adapter and click Next
4. Click on the button “Manage Password Credential Validators” in the bottom and create a new instance
5. Give an instance name and ID and select the required type for example, “    Simple Username Password Credential Validator”. (in this instance you can add users). Once completed click done
6. Click on “Add a new row to 'Credential Validators”
7. Choose the “Password Credential Validator Instance” created from the drop down and then update
8. Select session state as “globally” and click next
9. Under adapter attributes, Unique User Key Attribute - select username.
10. Select ‘Pseudonym’ for any attribute other than “username”.
11. Under “Attribute Sources & User Lookup”, add “attribute source” if needed. (optional)
12. Skip “Adapter Contract Fulfillment” and click next
13. Skip “Issuance Criteria” and click next
14. Click done and save next

Configure an SP connection
Here, we are mapping the IDP Adapter and the Artifactory service.

1. Log into your PingFederate UI.
2. Under SP Connections click on Create New.
3. On the Connection Template page, choose “Do not use a template for this connection” and click Next
4. Under Connection Type, select Browser SSO Profiles, choose the SAML 2.0 protocol and click Next.
5. On the Connection Options page, tick the Browser SSO checkbox, and click Next.
6. Under the Import Metadata select NONE and click Next.
7. On the General Info page, in the Partner’s Entity ID (Connection ID) textbox, fill in the desired name that describes your SP (Artifactory) instance. Note: The Entity ID you provide will be used thereafter for Artifactory’s SAML SSO settings (in the SAML Service Provider Name textbox). So, be sure they are exactly the same.
8. In the Connection Name textbox, fill in the desired name. Thereafter, click Next.
9. On the Browser SSO page, click on Configure Browser SSO.
10. On the SAML Profiles page, tick only the SP Initiated SSO checkbox. Thereafter, click Next.
11. You can skip the Assertion Time page by clicking Next. 
12. On the Assertion Creation page, click on Configure Assertion Creation.
13. On the Identity Mapping page, select Standard, and click Next.
14. On the Attribute Contract page, in the for the Attribute contract  “SAML_SUBJECT”, select Subject Name Format as “urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified”, and click Next.
15. On the Authentication Source Mapping page, select Map New Adapter Instance.
16. On the Adapter Instance page, under the Adapter Instance dropdown menu, choose your desired adapter (Note: To configure adapter instance, refer to the steps above) Click Next.
17. Under Mapping method, select “Use only the Adapter Contract values in the SAML assertion” and click Next.
18. On the Attribute Contract Fulfillment page, in the Attribute Contract section, select Adapter in the Source dropdown menu, select the username in the Value dropdown menu, and click Next. (username should be one of the adapter contract value you created or which is available in the IDP adapter)
19. Skip the Issuance Criteria page by clicking Next.
20. On the Summary page, click Done.
21. On the Authentication Source Mapping page, click Next.
22. On the Summary page, click Done.
23. On the Assertion Creation page, click Next.
24. On the Protocol Settings page, select Configure Protocol Settings.
25. On the Assertion, Consumer Service URL page, tick the default checkbox and enter the value “0” in the Index textbox. Then, select POST in the Binding dropdown menu. Thereafter, in the Endpoint URL textbox, fill in https://{ARTIFACTORY_URL}/artifactory/webapp/saml/loginResponse click the Add button, and click Next.
26. On the Allowable SAML Bindings page, tick only the POST and Redirect checkboxes. Then, click Next.
27. On the Signature Policy page, tick the Always sign the SAML assertion checkbox. Then, click Next.
28. On the Encryption Policy page, choose None, and click Next.
29. On the Summary page, click Done.
30. On the Protocol Settings page, click Next.
31. On the Summary page, click Done.
32. On the Browser SSO page, click Next.
33. On the Credentials page, click Configure Credentials.
34. Click on Manage certificates and create a new certificate with Signature Algorithm RSA SHA256, click Next and click Done
35. On the Digital Signature Settings page, under the Signing Certificate dropdown menu, select the desired certificate with RSA SHA256. Then, click Next.
36. On the Summary page, click Done.
37. On the Credentials page, click Next.
38. On the Activation & Summary page, click to Active. Then, click Save.

Configure or get the PingFederate Server IP and details:
System → Server → Protocol settings



To export the SAML metadata:
Under SP Connections  page, in the Connection Name menu find the name that you configured for your Artifactory instance and click on Export Metadata. Click Next. 
Click Export and save the metadata.xml file. Then, click Done.

Snippets from PingFederate Console







Configure PingFederate in Artifactory SAML SSO

Once the SP connection is completed and Metadata.xml is exported from PingFederate, we can use those details to configure in Artifactory UI.

1. Log in to Artifactory UI as an admin user.
2. Navigate to the Administration  → Authentication → SAML SSO
3. Tick the Enable SAML Integration checkbox.
4. In the SAML Login URL textbox, fill in https://{PINGFEDERATE_URL}:{PORT}/idp/SSO.saml2. (Ex: https://pingfederate.jfrog.io:9031/idp/SSO.saml2)
5. In the SAML Logout URL textbox, fill in https://ARTI_URL/ui/login( Ex: https://myartifactory.jfrog.io/ui/login)
6. In the SAML Service Provider Name textbox, fill in the Entity ID that you configured for your IDP in the SP connection (here, “jfrogping”).
7. In the SAML Certificate textbox, fill in the x509 certificate that was provided with the metadata.xml file that you exported from your PingFederate instance.
8. Select “Auto Create users”
9. Click Save.
10. Log out of Artifactory, then to verify that your configuration is correct, click "Log In" and click "SAML SSO"

Snippet from Artifactory SAML SSO





Troubleshooting

After SAML integration, if you are unable to login, please review the artifactory-service.log. A sample error message is as follows

Error occurred while trying to login using SAML: Fail to find SAML Assertion in response.

This happens if the SAML SSO configuration in the Artifactory and PingFederate are not matching. 

1. Verify the SAML Service Provider and Entity ID in the SP connection are matching or not
2. Verify the Consumer Service URL is correctly given in SP connections.

You can also verify the server.log of the PingFederate and see the SAML response received from Artifactory is not the same as we configured. 

Reference: 
https://jfrog.com/help/r/jfrog-platform-administration-documentation/saml-sso