SSO Testing
- Bridget Almas
Test scenarios and setup for testing SSO using Auth0 as an IdP
See also tickets
Basic Setup Instructions
Go to Auth0: Secure access for everyone. But not just anyone.
Click the Sign up button
Create an account
In the sidebar, click Applications/Applications
Click Create Application
Name: CollectionSpace
Application type: Regular Web Applications
Click the Settings tab
In Allowed Callback URLs, enter
https://{cspace server}/cspace-services/login/saml2/sso/{your name}-auth0(replace{cspace server}with the server that is going to use this IdP, and{your name}with some version of your name that has no spaces)Click the Save Changes button
Click the Addons tab
Turn on SAML2 WEB APP
Click the Settings tab in the pop-up that appears
Make note of the Identity Provider Metadata URL
Click the Enable button
Ask hosting to add the following SSO relying party configuration to the CSpace server you referenced in step 7 (replacing the stuff inside curly braces with appropriate values):
<relying-party id="{your name}-auth0"> <name>{your name}'s Auth0</name> <icon location="https://cdn.auth0.com/manhattan/versions/1.5422.0/assets/badge.png" /> <metadata location="{metadata url from step 12}" /> </relying-party>Note that the
idabove must be the same as the last path element of the URL you entered in step 7.Wait for the CSpace server to be redeployed and restarted
SAML log in with your IdP should now work. To verify:
Log in to CSpace as an admin user
Create a user in CSpace, and note the username/email
Log out
Log in, selecting Continue with {your name}'s Auth0
The Auth0 log in screen appears. Click to Sign Up link to register a new Auth0 user, using the email from step 2.
You should be logged in as the user you created in step 2.
Useful for further testing:
To log out of the Auth0 account:
In the Auth0 sidebar, click on Applications/Applications
Click on the CollectionSpace application
Note the content of the Domain field
Visit
https://{domain}/v2/logoutto log out
To change the email of an Auth0 user:
In the Auth0 sidebar, click on User Management/Users
Click on the user to edit
Click on the Actions button, then Change email
Enter the new email
Click the Save button
The test scenarios below specify additional configuration settings for the Auth0 IdP.
Configuration Scenario 1 |
|
|---|---|
Scenario Description | Email address used for both |
CSpace User Setup | Create a user on CSpace with the email testconfig1@example.com |
Relevant SAML Config on CSpace Server | <assertion-username-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-sso-id-probes> |
Relevant Auth0 IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is not found and login fails |
Configuration Scenario 2 |
|
|---|---|
Scenario Description | Email address used for both |
Preconditions | Create a user on CSpace with the email testconfig2@example.com |
Auth0 Mappings | {
"mappings": {
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
}
} |
Relevant SAML Config on CSpace Server | (Note the use of the |
Relevant Auth0 IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is not found and login fails |
Configuration Scenario 3 |
|
|---|---|
Scenario Description | Email address used for both |
Precondition | Create a user on CSpace with the email testconfig3@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | (Note the use of the |
Relevant Auth0 IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is not found and login fails |
Configuration Scenario 4 |
|
|---|---|
Scenario Description | Email address used for both |
Precondition | Create a user on CSpace with the email testconfig4@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is not found and login fails |
Configuration Scenario 5 |
|
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig5@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login succeeds (because attribute that is used for sso-id hasn’t changed) |
Configuration Scenario 6 | THIS IS THE MOST LIKELY IDP SETUP |
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig6@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpts |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login succeeds (because name identifier in the subject that is being used for sso-id hasn’t changed) |
Configuration Scenario 7 |
|
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig7@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | (Note the use of the identifier attribute for sso-id )
|
Relevant IDP Metadata excerpts |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login succeeds (because the value for identifier attribute used for sso-id hasn’t changed) |
Configuration Scenario 8 | Mimics 8.0 functionality in 8.1 |
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig8@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpts |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login fails |
Configuration Scenario 9 | Mimics 8.0 functionality in 8.1 |
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig9@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpts |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login fails |
Configuration Scenario 10 | Mimics 8.0 functionality in 8.1 - SUCCESS SEQUENCE |
|---|---|
Scenario Description | Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig10@example.com |
Auth0 Mappings | |
Relevant SAML Config on CSpace Server (Step 1) | |
Relevant IDP Metadata excerpts (Step 1) |
|
Expected behavior upon initial login | User is found and login succeeds |
Relevant SAML Config on CSpace Server (Step 2) | |
Relevant IDP Metadata excerpts (Step 2) |
|
Expected behavior after SAML config change | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP after SAML config change | User is found and login succeeds |
Configuration Scenario 11 |
|
|---|---|
Scenario Description | Using untyped Attributes. Email address asserted as |
Precondition | Create a user on CSpace with the email testconfig5@example.com |
Auth0 Mappings | |
Auth0 Additional Settings |
|
Relevant SAML Config on CSpace Server | |
Relevant IDP Metadata excerpt |
|
Expected behavior upon initial login | User is found and login succeeds |
Expected behavior after changing email address on Auth0 IdP | User is found and login succeeds (because attribute that is used for sso-id hasn’t changed) |