Using SAML as the Authentication Source for Digital Hive

Using SAML as the Authentication Source for Digital Hive

Question

Can Digital Hive leverage SAML as the authentication source so that existing an SAML provider can be used?

Answer

Digital Hive, both Windows and Linux, can be configured to use SAML authentication.

It is highly recommended that SAML integration is configured BEFORE a user has logged into the Digital Hive application. If a user has previously logged into Digital Hive before SAML was configured, please contact the Customer Success team at support@digitalhive.com.

Note: After completing these steps, the first user to log into Digital Hive will be the Super User so please make sure that the first user to access Digital Hive is the intended Super User.

Windows

  1. From within the Services panel, stop the DigitalHive-node1 service
  2. Using the Windows File Explorer, navigate to <install directory>\DigitalHive\app\node1\tomcat\bin
  3. Right click on the tomcat9w.exe file
  4. Select Create shortcut
  5. Drag the newly created tomcat9w.exe - Shortcut to the desktop
  6. Right click on the tomcat9w.exe - Shortcut
  7. Select Properties
  8. On the Shortcut tab, append //ES//DigitalHive-node1 to the Target making sure that there is a space between the value and the appended string 
  9. Click OK
  10. Double click the Desktop tomcat9w.exe - Shortcut
  11. Click Yes
  12. Select the Java tab
  13. In the Java Options: section add -Dspring.profiles.active=saml_auth to the list of strings                              
  14. Click OK
  15. Using the Windows File Explorer, navigate to <install directory>\DigitalHive\app\node1\tomcat\conf
  16. Edit the theia.properties file
  17. Edit or Add the following parameters
            #SAML Properties
            saml.idp.metadata.url should point to the IDP metadata provider URL (example: https://digitalhive.okta.com/app/digitalhive/exknxtx1ia8vlwhPd2/sso/saml/metadata)
            saml.sp.entity.id identifier for Digital Hive as an SP. This ID will be configured in the IDP to support Digital Hive authentication
            saml.keystore.location is the location of the keystore for signing requests to Digital Hive. Defaults to the Digital Hive web keystore at conf/keystore.jks
            saml.keystore.password is the password for the above keystore
            saml.keystore.key.alias is the alias of the key used to sign requests. The default value is Digital Hive
            saml.keystore.key.password is the password for the above key alias
            saml.username.attribute.name is the attribute name (from the assertion) to be used for the username. The default value is email
            saml.authorities.attribute.name is the attribute name (from the assertion) to be used for the user groups/authorities. The default value is eduPersonAffiliation

    18. Save and Close the text editor
    19. From within the Services panel, start the DigitalHive-node1 service

Digital Hive on Windows is now configured to use SAML for authentication. 

Linux

  1. Navigate to the root DigitalHive install and run .\tomcat.sh -stop
  2. Navigate to DigitalHive\app\node1\tomcat\conf
  3. Edit the theia.properties file
  4. Search for motio.theia.tomcat.jvm.opts and append: -Dspring.profiles.active=saml_auth
  5. Edit or Add the following parameters
            #SAML Properties
            saml.idp.metadata.url should point to the IDP metadata provider URL (example: https://digitalhive.okta.com/app/digitalhive/exknxtx1ia8vlwhPd2/sso/saml/metadata)
            saml.sp.entity.id identifier for Digital Hive as an SP. This ID will be configured in the IDP to support Digital Hive authentication
            saml.keystore.location is the location of the keystore for signing requests to Digital Hive. Defaults to the Digital Hive web keystore at conf/keystore.jks
            saml.keystore.password is the password for the above keystore
            saml.keystore.key.alias is the alias of the key used to sign requests. The default value is Digital Hive
            saml.keystore.key.password is the password for the above key alias
            saml.username.attribute.name is the attribute name (from the assertion) to be used for the username. The default value is email
            saml.authorities.attribute.name is the attribute name (from the assertion) to be used for the user groups/authorities. The default value is eduPersonAffiliation

    6. Save and Close the editor
    7. Navigate to the root DigitalHive install and run .\tomcat.sh -start

Digital Hive on Linux is now configured to use SAML for authentication. 


    • Related Articles

    • Using OAuth as the Authentication Source for Digital Hive

      Question Can Digital Hive leverage OAuth as the authentication source so that existing users and groups can be used? Answer OAuth sources like Azure and Google can both be leveraged for Digital Hive authentication. When using external third-party ...

    • Using Active Directory as the Authentication Source for Digital Hive

      Question Can Digital Hive leverage Active Directory as the authentication source so that existing AD users and groups can be used? Answer Digital Hive can be configured to use Active Directory authentication as long as the Digital Hive server is ...

    • Digital Hive Architecture Overview

      Overview Digital Hive is a lightweight, web-based application that is both easy to install as well as to maintain and manage. Other than the Microsoft C++ redistributable (https://www.microsoft.com/en-ca/download/details.aspx?id=40784), there are no ...

    • Digital Hive Auditing Explained

      Question The Digital Hive Control Center doesn't seem to provide any reports or views around usage of the platform. Is there a way to create reports to show metrics like the amount of reports executed by platform, the number of searches being made, ...

    • Digital Hive Frequently Asked Questions (FAQ)

      Installation Can Digital Hive be installed on premise or in the Cloud? Digital Hive can be installed using either on-premise hardware, in a Private Cloud, or a hybrid architecture that leverages both Cloud and on-premise. There is currently no ...