Liferay and SAML(2.0) integration

Title: Liferay and SAML(2.0) integration with portal cluster environment behind a load           balancer

  Introduction

        What is an SAML(Security Assertion Markup Language)?

                It is a XML-based, open-standard data format for exchanging authentication and 
                authorization data between parties, in particular, between an identity provider and a service
                provider.    

   
   Overview

             This brief article outlines a high level solution for using the Liferay SAML 2.0 EE Provider 
              plugin as the SAML SP in a clustered node environment.

             The solution extends from using Liferay SAML 2.0 EE Provider plugin as the SAML SP in a 
             single node environment.

     Scenario

              You wish to use SAML as the SSO solution for your environment.

              You have a Liferay Portal cluster with multiple nodes behind a load balancer 
              (e.g. F5 BigIP).
              You have a third-party product participating as the SAML Identity Provider (IdP), such as
               F5 BigIP.

               The Liferay Portal nodes will participate as SAML Service Providers (SPs).

 High Level Solution

     Step 1.  Configure SAML IdP and LP node 1 as SAML SP as per other instructions

                        eg. Use Case #2: Liferay as both IdP and SP

                        https://www.liferay.com/group/customer/knowledge/kb/-/knowledge_base/article
                       /40556658#use-case2

NOTE: In our case, we have a third-party IdP and LP will be the SP

NOTE: Ensure LP node 1 is using the load balancer as the web.server.host in portal-

              ext.properties.

 
            # Set the hostname that will be used when the portlet generates URLs.

            # Leaving this blank will mean the host is derived from the servlet

            # container.

           web.server.host=

     Step 2.   Repeat SAML SP config for LP node 2 as per node 1

     Step 3.   Copy keystore from LP node 1 to LP node 2

                The “keystone” contains the valid or self-signed certificate managed by the SAML 2.0 EE
                Provider plugin.

                The “keystore” is created by the Liferay 2.0 SAML EE Provider plugin in folder
                LIFERAY_HOME/data/keystore.jks

                Copy file “LIFERAY_HOME/data/keystore.jks” from LP node 1 to LP node 2

     Step 4. Review
                At this stage, the LP nodes have the same SAML SP configuration and either can respond 
                to web  requests and handle the SAML SP <>IdP protocol.

     Step 5. Test

                Test SAML as SSO solution by signing into LP via load balancer, navigating sites and 
                pages then signing out.