Client setup for Single Sign-On (Generic) endpoint in their IdP using the SAML 2.0 protocol for a Frontline application. Steps and roles to establish for the Asset Management application.

1.  Navigation:
2. Admin View
3. District Settings
4. API and SSO Information

Configuration Checklist

Frontline Configuration

The following items have been setup/created by Frontline in order to kick off the SSO setup:

District Configuration

Overview to Setup SAML 2.0 SSO

Customers who are asked to setup a Single Sign-On endpoint in their IdP using the SAML 2.0 protocol for a Frontline application are sent an application Identifier (Entity ID), the Reply URL (Assertion Consumer Service), the Metadata XML, the roles to be created in their IdP and the list of attributes, and claims needed by the Frontline Asset Management application.

After setting up the SSO endpoint, customers are asked to the IdP SAML Login URL, the IdP SAML Metadata URL or XML, the SAML Certificate and the certificate thumbprint to Frontline support services. This process is repeated for each Frontline application.

Once the above process is complete, customers will create, setup and send Frontline the test/support account (username/domain and password) in their IdP.

Setup Roles or Groups

Asset Management products must have the following roles (group names) setup in the IdP, and those group names must be sent over as plain text in the "role" attribute/claim the SAML response to the Asset Management application.

Create an Account for Frontline Asset Management

Create an SSO account for Frontline support users in your IdP. Create the following user in your IdP for Frontline Support Staff with a password that does not expire.

• Username: tipweb_it
• Password: <password that does not expire>
• Add to group: TIPWEBIT_ADMINVIEW_ADMIN
• Add an email address such as tipweb_it@DistrictDomainName

Set Up Endpoints

When you have setup the SSO endpoint for Asset Management in your IdP, fill out the required fields in Configuration Document, and send it to ihdmsupport@frontlineed.com.

Sample SAML Request and Response

Request

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="_591df756-862f-40ff-8b87-2624fbf38c86">
Version="2.0"
IssueInstant="2021-09-10T15:37:21Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
AssertionConsumerServiceURL="https://HayesURL/TIPIDCore/SSO/SAMLConsumer.aspx"
Destination="https://__your_SSO_Login_URL__"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://HayesURL/TIPIDCore/</saml:Issuer>
</samlp:AuthnRequest>

Response

The SSO IdP must send back a SAML response to Asset Management that is similar to the following:

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_93883a0f-fa68-42d7-8444-c61473ea706c" Version="2.0" IssueInstant="2021-09-08T17:49:02.278Z" Destination="https://HayesURL/TIPIDCore/SSO/SAMLConsumer.aspx" InResponseTo="_f9948222-3e11-4592-a0f6-7f15c2812131"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/90e0c2f4-c0eb-4f28-b0f5-8d2c578af4c8/</Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_6cf241dc-38c0-4881-9b8b-cd751eda6701" IssueInstant="2021-09-08T17:49:02.278Z" Version="2.0"><Issuer>https://sts.windows.net/90e0c2f4-c0eb-4f28-b0f5-8d2c578af4c8/</Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><Reference URI="#_6cf241dc-38c0-4881-9b8b-cd751eda6701"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><DigestValue>...</DigestValue></Reference></SignedInfo><SignatureValue>...</SignatureValue><KeyInfo><X509Data><X509Certificate>...</X509Certificate></X509Data></KeyInfo></Signature><Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">tipweb_it@DistrictDomainName</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="_f9948222-3e11-4592-a0f6-7f15c2812131" NotOnOrAfter="2021-09-08T18:49:01.997Z" Recipient="https://HayesURL/TIPIDCore/SSO/SAMLConsumer.aspx"/></SubjectConfirmation></Subject><Conditions NotBefore="2021-09-08T17:44:01.997Z" NotOnOrAfter="2021-09-08T18:49:01.997Z"><AudienceRestriction><Audience>https://HayesURL/TIPIDCore/</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="http://schemas.microsoft.com/identity/claims/displayname"><AttributeValue>Hayes Support</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"><AttributeValue>Hayes</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"><AttributeValue>Support</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"><AttributeValue>tipweb_it@DistrictDomainName</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"><AttributeValue>tipweb_it@DistrictDomainName</AttributeValue></Attribute><Attribute Name="role"><AttributeValue>TIPWEBIT_ADMINVIEW_ADMIN</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="2021-09-08T17:39:00.607Z" SessionIndex="_6cf241dc-38c0-4881-9b8b-cd751eda6701"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>

Setting Up Google SAML

To integrate Google SAML SSO with Frontline Asset Management, you must have a valid Google for Education or Google Workspace license.  If you don’t have a Google Workspace/Admin account, you can read about it at Google Workspace Services.

These are the steps that you will need to follow in order to allow Frontline to configure Asset Management to SSO into your Google instance.

1. Create Google Custom User Attributes (roles) for Asset Management and Mobile SSO
2. Create a Google account for Frontline support users
3. Add an Identifier Entity ID and ACES URL for each product Asset Management and Mobile
4. Map the SAML attributes including custom user attributes
5. Populate all the users’ custom attributes (the roles)
6. Send the account and credentials, the security certificates and login details to the Frontline team
7. Repeat steps 1-6 these for Mobile

Steps

Login to your Google Admin console. You must be an administrator of your Google Workspace. Click Users, then select More -> Manage Custom Attributes.

Click Add Custom Attributes

Add a new custom attribute for Asset Management groups. It must be of the "Text" type, visible to the organization and a Single Value.

Click Save

Click Apps

Click Web and mobile apps

Click and select Add App -> Add custom SAML app

Give your new app a name (required) and an icon (optional but recommended).

Download and copy the metadata, SSO URL, entity ID, certificate and fingerprint and record them in Configuration Document. Repeat the process for Mobile. Send both documents to Frontline support.

Type in or copy the ACS URL and the Entity ID from this document. The Entity ID is the "Application Identifier". The ACS URL is the Endpoint Reply URL or Assertion Consumer Service URL. The response must not be signed. The Name ID format is the EMAIL and the Name ID is the Primary email (Basic Information -> Primary email).

Add the SAML attribute mapping. You must include the custom role attribute that carries the name of the users' roles.

FAQs