Authentication

Overview

Infoworks supports authentication using the following three mechanisms.

1. Default: This option is the Infoworks application based authentication where the user account details are stored in MongoDB and any user who tries to access the application is authenticated and authorized against that.
2. LDAP Authentication: LDAP is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information service. It authenticates against Active Directory. An Active Directory is a Directory services implementation that provides all sorts of functionality like authentication, group and user management, policy administration and more.
3. SAML Authentication: Security Assertion Markup Language (SAML) is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP). This enables SSO. SAML transactions use Extensible Markup Language (XML) for standardized communications between the identity provider and service providers

Configuring LDAP Authentication

Following are the steps to perform LDAP Authentication:

1. Log in to the Infoworks with admin credentials.
2. Click the Admin menu.
3. Click the Users icon. Click the Authentication tab. The Authentication Configuration page is displayed.
4. Select the authentication type as LDAP.
5. Set the LDAP configurations parameters as mentioned below.
6. Click Save Changes.

NOTES

• Infoworks UI and Platform services, Rest API service must be restarted after setting the Authentication Type to LDAP.
• You must login through the Infoworks at least once to use the REST API service. This holds true for default, LDAP and SAML authentication mechanism.

Securing Services with SSL

To enable SSL communication for services which include Ingestion services, Platform services, Governor, Configuration, DT, Monitoring, UI and Rest API, perform the following steps:

1. Navigate to Nginx configuration directory using the following command: cd ${IW_HOME}/resources/nginx-portable/conf/infoworks
2. Run the following command to open platform.conf.template file for editing: vi platform.conf.template

The structure of the template file will be as follows:

server {

​

# External Access#

​

# Exteral port on which this service will be listening

​

# Syntax for HTTP: listen <port-number>;

​

# Syntax for HTTPS: listen <port-number> ssl;

​

listen ${PROXY_SERVER_PORT};

​

################################################

​

# SSL Certificates

​

#

​

# For HTTPS, the path to the certificate and key file

​

# need to be specified in the following keys:

​

# ssl_certificate <path-to-certificate-file>

​

# ssl_certificate_key <path-to-certificate-key-file>

​

# ssl_certificate /etc/nginx/ssl/infoworks_ssl.crt;

​

# ssl_certificate_key /etc/nginx/ssl/infoworks_ssl.key;

3. Add the string ssl after the proxy_server_port as follows: listen $ {PROXY_SERVER_PORT} ssl;
4. Add the respective ssl certificate key path and certificate file path as described below:

Prerequiste Ensure that the SSL key is setup without passphrase.

Step 1: Uncomment # ssl_certificate /etc/nginx/ssl/infoworks_ssl.crt;.

Step 2: Update it to ssl_certificate <path-to-certificate>/infoworks_ssl.crt; , where path-to-certificate is your respective path to the generated certificate file.

Step 3: Uncomment # ssl_certificate_key /etc/nginx/ssl/infoworks_ssl.key;.

Step 4: Update it to ssl_certificate_key <path-to-certificate>/infoworks_ssl.key;,where path-to-certificate is your respective path to the generated certificate file.

Step 5: Update the conf.properties file by changing the key: proxy_server_scheme=https

Step 6: Add proxy_server_port=433 in the conf.properties file.

Step 7: Restart all Infoworks services using the following commands: cd ${IW_HOME}/bin

$IW_HOME/bin/stop.sh all mongo

$IW_HOME/bin/start.sh mongo all

NOTE The Infoworks Product Documentation server currently serves request over HTTP server only. Since HTTP server serves an insecure communication, Infoworks Product Documentation server can be configured to listen to a local host to hide it from the external traffic. All other Infoworks services serves request over HTTPS.

Configuring SAML Authentication

Prerequisites

Ensure to register Infoworks with the identity provider. For example, for integrating Infoworks with OKTA, follow the steps mentioned here.

Following are the steps to perform SAML Authentication:

1. Log in to the Infoworks with admin credentials.
2. Click the Admin menu.
3. Click the Users icon. Click the Authentication tab. The Authentication Configuration page is displayed.
4. Select the authentication type as SAML.
5. Set the SAML configurations parameters as mentioned below.
6. Click Save Changes.

User Configuration Examples in OKTA

This setup shows four users, User Group A, User Group B, User Both, and User Neither. The screenshots below shows that User Both belongs to both Group A and Group B, and User Neither doesn’t belong to either.

Groups that Directly Match Roles

If the groups directly match roles that you wish to assign the user, you can use the GROUP ATTRIBUTE STATEMENTS area provided in Okta.

The below statement gives the attribute “Groups” which contains all the groups that the user belongs to and are assigned to this application in Okta.

Given below are the values received for “User Both”:

Based on the above configuration, User Group A, User Group B, and User Both are assigned with the following roles:

Note that none of the users are assigned to Admin role as the value of Group C does not match any of the groups that the users have. User Both gets DBAdmin and Analyst roles as he has groups matching the values input in those roles. User Neither is not assigned any role as he does not have any group values matching any of those that are specified in the roles. If you try to sign in with that user, you tend to get the following error:

Multi Group Combination in Okta With Combinations of Group Belongings

If you do not wish to directly match the group values to Role Inputs, you can manipulate the values or add new ones entirely or substitute them depending on your requirements. The following example shows how an AND condition is achieved, that is, a user is assigned with Admin role if they belong to two groups simultaneously.

The attribute custom is comma separated string of all the groups that the user belongs to as well as including “Both” or “Neither” based on whether a user belongs to both Group A and Group B or neither of them.

It is defined in the User Attribute in Okta with the following Expression (The Alphanumeric strings are All Group Ids to scan the user’s groups against):

Arrays.toCsvString(getFilteredGroups({"00g4qf335wjjqgxzh5d7", "00g4qf43leVm18RDH5d7", "00g7cbjxtIIEMiBRa5d6"}, "group.name", 50)) + (isMemberOfGroupName("Group A") && isMemberOfGroupName("Group B") ? ",Both" : "") + (!isMemberOfGroupName("Group A") && !isMemberOfGroupName("Group B") ? ",Neither" : "").

Given below is the screenshot of the expression:

Below you can see the value of the custom attribute for User Both:

The following is the SAML Configuration.

• For more details on creating custom attributes in OKTA, refer to Okta Expression Language.
• For more details on adding Okta groups to Okta application, refer to https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-assign-app-group.htm and https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-assign-multiple-app-group.htm.

NOTES

• Infoworks UI and Platform services, Rest API service must be restarted after setting the Authentication Type to SAML.
• You must login through the Infoworks at least once to use the REST API service. This holds true for default, LDAP and SAML authentication mechanism.

If the SAML authentication is enabled, any user accessing the Infoworks UI, shall be redirected to the Identity Provider's page, where the user will have to provide the credentials. After the user is authenticated by the IdP, she or he will be redirected to Infoworks page.

As long as the session is active in the IdP, the user will be able to Single Sign On (SSO) in Infoworks UI, without entering the credentials again.

Refer the following SAML Configuration for Azure AD to fetch Role Attribute and Domain Attribute. To get group names in Azure AD, refer to Configuring Group Claims.

Resetting to Default MongoDB Authentication.

If you’re unable to login via SAML or LDAP authentication, you can reset the authentication mechanism to default using a script provided with the package.

Step 1: Log in to Infoworks VM and switch to infoworks user.

Step 2: Execute the following commands.

source /opt/infoworks/bin/env.sh

python /opt/infoworks/scripts/reset_to_default_auth.py

Step 3: Restart UI and Platform Services via Start/Stop Scripts