Exploring Apache Knox - part VI

This is the sixth in a series of blog posts exploring some of the security features of Apache Knox. The previous post looked at how to achieve single sign-on using the Knox SSO service, where the Knox SSO service was configured to authenticate the user to a third party Identity Provider using OpenId Connect. In this post we will show instead how to configure Knox SSO to redirect the user instead to a SAML SSO Identity Provider.

As a prerequisite to this tutorial, follow the first tutorial to set up Apache Knox as well as the backend Apache Hadoop cluster we are trying to obtain a file from.

1) Configure the Apache Knox SSO service

For the purposes of this tutorial we are going to use the www.testshib.org SAML SSO Identity Provider. First we'll configure the Knox SSO service. Copy "conf/topologies/knoxsso.xml" to "conf/topologies/knoxssopac4jsaml.xml". Now edit it and delete the "ShiroProvider" provider and add the following provider instead (which leverages the Pac4j project):

	<topology>
	<gateway>
	...
	<provider>
	<role>federation</role>
	<name>pac4j</name>
	<enabled>true</enabled>
	<param>
	<name>pac4j.callbackUrl</name>
	<value>https://localhost:8443/gateway/knoxssopac4jsaml/api/v1/websso</value>
	</param>
	<param>
	<name>clientName</name>
	<value>SAML2Client</value>
	</param>
	<param>
	<name>saml.serviceProviderMetadataPath</name>
	<value>./KnoxTestMetadata.xml</value>
	</param>
	<param>
	<name>saml.identityProviderMetadataPath</name>
	<value>https://www.testshib.org/metadata/testshib-providers.xml</value>
	</param>
	</provider>
	...
	</gateway>
	</topology>

view raw knoxssopac4jsaml.xml hosted with ❤ by GitHub

Note that one of the configuration parameters references the SAML SSO RP (Relying Party) Metadata file, which we will need to configure the IdP. Luckily Apache Knox will generate this for us on the first call. Open a browser and navigate to the following URL:

• https://localhost:8443/gateway/knoxssopac4jsaml/api/v1/websso

You should see an error page on the TestShib site, as it has not yet been configured with our Metadata file. However, Knox has now generated this file at the location we specified via "saml.serviceProviderMetadataPath". Go to "https://www.testshib.org/register.html" and upload the generated metadata file:

2) Secure a topology using the "SSOCookieProvider" provider

In section 2 of this earlier tutorial, we showed how to secure a topology using the "SSOCookieProvider" provider. Copy "conf/topologies/sandbox-sso.xml" to "conf/topologies/sandbox-ssopac4jsaml.xml" and change the value of the "sso.authentication.provider.url" parameter to:

• https://localhost:8443/gateway/knoxssopac4jsaml/api/v1/websso

Now start Apache Knox and navigate to the following URL:

• https://localhost:8443/gateway/sandbox-ssopac4jsaml/webhdfs/v1/data/LICENSE.txt?op=OPEN

You will be redirected to the Knox SSO service and then on to the TestShib IdP and authenticate with "myself" / "myself".The browser will then be redirected back to the "sandbox-ssopac4jsaml" topology and "LICENSE.txt" should be successfully downloaded.