diff --git a/FoxIDs.sln b/FoxIDs.sln index d66d83fe6..9c90dd435 100644 --- a/FoxIDs.sln +++ b/FoxIDs.sln @@ -53,8 +53,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "docs", "docs", "{CB5D86A0-D docs\email.md = docs\email.md docs\faq.md = docs\faq.md docs\foxids-inside.md = docs\foxids-inside.md - docs\howto-connect.md = docs\howto-connect.md docs\get-started.md = docs\get-started.md + docs\howto-connect.md = docs\howto-connect.md docs\howto-oidc-foxids.md = docs\howto-oidc-foxids.md docs\howto-saml-2.0-context-handler.md = docs\howto-saml-2.0-context-handler.md docs\howto-tracklink-foxids.md = docs\howto-tracklink-foxids.md @@ -159,7 +159,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{CB8812 docs\images\howto-saml-context-handler-down-ct2.png = docs\images\howto-saml-context-handler-down-ct2.png docs\images\howto-saml-context-handler-up-attributes.png = docs\images\howto-saml-context-handler-up-attributes.png docs\images\howto-saml-context-handler-up-nameidformat.png = docs\images\howto-saml-context-handler-up-nameidformat.png - docs\images\howto-saml-context-handler-up-privilege-claim-tf.png = docs\images\howto-saml-context-handler-up-privilege-claim-tf.png docs\images\howto-saml-context-handler-up-read-metadata.png = docs\images\howto-saml-context-handler-up-read-metadata.png docs\images\howto-saml-nemlogin3-certificate-container-type.png = docs\images\howto-saml-nemlogin3-certificate-container-type.png docs\images\howto-saml-nemlogin3-certificate.png = docs\images\howto-saml-nemlogin3-certificate.png @@ -171,10 +170,10 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{CB8812 docs\images\howto-saml-nemlogin3-up-claims.png = docs\images\howto-saml-nemlogin3-up-claims.png docs\images\howto-saml-nemlogin3-up-contact.png = docs\images\howto-saml-nemlogin3-up-contact.png docs\images\howto-saml-nemlogin3-up-nameidformat.png = docs\images\howto-saml-nemlogin3-up-nameidformat.png - docs\images\howto-saml-nemlogin3-up-privilege-claim-tf.png = docs\images\howto-saml-nemlogin3-up-privilege-claim-tf.png docs\images\howto-saml-nemlogin3-up-read-metadata.png = docs\images\howto-saml-nemlogin3-up-read-metadata.png docs\images\howto-saml-nemlogin3-up-top.png = docs\images\howto-saml-nemlogin3-up-top.png docs\images\howto-tracklink-foxids-down-party.png = docs\images\howto-tracklink-foxids-down-party.png + docs\images\howto-saml-privilege-claim-tf.png = docs\images\howto-saml-privilege-claim-tf.png docs\images\howto-tracklink-foxids-up-party.png = docs\images\howto-tracklink-foxids-up-party.png docs\images\master-tenant2.png = docs\images\master-tenant2.png docs\images\parties-down-party-oauth.svg = docs\images\parties-down-party-oauth.svg diff --git a/docs/claim-transform-dk-privilege.md b/docs/claim-transform-dk-privilege.md index 6beedd672..32ced2e97 100644 --- a/docs/claim-transform-dk-privilege.md +++ b/docs/claim-transform-dk-privilege.md @@ -1,6 +1,6 @@ # DK privilege - claim transforms -FoxIDs support claim transforms of DK privilege used in Danish IdPs like [NemLog-in](up-party-howto-saml-2.0-nemlogin.md) and [Context Handler](howto-saml-2.0-context-Handler.md). +FoxIDs support claim transforms of DK privilege used in Danish [NemLog-in](up-party-howto-saml-2.0-nemlogin.md) and [Context Handler](howto-saml-2.0-context-Handler.md) IdPs. Supported privilege standard: @@ -9,14 +9,23 @@ Supported privilege standard: - FoxIDs support both to read the base64-encoded privilege string from the standard claim `https://data.gov.dk/model/core/eid/privilegesIntermediate` and a custom defined claim. ## Configuring DK privilege - claim transforms -The DK privilege can both be configured in a SAML 2.0 up-party and down-party and furthermore in a OpenID Connect up-party and down-party. +The DK privilege can both be configured in a SAML 2.0 up-party and down-party and likewise in a OpenID Connect up-party and down-party. -DK privilege claim transforms in [FoxIDs Control Client](control.md#foxids-control-client): +- In SAML 2.0 the DK privilege claim transformer default read the standard claim `https://data.gov.dk/model/core/eid/privilegesIntermediate` and issue the transformed claim `http://schemas.foxids.com/identity/claims/privilege`. +- In OpenID Connect the DK privilege claim transformer default read the standard claim `privileges_intermediate` and issue the transformed claim `privilege`. -- SAML 2.0 up-party and down-party default read the standard claim `https://data.gov.dk/model/core/eid/privilegesIntermediate` and issues transformed claims in `http://schemas.foxids.com/identity/claims/privilege`. -- OpenID Connect up-party and down-party default read the claim `privileges_intermediate` and issues transformed claims in `privilege`. +Configure the DK privilege claim transformer on SAML 2.0 up-party in [FoxIDs Control Client](control.md#foxids-control-client): -> Remember to add a [claim mapping](saml-2.0.md#claim-mappings) from SAML `http://schemas.foxids.com/identity/claims/privilege` to JWT `privilege` in the settings section. If you use a [SAML 2.0 up-party](up-party-saml-2.0.md) and a [OpenID Connect down-party](down-party-oidc.md). +1. Select the Claim transform tab +1. Click Add claim transform and click DK XML privilege to JSON. +1. Then again, click Add claim transform and click Match claim. +2. Select to remove the original privilege claim `https://data.gov.dk/model/core/eid/privilegesIntermediate` from the claims pipeline. +3. Click update + +![Context Handler SAML 2.0 up-party privilege claim transformation](images/howto-saml-privilege-claim-tf.png) + + +> Remember to add a [claim mapping](saml-2.0.md#claim-mappings) from SAML `http://schemas.foxids.com/identity/claims/privilege` to JWT `privilege` in the settings section. If you e.g. use a [SAML 2.0 up-party](up-party-saml-2.0.md) and a [OpenID Connect down-party](down-party-oidc.md). ## Model 2 The DK privilege claim is transformed into a list of claims, one claim for each group. The XML PrivilegeGroup element is transformed into a JSON object and serialized as a string. diff --git a/docs/howto-saml-2.0-context-handler.md b/docs/howto-saml-2.0-context-handler.md index 3b8cd3697..b41314ca6 100644 --- a/docs/howto-saml-2.0-context-handler.md +++ b/docs/howto-saml-2.0-context-handler.md @@ -110,7 +110,9 @@ Furthermore, it makes the tokens readable. 2. Remove the original privilege claim from the claims pipeline. 3. Click update -![Context Handler SAML 2.0 up-party privilege claim transformation](images/howto-saml-context-handler-up-privilege-claim-tf.png) +![Context Handler SAML 2.0 up-party privilege claim transformation](images/howto-saml-privilege-claim-tf.png) + +> Remember to add a claim mapping from SAML `http://schemas.foxids.com/identity/claims/privilege` to JWT `privilege` please see next section 4). **4 - Add SAML 2.0 claim to JWT claim mappings in [FoxIDs Control Client](control.md#foxids-control-client)** diff --git a/docs/images/howto-saml-context-handler-up-privilege-claim-tf.png b/docs/images/howto-saml-context-handler-up-privilege-claim-tf.png deleted file mode 100644 index 48e28ab31..000000000 Binary files a/docs/images/howto-saml-context-handler-up-privilege-claim-tf.png and /dev/null differ diff --git a/docs/images/howto-saml-nemlogin3-up-privilege-claim-tf.png b/docs/images/howto-saml-nemlogin3-up-privilege-claim-tf.png deleted file mode 100644 index 5d686b30d..000000000 Binary files a/docs/images/howto-saml-nemlogin3-up-privilege-claim-tf.png and /dev/null differ diff --git a/docs/images/howto-saml-privilege-claim-tf.png b/docs/images/howto-saml-privilege-claim-tf.png new file mode 100644 index 000000000..dcb959f77 Binary files /dev/null and b/docs/images/howto-saml-privilege-claim-tf.png differ diff --git a/docs/up-party-howto-saml-2.0-nemlogin.md b/docs/up-party-howto-saml-2.0-nemlogin.md index 49e68ca78..600c52349 100644 --- a/docs/up-party-howto-saml-2.0-nemlogin.md +++ b/docs/up-party-howto-saml-2.0-nemlogin.md @@ -131,10 +131,10 @@ First you need to create an NemLog-in IT-system or have someone else creating an FoxIDs can transforms the [DK privilege XML claim](claim-transform-dk-privilege.md) to a JSON claim. It is recommended to add the transformation in order to obtain smaller claims and tokens. Furthermore, it makes the tokens readable. -1. Set the privilege claim depending of the Context Handler version. +1. Add the DK privilege claim transformer. 2. Remove the original privilege claim from the claims pipeline. -![NemLog-in SAML 2.0 up-party privilege claim transformation](images/howto-saml-nemlogin3-up-privilege-claim-tf.png) +![NemLog-in SAML 2.0 up-party privilege claim transformation](images/howto-saml-privilege-claim-tf.png) **4 - Add SAML 2.0 claim to JWT claim mappings in [FoxIDs Control Client](control.md#foxids-control-client)** diff --git a/src/FoxIDs/Views/Login/Password.cshtml b/src/FoxIDs/Views/Login/Password.cshtml index 1fd6af17d..a11af40f5 100644 --- a/src/FoxIDs/Views/Login/Password.cshtml +++ b/src/FoxIDs/Views/Login/Password.cshtml @@ -16,7 +16,7 @@
-
+