SAML SSO configuration

After installing and configuring the Apigee SSO, you can configure SAML IDP settings as described in this section.

SAML configuration properties

Copy the SAML IDP certificate OpenLDAP node

  1. Create a directory for the certificates (if not already present) on the OpenLDAP node: 
    sudo mkdir -p /opt/apigee/customer/application/certs/
  2. Copy your PEM-encoded certificate (.crt) to the new directory.
  3. Change the owner of the directory and files to the "apigee" user, and secure the permissions: 
    sudo chown -R apigee:apigee /opt/apigee/customer/application/certs/
sudo chmod 644 /opt/apigee/customer/application/certs/okta.crt

Append the following block to the file shown here on the server where apigee-openldap is installed, modifying the variables to match the details provided by your SAML IDP (for example, Okta or ADFS):

sudo vi /opt/apigee/customer/application/openldap.properties
 
 # SAML Settings
 lib_settings_enable_sso_saml=true
 lib_settings_saml_name=Okta
 lib_settings_saml_sso_url=https://idp.example.com/sso
 lib_settings_saml_entity_issuer=apigee-saml-login-opdk
 lib_settings_saml_redirect_uri=http://PUBLIC_IP:9099/callback
 lib_settings_saml_username_attr=name
 lib_settings_saml_email_attr=email
 lib_settings_saml_groups_attr=groups
 lib_settings_saml_ca_file=/opt/apigee/customer/application/certs/okta.crt

Run the following command to configure the apigee-openldap component with the SAML settings shown earlier:

 /opt/apigee/apigee-service/bin/apigee-service apigee-openldap setup-sso -f /opt/silent.conf