Does OJS support SAML2 SSO authentication?

griffith · November 23, 2015, 6:20am

Hi!

We’re currently using LDAP authentication with OJS and I’ve been told that OJS ships with out of the box SAML support, but I can’t find any information on this. Is this is accurate? Does anyone have it setup? We use Ping Federate and are trying to decide whether to turn off our LDAP authentication (and rely on OJS local auth) or upgrade to SAML SSO as part of a move to remote hosting with PKP.

We’re on OJS 2.4.2.

Thanks,
Suzy

ctgraham · November 23, 2015, 1:29pm

Check out the Shibboleth plugin.

Configuration on the OJS side is largely done in config.inc.php:

github.com

pkp/ojs/blob/ojs-dev-2_4/config.TEMPLATE.inc.php#L266-L287



; Configure whether implicit authentication (request headers) is used.
; Valid values are: On, Off, Optional
; If On or Optional, request headers are consulted for account metadata so
; ensure that users cannot spoof headers. If Optional, users may use either
; implicit authentication or local accounts to access the system.
;implicit_auth = On

; Implicit Auth Header Variables
;implicit_auth_header_first_name = HTTP_GIVENNAME
;implicit_auth_header_last_name = HTTP_SN
;implicit_auth_header_email = HTTP_MAIL
;implicit_auth_header_phone = HTTP_TELEPHONENUMBER
;implicit_auth_header_initials = HTTP_METADATA_INITIALS
;implicit_auth_header_mailing_address = HTTP_METADATA_HOMEPOSTALADDRESS
;implicit_auth_header_uin = HTTP_UID

; A space delimited list of uins to make admin
;implicit_auth_admin_list = "jdoe@email.ca jshmo@email.ca"

This file has been truncated. show original

You will also need your webserver to be configured (e.g. Apache with mod_shib)

griffith · November 24, 2015, 12:30am

Thanks, I’ll send to our authentication team and get some advice. Do you know if this works with multiple domain names? We have a multi journal install with separate domains for each journal i.e. not sub domains.

ctgraham · November 24, 2015, 1:07pm

If using the Linux NativeSP, I know from personal experience that you can attach this via mod_shib to multiple Apache name-based VirtualHosts. Note that the implict auth config happens at the OJS site install level, so if you had divergent configuration parameters for individual journals (for example, JournalA uses WAYF #1, but JournalB uses WAYF #2), these would need to be housed in different OJS installs.