This is the development documentation. For the latest released documentation see 4.4.0.
Version: next
Configuring Single Sign On
By default, Stratos will authenticate against a UAA using username and password, for both logging into Stratos and when connecting Cloud Foundry endpoints.
UAA can support richer login mechanisms than username and password. To accommodate this, you can configure Stratos to use the UAA's Single Sign On UI for login.
This can be enabled by setting the config setting SSO_LOGIN to true.
Most importantly, you will need to ensure that the Client used when communicating with your UAA is configured to allow Stratos to use Single Sign On - i.e. that the Stratos SSO Login callback URI is registered with the UAA.
You'll need the uaac CLI to configure your Client to accept the Stratos SSO Callback URI - see here.
NOTE: The Stratos SSO Redirect URI that you'll need is:
https://HOST.DOMAIN/pp/v1/auth/sso_login_callback
where HOST and DOMAIN depend on your Stratos installation.
Target your UAA
uaac target <UAA URL>
Login to your UAA with the admin client:
uaac token client get admin -s <ADMIN_CLIENT_SECRET>
Next, check the configuration of your Client - for example, for the cf client:
uaac client get cf
You'll get the current configuration - there are two properties of interest redirect_uri and authorized_grant_types.
Note: The following commands will overwrite existing values for the settings specified. To keep the existing values along with the new value include them in the new value as a comma-separated list.
The redirect_uri value should contain the Stratos redirect URI. If not update the Client with:
When SSO has been configured Stratos's log in request will contain a URL that tells SSO where to return to. When using a browser this is automatically populated. To avoid situations where this can be hijacked or called separately an SSO state allow-list can be provided via the environment variable SSO_ALLOWLIST. This is a comma separated list. For example...
When set, any requests to log in with a different state will be denied.
In order for the SSO state to match an entry from the allow-list the schema, hostname, port and path must match exactly. A wildcard * can be provided for the path to match anything.
Further configuration of SSO is provided through the SSO_OPTIONS environment variable.
Setting this variable to nosplash will skip the need for users to press the Login button - users will jump straight to the configured SSO endpoint when accessing Stratos instead of first seeing the Stratos login page.
In production environments, it's wise to setup a dedicated UAA client for
Stratos SSO, instead of re-using the cf client, that already represents by
the cf CLI.
In this case, you can duplicate the cf client definition and create a
stratos-console client, for example. In typical UAA deployment manifest with
BOSH, you would typically add the following configuration properties to the
uaa job, in the uaa instance group.
Listing the Stratos console as a registered application in UAA users home page#
With the above UAA client set though, the Stratos Console would still not be
displayed as a registered SSO application in UAA users home page. (This home
page is typically hosted at https://login.{SYSTEM_DOMAIN}/home.)
In order to properly list the Stratos Console there, the show-on-homepage
property has to be set to true and the app-launch-url property has to be
perperly provided, with some non-null URL.
The example below shows the whole setup, with a simplified PNG image as the
app-icon though, to keep is concise.
If you need an app-icon that properly displays the Stratos logo though, here
is one you could use. This is the Stratos logo, reduced to 68x68 because
that's the size the UAA users home page will display it. This is still 4.91 KB
of PNG data though, as it is Base64-encoded.
User has selected the incorrect application authorities when logging in to Stratos via SSO for the first time.
The user can update their permissions and other account settings via https://login.< uaa address >/profile
Administrator wants to remove the application authorities selection users see when logging in to Stratos via SSO for the first time
This is carried out at the Admins discretion
Using the uaac cli update the 'autoapprove' property of the client used by Stratos to either true for all authorities or a comma separated list for the authorities to be removed.