<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There's a plugin here:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://github.com/lyrasis/aspace-oauth">https://github.com/lyrasis/aspace-oauth</a><br>
</div>
<div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="color:rgb(0,0,0); background-color:rgb(255,255,255)">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; margin:0px">
<font face="Calibri,Arial,Helvetica,sans-serif" size="3" color="black"><span dir="ltr" style="font-size:12pt; background-color:white"><font size="2"><span style="font-size:11pt"><br>
</span></font></span></font></div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> archivesspace_users_group-bounces@lyralists.lyrasis.org <archivesspace_users_group-bounces@lyralists.lyrasis.org> on behalf of Peter Heiner
<ph448@cam.ac.uk><br>
<b>Sent:</b> Monday, March 14, 2022 11:40 AM<br>
<b>To:</b> Archivesspace Users Group <archivesspace_users_group@lyralists.lyrasis.org><br>
<b>Subject:</b> Re: [Archivesspace_Users_Group] Help: Does ASpace support Okta/SSO/SAML?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Cambridge University Libraries use the aspace-oauth plugin with the SAML<br>
provider.<br>
<br>
We chose SAML over LDAP because our directory doesn't allow anonymous binds<br>
and ArchivesSpace requires a separate bind DN which I was not too keen on<br>
having. SAML was not particularly easy to set up, we've seen some quirks like<br>
it not being able to use our IdP's metadata autoconfiguration and us having to<br>
add config items that would be available from said metadata, but it can be<br>
made to work with some trial and error. <br>
<br>
The separate login link in the header that aspace-oauth creates felt pretty<br>
clunky, so we have also modified the main app page in our local plugin to take<br>
the user directly to the SSO login page unless a specific URL parameter is<br>
set.<br>
<br>
Sadly, only the database is supported for authorisation, none of those<br>
fancy-schmancy SAML attributes or Oauth2 claim shenanigans from the early 21st<br>
century.<br>
<br>
p<br>
<br>
Jerry Boggio wrote on 2022-03-14 14:45:01:<br>
> Resubmitting as it appears my original question was kicked back.<br>
> <br>
> Gerard (Jerry) Boggio | MITRE Corporation | R124 - Collaboration & Info Management | 781-271-2719<br>
> <br>
> From: Jerry Boggio <gboggio@mitre.org><br>
> Sent: Monday, March 14, 2022 10:28 AM<br>
> To: archivesspace_users_group-request@lyralists.lyrasis.org<br>
> Subject: Help: Does ASpace support Okta/SSO/SAML?<br>
> <br>
> Hi Everyone;<br>
> <br>
> Could someone please tell us if ArchivesSpace supports Okta, SSO (Single Sign On), and/or SAML (Security Assertion Markup Language)? Are there other security packages supported other than storing logon ID and password in the MySQL database? If so, could you
please pass on documentation?<br>
> <br>
> Thank you!<br>
> Gerard (Jerry) Boggio | MITRE Corporation | R124 - Collaboration & Info Management | 781-271-2719<br>
> <br>
<br>
> _______________________________________________<br>
> Archivesspace_Users_Group mailing list<br>
> Archivesspace_Users_Group@lyralists.lyrasis.org<br>
> <a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group">
http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><br>
_______________________________________________<br>
Archivesspace_Users_Group mailing list<br>
Archivesspace_Users_Group@lyralists.lyrasis.org<br>
<a href="http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group">http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</a><br>
</div>
</span></font></div>
</body>
</html>