Setting up SnowMirror Integration with Authentik SAML IDP
Tags: snowmirror, saml, servicenow, authentik
Published: 2023-08-22 15:20:15

Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between parties, in particular, between an identity provider (IDP) and a service provider (SP). In this article, we will walk through how to set up a SnowMirror SP integration with Authentik SAML IDP.

##Overview

The SAML flow allows you to authenticate a user's identity and obtain a SAML response that can be used to interact with Authentik SAML IDP on their behalf. Here are the steps involved in setting up a SnowMirror integration with Authentik SAML IDP:
1. Create SAML Property Mappings
2. Set up a SAML Provider in Authentik
3. Create an application in Authentik
4. Create Groups and assign users in Authentik
5. Configure the SnowMirror Security Real

We'll go through each of these steps in detail below.

###Step 1: Create SAML Property Mappings
Login to your Authentik admin interface and 
1. Browse to the Customisation > Property Mappings section from the left sidebar
2. Click the Create button. 
3. Select SAML Property Mapping and then click Next.
![SAML Property Mapping](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/27zo3mrwrkufrbjub131.png)

Then use the following values to create the property and click Finish.

| Parameter | Value |
--------------------|--------------------------------------------------------|
| Name | SnowMirror SAML Mapping: Groups |                                          
| SAML Attribute Name | groups |
| Expression | for group in request.user.ak_groups.all(): yield group.name |


![New Property Mapping](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i2vvgtxcmh3mptmsf7vk.png)

###Step 2: Set up a SAML Provider in Authentik
The first step is to create a Authentik Provider. To do this, follow these steps:

1. Browse to the Applications > Providers section from the left sidebar
2. Click the Create button.
<br> 
![Create provider](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9dof5dub4mm7f38352km.png)
<br>
3. Select "SAML Provider" and Click on "Next"
<br> 
![New Application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fsuilheypiurxxlvuzve.png)


<br>
Then use the following values to create the provider and click Finish.

| Parameter | Value |
--------------------|--------------------------------------------------------|
| Name               | SnowMirror |                                          
| Authorization flow | default-provider-authorization-implicit-consent        |
| ACS URL | https://snowmirror.company/saml/SSO  |
| Issuer | SnowMirror |
| Service Provider Binding | Post |
| Property Mapping | SnowMirror SAML Mapping: Groups,<br> authentik Default SAML Mapping: User ID |
![SAML Provider](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lzgayox79l5944c39rs2.png)
![SAML Provider Part 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jmd8kf0ju1aq7qstt3o.png)
 
| :warning: WARNING          |
|:---------------------------|
| The ACS URL is an example URLs only and will not work in your setup.  You need to replace snowmirror.company with the FQDN of your SnowMirror server    |

###Step 3: Create an application in Authentik
1. Click the Create button under the "Assigned to application" heading that's now showing for the SnowMirror provider in Authentik.
<br>

![New application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5o4rfh8ns34r33tckg6g.png)

2. Populate the form with the information pictured below and then click the Create button:

| Parameter | Value |
--------------------|--------------------------------------------------------|
| Name | SnowMirror |                                          
| slug | snowmirror |
| Provider | SnowMirror |

![Create application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1loghflv2qz90m9woymf.png)

###4. Create Groups and assign users in Authentik
1. Browse to the Directory > Groups section from the left sidebar
2. Click the Create button. 
3. Enter SUPER_ADMINISTRATOR and click Create
![Create Group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v5j50boxyrohhmjhqssf.png)
4. Setup additional SnowMirror Groups if required
![Create Groups](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m8hb7fegqkw87a7cx55f.png)
5. Select the Group for which you would like to add users to and select Users from the top tab bar.
6. Click on Add Existing User
![Add User](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i6quqb2oukrlbdborqz4.png)
7. Select the user and click Add

###Step 5: Configure the SnowMirror Security Real
Login to your SnowMirror admin interface and 
1. Browse to the Settings > User Management section from the top menu
2. Click the Configure Security Realm button
Then use the following values to create the Security Realm and click Save.

| Parameter | Value |
--------------------|--------------------------------------------------------|
| Security Realm | SSO |                                          
| Entity Id | SnowMirror |
| IdP Metadata  | copy the Metadata from the Authentik provider created in **Step 2** |
| Internal Realm  | Enabled |
![SnowMirror Security Realm](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i3v9f5a1kagjzn1dhn00.png)

Click logout and login to your SnowMirror using your SnowMirror FQDN.