Specifying preauthentication and postauthentication activities for a SAML SSO authentication service
To customize the login process, you can write activities that are triggered before and after SAML SSO authentication. For example, a postauthentication activity can update the operator record with values from the service provider or refuse an automatically provisioned user access to an application.
Create your preauthentication and postauthentication activities. For more information, see the sample activities pySSOPreAuthenticationActivity and pySSOPostAuthenticationActivity. When you write these activities, consider the following:
- Update the pega Browser requestor type's default access group to equal an access group that includes the ruleset of the preauthentication activity. The preauthentication activity must be accessible to the pega Browser requestor type, which is used for the unauthenticated user session. By default, this requestor type is assigned to the PRPC:Unauthenticated access group.
- Create the postauthentication activity in a ruleset that is accessible to the user's default access group. The postauthentication activity must be accessible to the user who has just been authenticated.
- Set the Applies To key part of the activities to Code-Security.
- Set the authentication result in pyAuthenticationPolicyResult to
trueto proceed with authentication, or set to
falseto terminate the request; for example:
- You can dynamically update the user’s role list by using a postauthentication activity. This is useful if you want to dynamically add roles to the user context at login without maintaining multiple access groups in the database for all combinations of roles. In the postauthentication activity, update the list of roles by calling setRoles, as shown in the following example. For more information on setRoles, see the Engine API documentation for PRAuthorization.
tools.getAuthorizationHandle().setRoles(tools, tools.getAuthorizationHandle().UPDATE_APPEND, rolesList);Roles that you set in the postauthentication activity without saving the access group to the database lose their effect if the user switches applications. To dynamically add roles in a way that supports switching applications, see How to dynamically add roles during user authentication.
Open the service from the navigation panel in Dev Studio by clickingand choosing a service from the instance list.
On the SAML 2.0 tab, expand the Advanced configuration settings section.
In the Pre-authentication activity field, enter the name of the preauthentication activity.
In the Post-authentication activity field, enter the name of the postauthentication activity.
- Authentication services
To override or extend the default authentication process, create and configure an authentication service.
- More about authentication services
This page describes additional topics relevant to authentication services that are not directly referenced on the rule form.
- Configuring a SAML SSO authentication service
After you create a SAML SSO authentication service, configure it so that Pega Platform uses the specified identity provider for authenticating users. You can map attributes from the identity repository to properties in Pega Platform, and also configure optional features such as preauthentication and postauthentication activities and operator provisioning.
A keystore is a file that contains keys and certificates that you use for encryption, authentication, and serving content over HTTPS. In Pega Platform, you create a keystore data instance that points to a keystore file.