How to Provision User in Calem by SAML SSO

In the coming release of release R20d in August 2020, a feature is available to provision users in Calem based on SAML SSO. The feature allows an organization to centralize user management in its ID Provider. Calem provisions an authenticated user in Calem, or update the user settings accordingly.

1. A user accesses Calem
2. The user is redirected to its ID provider for authentication via SAML
3. Upon authentication the user record is created Calem if not found. Otherwise, it's updated.

The following SAML attributes from an authenticated user may be used to provision a user record in Calem.

• Note that "Team ID" is deprecated. The team will be defined based on the Group Id in Calem from release R2022a (March 2022).

Plugins must be configured to enable user provisioning. A plugin includes business logic meeting the specific requirements of the integration for an organization.

• They are developed and released by Calem based on customer requirements.
• No plugin is configured out of the box.
• A plugin needs to be configured to enable the integration. 
• For instance, "itiga" is the plugin Id to be enabled.

• The plugin is deployed to directory Calem_Home/server/modules/plugin/itiga/
• The following configuration needs to be added to calem.custom.php to enable it.

$_CALEM_dist['saml_conf']['user_provision_plugin']='itiga'; 

 The user provisioning includes the following data integration points.

The following is the sample configuration for the data integration defined in calem.custom.php. 

$_CALEM_dist['saml_conf']['user_provision_map']=array(
  //Direct mapping to saml attr
  'direct'=>array(
	 'username'=>'https://schemas.xmlsoap.org/ws/2005/05/identity/claims/objectidentifier',
	 'email'=>'https://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'
  ),
  //Saml attr is a lookup value
  'lookup'=>array(
  ),
  //Default values to set
  'defaults'=>array(
	 'login_allowed'=>1,
	 'status_id'=>'us_active',
	 'site_id'=>'1000000'
  ),
  //custom logic, value is attr or null (indirect attributes)
  'custom'=>array(
	 'team_id'=>'TeamCompany',
	 'profle_id'=>'EAMGroupId',
	 'full_name'=>null
  )
); 

 Option 1. Group by a Custom Plugin

The group Id is mapped to a set of ACL profiles in Calem. The first option is to use a custom plugin to provision ACL profiles, maintenance flag, team and organization. It requires the development of a custom plugin. This option provides more flexibility per customer requirements. It is the only option for cases that cannot be handled by option 2.

The second option is to use the profile set plugin in Calem. This plugin uses the profile sets configured in Calem to provision users authenticated by IdP (Id Provider). 

• Menu: Organization | Open | Profile Sets.
• A profile set may be defined per team including the team, maintenance flag, job role, home site and ACL profiles for access control.
  • A profile set may include more than one ACL profile.
  • The attributes and ACL profiles of the profile set are used to provision or update the login user.
• A flag "No Provision" can be checked to turn off provisioning for users of this profile set.
• The name of the profile set needs to match the name of the group from the IdP (Id Provider).
• You may use the excel template file attached to prepare and upload profile sets.

Additional Resources

• How to Set up SAML SSO in Calem
• Login User Setup in Calem
• User Guide and Admin Guide (customer account required)
• Calem Enterprise Training Site
  
• Calem Enterprise Blogs
  
• Calem Enterprise demo