SafeNet IDPrime Virtual Setup

As a prerequisite, you must have a SafeNet IDPrime Virtual server that is up and running on your machine with the required services.

Configuring PingFederate as your identity provider in SafeNet IDPrime Virtual requires:

Configuring the Identity Provider Configuration File
Running the IDPV Server and Setting Up the IDPV Tenant

Configuring the Identity Provider Configuration File

Perform the following steps to configure the idp-configuration.json configuration file:

Access https://<ping_server>/ext/redirect/ATMInstance1/JWKS, copy the values of the following keys and paste them in the text editor:
- kid
- n
- e
Open the idp-configuration.json file that is placed at the /var/thales/config path and enter the values of the parameters given in the below table:

Parameter	Value
SigningKeys	`IdpPublicKeyModulus`: Enter the value of n key copied from step 1. `IdpPublicKeyExponent`: Enter the value of e key copied from step 1. `IdpKeyId`: Enter the value of kid key copied from step 1.
IdpClientId	Enter the Client ID that is available on the PingFederate server, refer to Configuring OAuth Client
IdpIssuerUrl	Enter the value of the Issuer url parameter that you copied from the WELL KNOWN CONFIGURATION URL
IdpRedirectUrl	Enter the VALID REDIRECT URL that is configured in client configuration on IDPV server. For executing IDPV client only: URL structure: `https://<server-host>/redirect` For example: `https://www.idpvserver.com/redirect` For executing Self-Service Portal and IDPV client: URL structure: `https://<server-host>/redirect` For example: `https://www.idpvserver.com/redirect` Note: This URL is updated per IDPV server host name.
IdentityProvider	Enter the Pingid IDP type.
RefreshTokenExpirationDuration	By default, the value is 480.
JwtExpiration	Enter a timeframe (in seconds) to be used by the IDPV client. The IDPV client obtains the access token value during this timeframe preceding the expiration of the access token.
JwtGroupClaim	Enter Groups.
JwtUserClaim	Enter preferred_username.
IDPrimeVirtualAdmin	Enter a list of administrator group names (for example, `IDPrimeVirtualAdmin`).
IDPrimeVirtualUser	Enter a list of user group names (for example, `IDPrimeVirtualUser`). User must be a part of any of the groups mentioned in the `IDPrimeVirtualUser` or `IDPrimeVirtualAdmin` parameter.
OfflineTokenEnabledGroup	Enter a list of group claim name for offline.
IDPrimeVirtualProvisioningAdmin	Enter a list of provisioning admin group.
JwtAdminWhiteList	Contains list of IDPrime Virtual Admin users.
IdpScope	The mandatory scope added in application on PingFederate. IdpScope parameter will read the `IdpScope` field of tenant configuration. When the server is upgraded, old tenant will be populated with value as `idpvscope openid offline_access` for PingFederate IDP, if this field is not explicity provided. For new tenant, this field must be configured similar to PingFederate client side in the `idp-configuration.json` file.

The JwtAdminWhiteList, IDPrimeVirtualProvisioningAdmin, OfflineTokenEnableGroup and IDPrimeVirtualProvisioningAdmin are optional parameters and must be provided if the Provisioning and Offline mode functions are enabled.

Sample 1: idp-configuration.json file for 2.5 release



{
"SigningKeys": [
{
"IdpPublicKeyModulus":"jrvwsXcd-Y62eYSXC0RPtWOlLE5Byiysid9VjwWYMxsOFSLbihU7-QADnC2jRj0b0Ak_P1g4KGAMrtTNZMwMhyVrpOqPd7bE_yPy-XXcprRD7NQIuRJ9kiAaFYOV8G3PeXHCVu2SVUQJujXQECCyq2fY_6tXKDyeLC44zBRrHdlaVxlj_DuKpC3DDBfwaQi3XqOv-nkMCzswb7jDU6n5F03Mi8JSaCMcm4smKH7ovgdIRRW28mxOoVLta-BtqDuv4hdk3UZM46XOO0pyGV1PFPTvLFTVNDvnx-isnYqFzQDVY6fUk0EQ4h4AozEt23QDMo_N2sq1MRuSexcwn_o5Q",
"IdpPublicKeyExponent":"AQAB",
"IdpKeyID":"Key2"
}
],
"IdpClientId":"activedirclient",
"IdpIssuerUrl":"https://10.164.42.219:9031/",
"IdpRedirectUrl":"https://www.idpvserver.com/redirect",
"JwtExpiration":"3600",
"IdentityProvider":"Pingid",
"RefreshTokenExpirationDuration": "480",
"JwtGroupClaim":"groups",
"JwtUserClaim":"preferred_username",
"JwtAdminWhiteList":"",
"IDPrimeVirtualAdmin":"IDPrimeVirtualAdmin",
"IDPrimeVirtualUser":"IDPrimeVirtualUser",
"OfflineTokenEnabledGroup":"IDPrimeVirtualOffline",
"IDPrimeVirtualProvisioningAdmin":"",
"IdpScope": "idpvscope openid  offline_access"

}

Sample 2: idp-configuration.json file for 2.4.1 release



{
"IdpPublicKeyModulus":"jrvwsXcd-Y62eYSXC0RPtWOlLE5Byiysid9VjwWYMxsOFSLbihU7-QADnC2jRj0b0Ak_P1g4KGAMrtTNZMwMhyVrpOqPd7bE_yPy-XXcprRD7NQIuRJ9kiAaFYOV8G3PeXHCVu2SVUQJujXQECCyq2fY_6tXKDyeLC44zBRrHdlaVxlj_DuKpC3DDBfwaQi3XqOv-nkMCzswb7jDU6n5F03Mi8JSaCMcm4smKH7ovgdIRRW28mxOoVLta-BtqDuv4hdk3UZM46XOO0pyGV1PFPTvLFTVNDvnx-isnYqFzQDVY6fUk0EQ4h4AozEt23QDMo_N2sq1MRuSexcwn_o5Q",
"IdpPublicKeyExponent":"AQAB",
"IdpKeyID":"Key2",
"IdpClientId":"activedirclient",
"IdpIssuerUrl":"https://10.164.42.219:9031/",
"IdpRedirectUrl":"https://www.idpvserver.com/redirect",
"JwtExpiration":"3600",
"IdentityProvider":"Pingid",
"RefreshTokenExpirationDuration": "480",
"JwtGroupClaim":"groups",
"JwtUserClaim":"preferred_username",
"JwtAdminWhiteList":"",
"IDPrimeVirtualAdmin":"IDPrimeVirtualAdmin",
"IDPrimeVirtualUser":"IDPrimeVirtualUser",
"OfflineTokenEnabledGroup":"IDPrimeVirtualOffline",
"IDPrimeVirtualProvisioningAdmin":"",
"IdpScope": "idpvscope openid  offline_access"

}

You can modify the policy-configuration.jsonfile as per your preferred configuration.

Sample of policy-configuration.json file:



[root@idpv2server config]# cat policy-configuration.json
{
"UserPinPolicy": {
"MaxRetries": 5,
"IsMustChange": false
},
"AdminPinPolicy": {
"MaxRetries": 5,
"IsMustChange": false
},
"OfflineTokenPolicy": {
"ValidityDurationInHours": 120,
"PrivateKeyExportLevel": "All"
}
}

Sample of sws-config.json file:



{
  "_comment1": "(Mandatory for SWS API) The commercial name of the remote service. The maximum size of the string is 255 characters.",
  "Name": "Thales Signing Web Service",
  "_comment2": "(Mandatory for SWS API) The ISO 3166-1 [22] Alpha-2 code of the Country where the remote service provider is established (e.g. ES for Spain).",
  "Region": "US",
  "_comment3": "(Mandatory for SWS API) The URI of the image file containing the logo of the remote service which SHALL be published online. The image SHALL be in either JPEG or PNG format
   and not larger than 256x256 pixels.",
  "Logo": "https://example.com/SWSLogo.png",
  "_comment4": "(Mandatory for SWS API) The maximum size of the string is 255 characters.",
  "Description": "The Signing web service (SWS) APIs are based on Cloud Signature Consortium (CSC) standards and it supports web and mobile applications and comply with the most demanding electronic signature regulations in the world.' # (Mandatory for SWS API) The maximum size of the string is 255 characters."
}

Running the IDPV Server and Setting Up the IDPV Tenant

After configuring the SafeNet IDPrime Virtual Server files, you need to perform the following steps to run the IDPV server and set up the IDPV tenant:

Run the IDPV Server, refer to Running the IDPV Server.
Run the following command to create a SafeNet IDPrime Virtual (IDPV) tenant.
```
SetupTenant create -i <Config/idp-staclassic-redirect.json> -p <Config/policy-configuration.json> -k true (or false)  -a <IDP_client_secret> -k true (or false) -n <tenant_name> -u true (or false) -c <IDPV (or SWS)> -m false (or true) -s <Config/sws-config.json>
```
Where, - -i accepts a json file as an IDP configuration file (Mandatory).
- -p accepts a json file as a token policy configuration file (Mandatory).
- -a accepts IDP Client Secret (Mandatory).
- -c accepts the tenantCategory (Optional).
  Use SafeNet IDPrime Virtual (IDPV) or Signature Web Service (SWS) to specify a tenant category. If -c is not given, the default value is IDPV.
- -s accepts a json file as a sws configuration file.
- -n accepts a tenant name.
- -k accepts true or false for the HSM export key flag. It is true by default. If -k is set to true explicitly, then the tenant is created for the export mode provided, and HSM supports it (Optional).
- -u accepts true or false. When -u is true, the IDPV Admin needs to provision the smart card for the user by using Connecting on behalf of the user functionality. When -u is false, the user can provision the smart card on his own, by connecting with the IDPV Client.
IDPV Tenant Example:
```
SetupTenant create -i Config/idp-staclassic-redirect.json -p Config/policy-configuration.json -k true  -a fd1b4b61-32ba-47b3-a0c9-cf8bda938b4d -n 'IDPV-Tenant' -u true -c IDPV
```
After running the above command, a Tenant ID is generated and saved as a text file in the /publish/Tenant/<TenantGUID>.txt directory, and displayed on the console.

SWS Tenant Example:
```
SetupTenant create -i Config/idp-staclassic-redirect.json -p Config/policy-configuration.json -k true  -a fd1b4b61-32ba-47b3-a0c9-cf8bda938b4d -n 'IDPV-Tenant' -u true -c IDPV
```

Copy the Tenant ID to the machine using the following command:


docker cp idprime-virtual-server-containername:/publish/Tenant/<TenantGUID>.txt <location on host>

Suggest A Change

SafeNet IDPrime Virtual Setup

Configuring the Identity Provider Configuration File

Running the IDPV Server and Setting Up the IDPV Tenant

On this page