Single Sign-On Pre-Requisites - PortalGuard Identity Provider (IdP)

Owned by Stephen Call (Deactivated)
Last updated: Feb 17, 2023 by Christopher R. Perry
3 min read

Problem

You want to configure the PortalGuard Identity Provider (IdP) in order to utilize Single Sign-On.

Solution

Follow the steps below to prepare your PortalGuard IdP.

Quick Navigation

Create the Signing Certificate

  1. Navigate to the PortalGuard server and locate the installation kit.

    • This is the folder containing the original MSI installer for PortalGuard. If you have recently upgraded, reference that folder. 

  2. Navigate to the 'ADDINS' folder and locate the following two files:

    • openssl.cnf

    • openssl.exe

  3. Copy those files and paste them in your 'Program Files\PistolStar\PortalGuard' directory. 

  4. Open an elevated CMD and CD to this directory. 

  5. Run the following command and follow the prompts that appear to generate a self-signed certificate:

    • openssl req -sha256 -x509 -days 3650 -newkey rsa:2048 -keyout PGIdP.pem -out PGIdP.pem -config ./openssl.cnf

  6. The resulting output should resemble the following:

    • IMPORTANT NOTE: You will be asked to enter a pass phrase for the file.  Please note that while your keystrokes will not appear to register in the DOS prompt, they are being recorded.  Simply hit enter when you are ready and you will then be asked to re-enter the pass phrase for validation. 

  7. Verify that a new file named 'PGIdP.pem' exists in the 'Program Files\PistolStar\PortalGuard' directory.

  8. Run the following command to extract the public portion of the certificate to its own file:

    • openssl x509 -outform PEM -in PGIdP.pem -out PGIdP.cer

    • This command requires no additional input. 

  9. Verify that a new file named 'PGIdP.cer' exists in the 'Program Files\PistolStar\PortalGuard' directory. 

Configure the Identity Provider Configuration Editor

  1. From the PortalGuard server, open the Identity Provider Configuration Editor.

  2. Click on the 'General IdP Settings' button.

  3. Navigate to the Signing tab.

  4. Click on the 'Browse' button and then 'Browse' within the popup that appears to locate the 'PGIdP.pem' file that you created in the previous steps. 

    • This file should be located in the 'Program Files\PistolStar\PortalGuard' folder.

  5. Enter the pass phrase that you established when creating the pass phrase.

  6. Your final result should resemble the following:

  7. Navigate to the Response tab.

  8. Set a value for the 'Issuer' field. 

    • Important Note: This value should be unique and cannot be used by any other IdP in your environment or otherwise.  In light of that, the simplest format is to utilize a URL structure as seen in the example above.  The URL that you use here does NOT have to be a legitimate URL in DNS. 

  9. Click on the 'Save' button. 

  10. From the main screen of the Identity Provider Configuration Editor, navigate to the Attribute Stores tab.

  11. Ensure your Attribute Stores tab contains an entry for each 'User Repository' configured within the PortalGuard Configuration Editor.  

    • The LDAP Basic, LDAP Advanced, and Resolution tabs should all match between the two configurations.  

    • These 'Attribute Stores' are utilized to look up the user and populate claims to be sent to a Service Provider during SSO.

  12. After making the necessary changes, click on the 'Apply to Identity Provider' button. 

  13. Click on the 'Sync' button to finalize the settings.