https://pact.io logo
Join Slack
Powered by
Hi all, My pactflow on-prem setup has been done on...
# pactflow
p
Hi all, My pactflow on-prem setup has been done on Kubernetes (PKS). But right now it is in demo auth mode. (See screenshot) I was going through the SAML Auth documentation ( https://docs.pactflow.io/docs/on-premises/authentication/saml/ ) There is a SSO enablement team in my company that wanted the following info so that they can configure the on-prem broker with SSO. 1. ACS / Callback URL 2. SAML Subject ( username / nt id / email ) 3. Metadata URL ( when I go to the one as per doc, it shows nothing -> http://pactflow.cre.pks.com/auth/saml/metadata )
m
1. ACS / Callback URL
https://docs.pactflow.io/docs/on-premises/authentication/saml/#assertion-consumer-url The URL is 
https://<your PactFlow host>/auth/saml/callback
.
2. SAML Subject ( username / nt id / email )
https://docs.pactflow.io/docs/on-premises/environment-variables#pactflow_saml_idp_id_attribute
3. Metadata URL ( when I go to the one as per doc, it shows nothing -> http://pactflow.cre.pks.com/auth/saml/metadata )
If you are unable to reach this endpoint, then something might be incorrect in your setup.
p
For Metadata URL, I have configured it in environment variables like this : But it is throwing 404 when trying to access it, am I missing something here?
m
This value points to your IDP, not PactFlow
Your IDP should have a metadata URL that PactFlow can query to get the information it needs. If you don’t know it, you need to specify the other attributes in the guide (the metadata endpoint can be used to discover the other items)
p
So the devpactflow.cre.pks.__<http://.com|.com> is our IDP configured by our PKS team. They said the vendor provides the metadata url. That is why I pinged here.
m
Yes, there are two metadata URLs: The IDP metadata URL (https://docs.pactflow.io/docs/on-premises/environment-variables#pactflow_saml_idp_sso_target_url) and the Service Provider one, which is the one available at 
https://<your PactFlow host>/auth/saml/metadata
(https://docs.pactflow.io/docs/on-premises/authentication/saml#metadata-url)
p
So correct me if I am wrong here, We JUST need to set the "PACTFLOW_SAML_IDP_SSO_TARGET_URL" (IDP Metadata URL). The Service provider one is automatically set by default with value [https://<your PactFlow host>/auth/saml/metadata] and will query from target url
m
You need to set all of the required ones here: https://docs.pactflow.io/docs/on-premises/environment-variables/#saml-authentication If you set the metadata URL (
PACTFLOW_SAML_IDP_METADATA_URL
) , then the PACTFLOW_SAML_IDP_SSO_TARGET_URL and PACTFLOW_SAML_IDP_CERT_FINGERPRINT can be skipped.
The Service provider one is automatically set by default with value
[https://<your PactFlow host>/auth/saml/metadata] and will query from target url
correct
p
@Matt (pactflow.io / pact-js / pact-go) I got the IDP metadata ( its in xml format - SEE SCREENSHOT) I have a link that reaches this location. I have provided that in the environment variables. ISSUE When I click on login button, the button is not redirecting anywhere. Showing this while inspect. (See ss below)
m
Hi Prakhar, we’re going to need to know the values you have set in your configuration to help you. The CSP issue is because there is a misalignment between the host names you are allowed to post to, and what it is actually wanting to post to. Best to raise a support ticket so the team can help you
Note how the form is trying to post to 
<http://devpactflow>…
but in the metadata it wants to post to 
<https://pf-uat>…
. Something is misaligned that is resulting in that setup
The logs of the PactFlow instance should tell you what values it sees for all of it’s configuration, please share those with the support ticket
howtopactflowsupport
s
Please create a ticket here with the issue details so that we can properly track the resolution and the PactFlow product support team will continue to work through it with you: https://support.smartbear.com/pactflow/message
p
Okay sure, I can raise the support ticket and provide all the info. One issue there is that its asking for Account URL. But smart bear team would not be able to access that without our VPN. Is there a way we can have a short live session on zoom etc for this?
m
The support ticket would be the starting point for that if it gets to it.
👍 1
If you choose the correct edition, it won’t ask for the account URL
hmm no it doesn’t, you can just ignore that and I’ll ask to see if we can make it go away for those using on-prem
👍 1
p
Since we are using the latest pact image available from quay, I provided the latest available version. Shall I provide our internal DNS for account URL for now or leave it blank?
👍 1
m
Yes, I’ve just noticed that’s out of date too facepalm
Shall I provide our internal DNS for account URL for now or leave it blank?
It’s probably helpful context, but you can just provide that in the problem description
👍 1
p
I have provided all the information along with the error i am seeing as well as the PKS deployment script where I have set up the envs variable for pactflow instance.
m
thanks! did you also attach the broker logs showing the configuration it sees?
✅ 1
p
You mean the pks pod logs for pactflow instance?
m
yes
✅ 1
That will be more important that the PKS configuration, because it shows exactly what the broker thinks was given to it
✅ 1
p
I just added that logs file as well to the ticket
thankyou 1
Open in Slack
PreviousNext
Powered by