Configuring for SAML Authentication

[edit on GitHub]

Chef Manage can support logging in users via SAML authentication. In order to do so, there must be a Chef Automate Server that is configured to act as a SAML Identity Provider (IdP). When the Chef Automate Server is configured to do so, it will provide an OpenID Connect (OIDC) protocol end-point that Chef Manage can use to initiate authentication.

Configuring Chef Manage

To configure the Chef Infra Server management console, first add the following code to /etc/chef-manage/manage.rb:

saml.enabled true
saml.issuer_url '<AUTOMATE OIDC ENDPOINT>'

Second, store your OIDC client credentials with using the Secrets Management commands:

chef-server-ctl set-secret saml client_id '<CLIENT ID>'
chef-server-ctl set-secret saml client_secret '<CLIENT SECRET>'

The issuer_url property should be set to something like 'https://<yourChefAutomateDomain>/api/v0'. Also, the client_id must be known to the Chef Automate server. For development purposes only, you may also need to turn off the TLS verification for the OIDC client by adding

saml.verify_tls false

to your Chef Manage configuration.

Finally, run chef-manage-ctl reconfigure to apply these settings.