Configure SAML for PORTALADMIN (on macOS)

Historically, PORTALADMIN authentication needs the nativeadmin password of the WNV. This is very difficult to do if you are using both SAML and non-SAML environments. To avoid this difficult situation, there is a DEFAULTS.php option named ADMIN_HTTPD_AUTH. If set to true, this will move control of authentication to the Portal server’s Apache server. You will have to log in as “nativeadmin” when asked for a user name, which is different from non-SAML PORTALADMIN, which doesn't ask for a user name.

This option will only be available as of Portal 19.0, which contains /usr/etc/portal/PORTAL/libs/PORTALADMIN.obj.php to support this authentication option.

Change the value of ADMIN_HTTPD_AUTH

In /usr/etc/portal/PORTAL/defaults/DEFAULTS.php, change the value of the ADMIN_HTTPD_AUTH variable to true:

'ADMIN_HTTPD_AUTH' => true,

Edit the PORTALADMIN section of httpd.conf

Edit the "<Directory /usr/etc/portal/PORTALADMIN>" block in httpd.conf on the Portal Server.

In th example below, the italics show what is removed, and bold text what is added. Italics within a bold line shows fields that need to be edited.

The default looks like this:

<Directory /usr/etc/portal/PORTALADMIN>

Order Allow,Deny

Allow From All

AllowOverride None

Options MultiViews

</Directory>

Change it to this:

<Directory /usr/etc/portal/PORTALADMIN>

AuthType Basic

AuthName WebNative

AuthBasicProvider file

AuthUserFile /etc/httpd/apache.userfile

Require valid-user

AllowOverride None

Options MultiViews

</Directory>

Restart Apache:

> apachectl restart

Set up nativeadmin user on the Portal Server

Run this to create the nativeadmin Apache user and assign nativeadmin password:

> htpasswd -c /etc/httpd/apache.userfile nativeadmin

This means that you will have to change the password on the Portal server every time you change it on the Xinet server if you want the password to be consistent.

IMPORTANT: Note that even though PORTALADMIN is now set up to use SAML, you will still need to configure any new sites later created to use SAML.