<!-- example of a SAML authentication provider
		-->
		<security:authentication-provider ref="samlAuthenticationProvider"/>

   	<!-- An Example of a KeyStore File -->
	
	<bean id="keyManager"
		class="org.springframework.security.saml.key.JKSKeyManager">
		<constructor-arg
			value="classpath:keystore/samlKeystore.jks" />
		<constructor-arg type="java.lang.String"
			value="<<KeyStorePassword>>" />
		<constructor-arg>
			<map>
				<entry key="PhixflowSAML" value="<<KeyPassword>>" />
			</map>
		</constructor-arg>
		<constructor-arg type="java.lang.String"
			value="PhixflowSAML" />
	</bean>

In order to connect to your identity provider PhixFlow must be configured to contain service provider metadata. The configuration file contains all the tools needed in order to generate a metadata file. It is recommended to follow this procedure to generate your metadata then save the resulting xml in a file called "sp-metadata.xml" in the folder at  [tomcat root]/webapps/phixflow/WEB-INF/classes/metadata.  In order to configure the metadata generator two things need to be customised.

...

<property name="entityBaseURL"
					value="https://localhost:8443/Phixflow" />

Metadata configuration

The next step is to configure PhixFlow so that it knows where to look for both identity provider and service provider metadata. First we look at identity provider metadata:

...

 	<!-- with the exception of the metageneratorfilter line the following must be uncommented to enable SAML login -->
	<security:http entry-point-ref="samlEntryPoint"
		pattern="/SAMLLogin" use-expressions="false">
		<security:intercept-url pattern="/**"
			access="ROLE_USER" />
		<security:custom-filter
			after="BASIC_AUTH_FILTER" ref="samlFilter" />
	<!--  uncomment the line below to generate your service provider metadata -->		
	<!--<security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/>-->
	</security:http>

Other configuration

After this in order to enable SAML all that is required is to uncomment the following sections with a few exceptions. First uncomment all of the text listed below:

		<!--

	<security:http entry-point-ref="samlEntryPoint"
		pattern="/saml/**" use-expressions="false">
		<security:intercept-url pattern="/**"
			access="ROLE_USER" />

		<security:custom-filter
			after="BASIC_AUTH_FILTER" ref="samlFilter" />

	</security:http>
	
		<import resource="phixflow-SAML.xml/>
	-->

Metadata Generation

After completing this initial setup. It's time to generate the metadata. To do this setup the login configuration form to have a log in with SAML button and click it. You should be redirected to your identity provider and rejected, but your metadata will be generated by this step. Next log in as a local user then go to <<yourhost>>/Phixflow/saml/metdata in order to download an XML file of your metadata.This will need to be given to your identity provider to log in. In order to simplify configuration it is recommended to save this as metadata/sp-metadata.xml

...

At this point please refer to  the Phixflow Active Directory Setup section for more information on how to connect your identity provider provided groups to PhixFlow groups. The "default domain" section is not needed.

Logging in as a SAML user

To log in, users simply have to select a login option with SAML and click on the login button where they will be redirected to the identity provider to enter their credentials. If the login form configuration has been set to automatically log in with SAML, then they will see this screen and will instead be redirected straight to the identity provider.

Troubleshooting

Enhanced diagnostics can be generated by adding the lines

...