A SessionCreateValve is needed because RADIUS does not include the concept of a session. No changes are required to the default values of the SessionCreateValve shown below.

{
  "name": "SessionCreateValve",
  "enabled": "true",
  "config": {
    "proceed_on_error": "false"
  }
}

Modify the LDAPSearchValve to have the values required. The following JSON lists example values:

{
  "name": "LDAPSearchValve",
  "enabled": "true",
  "config": {
    "connection_ref": "bbd7198c-0a6c-43aa-b62b-cd7552c8b4cf",
    "base_dn": "dc=your,dc=base,dc=change,dc=com",
    "scope": "SUB",
    "size_limit": "0",
    "filter_template": "uid={{request.User-Name}}",
    "attributes": "*"
  }
}

Modify the LDAPBindValve as required. For example:

{
  "name": "LDAPBindValve",
  "config": {
    "connection_ref":"bbd7198c-0a6c-43aa-b62b-cd7552c8b4cf",
    "password_param_name":"User-Password",
    "userid_param_name":"User-Name"
  }
}

Add an UUIDCreateValve to create and store a random UUID. For example:

{
  "name": "UUIDCreateValve",
  "enabled": "true",
  "config": {
    "proceed_on_error": "false",
    "name": "alias_value"
  }
}

Create a SessionBindValve to bind the session to the UUID. This means that the session can be loaded later using the "Alias" or UUID string.

{
  "name": "SessionBindValve",
  "enabled": "true",
  "config": {
    "alias": "{{item.alias_value}}",
    "proceed_on_error": "false"
  }
}

Create a PropertySetValve that creates a property which contains the URL which is to opened by the OneConnect app. In this case, the UUID will be also passed as a parameter with the URL. For example:

{
  "name": "PropertySetValve",
  "enabled": "true",
  "config": {
    "proceed_on_error": "false",
    "name": "clavister-url",
    "value": "https://www.example.com/saml/authenticate/samldispatch/?accesstoken={{item.alias_value}}"
  }
}

Note that the example-url will be referenced by the vendor specific attribute in the RADIUS scenario. This attribute will be set in step D.

Create a SessionBindToUidValve to bind the session to the user ID received from the LDAPSearchValve. This will be used in the SAML Assertion.

{
  "name": "SessionBindToUidValve",
  "enabled": "true",
  "config": {
    "proceed_on_error": "false",
    "userid": "{{item.uid}}"
  }
}

Now create a SessionPersist Valve to make the session persistent otherwise it will disappear after each authentication.

{
  "name": "SessionPersistValve",
  "enabled": "true",
  "config": {
    "proceed_on_error": "false"
  }
}

SessionLoadAliasValve

This loads the previous session that was made persistent in the RADIUS scenario in step A using the user's UUID. The UUID is part of the URL that the OneConnect client opens in the browser. To retrieve the session, the aliasID property is set to this UUID using {{request.accesstoken}}.

Note that the require_session parameter is set to true so that if there is no session with the specified alias, flow execution will fail. This makes it impossible to connect using a random UUID.

LDAPSearchValve

A valve is required that creates an item instance in EasyAccess memory. An ItemCreateValve could be used for this. Alternatively, an LDAPSearchValve will also perform the task and will additionally retrieve user data based on the user ID bound to the session.

AssertionProvider

This is an assertion provider for the target webpage. The targetEntityID is the ID of an identity provider and this must have the same value as the idpID used in the HeaderSAML authenticator created earlier.

The sourceID will be the same as the entityID value in the MyApps scenario if MyApps is being used.

Other values would be added as required by the service provider. For a MyApps page, the JSON values listed above would be sufficient.

The nameIDAttribute could also be set to {{session.user_id}}.

SessionClearAllAliasValve

This clears all aliases from the session. This is done to avoid the remote possibility that an attacker might successfully replicate an alias.