SSO設定

このコンテンツは日本語をサポートしていません。

Available in Classic and VPC

Single Sign On (SSO) refers to integrated login linkage that enables access (authenticate) to multiple systems with a single ID and password. By setting SSO linkage between WORKPLACE and another system, you can automatically access and use both systems with a single login.

WORKPLACE Developers supports the following two methods of SSO, and you can select one of the two methods for linkage.

• IDP Method: IDP stands for Identify Provider and refers to a service that stores and manages the authentication information of users who access the cloud service, etc.
• SP Method: SP stands for Service Provider and refers to a service system.

IDP Method Linkage

You can link login between the company's corporate information system and WORKPLACE based on SAML 2.0 or OAuth 2.0 in the IDP method.

OAuth

Take the following procedure to perform SSO linkage with the IDP method.

• 1. Enter Linkage Information on Console
• 2. Redirect to WORKPLACE OAuth 2.0 Server and Process Response
• 3. Exchange Authentication Code for Access Token
• 4. Return Authenticated User Information

1. Enter Linkage Information on Console

1. From the NAVER Cloud Platform console, click the Services > Business applications > WORKPLACE menus, in that order.
2. Click the Developers menu.
   • If the notification pop-up window appears, check the details in the pop-up window, and then click the [Close] button.
3. Click SSO Settings.
4. Click the [Link Login] button.
   • If you are using SMARTWORK Solution (bundling WORKPLACE and NAVER WORKS), then you can skip this step.
5. Specify the SSO setting items, and then click the [Apply] button.
   
   • Domain: URL to be forwarded to redirect_uri of the company, copied onto the clipboard by clicking the [Copy] button
   • Client ID: client ID provided by WORKPLACE, copied onto the clipboard by clicking the [Copy] button
   • Client Secret: client secret value provided by WORKPLACE, copied onto the clipboard by clicking the [Copy] button
   • Redirect Domain: Copy the URL to be forwarded to redirect_uri of the company, and enter it here.

2. Redirect to WORKPLACE OAuth 2.0 Server and Process Response

Create a request parameter and redirect to the WORKPLACE OAuth 2.0 server.

https://CompanyDomainID.ncpworkplace.com/authn/oauthLogin

HTTP Method:

GET

Request:

Example:

GET https://CompanyDomainID.ncpworkplace.com/authn/oauthLogin?response_type=code&client_id=17nRVbxDCSmzymTHMdnv&redirect_uri=http://Customer/oauth2callback&loginId =admin@nbp.co.kr

After confirming login or authentication as above, the OAuth 2.0 server uses the specified URL (redirect_uri) to respond to the access request.

https:/CompanyDomainID.ncpworkplace.com/authn/oauthLogin

HTTP Method:

GET

Response:

Example:

If an error occurs, http://Customer/oauth2callback?error=access_denied
If successful, http://Customer/oauth2callback?code=jxCiS2TA80GSocD2

3. Exchange Authentication Code for Access Token

To exchange the authentication code for the access token, receive the authentication code for the Access Token Return API as shown below.

https://CompanyDomainID.ncpworkplace.com/authn/accessToken

HTTP Method:

POST

Request:

Example:

https://CompanyDomainID.ncpworkplace.com/authn/accessToken?grant_type=authorization_code&client_id=17nRVbxDCSmzymTHMdnv&client_secret=JsjOUSDOtb&code=jxCiS2TA80GSocD2

Response:

4. Return Authenticated User Information

Return the authenticated user information as shown below.

https://CompanyDomainID.ncpworkplace.com/authn/userProfile

HTTP Method:

POST

Request:

Example:

https://CompanyDomainID.ncpworkplace.com/authn/userProfile?client_id=17nRVbxDCSmzymTHMdnv&client_secret=JsjOUSDOtb&access_token=imLS80bZNkpKtM9FWvZt7MjMTcXIyIN0ygyr8DERsgzetKFIUWqArHlCUQ1VJ6I....

Response:

Logout URL

https://CompanyDomainID.ncpworkplace.com/authn/logoutProcess

SAML

Take the following procedure to perform SSO linkage based on SAML 2.0.

• 1. Enter Linkage Information on Console
• 2. Create and Deliver SAML Request
• 3. Validate SAML Request
• 4. Create and Deliver SAML Response

1. Enter Linkage Information on Console

1. From the NAVER Cloud Platform console, click the Services > Business applications > WORKPLACE menus, in that order.
2. Click the Developers menu.
   • If the notification pop-up window appears, check the details in the pop-up window, and then click the [Close] button.
3. Click SSO Settings.
4. Click the [Link Login] button.
   • If you are using SMARTWORK Solution (bundling WORKPLACE and NAVER WORKS), then you can skip this step.
5. Select SAML.
6. Specify the SSO setting items, and then click the [Apply] button.
   
   • SSO URL: Copy the provided SSO URL and enter it for the login page URL (SSO URL field) of the customer system.
   • Response Issuer: Copy the provided Response Issuer and enter it in the customer system.
   • Application: Click the [Add] button, and then enter the application information.
     • Application Name: Enter the name of the application you want to link with SSO in English.
     • ACS URL: Enter the ACS URL provided by the customer system.
     • SP Issuer (Entity ID): Enter the SP issuer (entity ID) provided by the customer system. The SP issuer can't be duplicated in a single domain.
   • Certificate: Click the [Download] button of each added application to download the certificate, and attach it to the Certificate field of the customer system.
   • NAME ID: It is fixed and displayed as "Login ID."
   • NAME ID Format: It is fixed and displayed as "UNSPECIFIED."

2. Create and Deliver SAML Request

A SAML request is created as a parameter of SSO URL, and delivered to the customer authentication system.

Request URL

It delivers the SSO URL, which is issued when registering SAML Apps in the Developer console.

Example:

https://{Companyid}.ncpworkplace.com/authn/saml/samlLogin

HTTP Method

POST

Request

See the Request field.

SAML Request Details

 <saml2p:AuthnRequest
     xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
     AssertionConsumerServiceURL="{ACS URL registered in WORKPLACE}"
     ID="{ID}"
     IssueInstant="{SAML request creation date and time}"
     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
     ProviderName="{Service Provider Name}"
     Version="2.0">
     <saml2:Issuer
         xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">{SP issuer registered in WORKPLACE}</saml2:Issuer>
     <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
 </saml2p:AuthnRequest>

3. Validate SAML Request

The customer authentication system receives the SAML request and executes the login page by validating it.
At this time, the customer's login page is executed for a domain that uses SSO, and WORKPLACE login page is executed otherwise.

4. Create and Deliver SAML Response

If the login is successful, a SAML response is created and delivered to the customer's ACS URL.

Request URL

It uses the ACS URL specified in the SAML request. (It must be identical to the registered ACS URL.)

HTTP Method

POST

Request

SAML Response Details

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="{ACS URL registered in WORKPLACE}"
 ID="{ID issued by WORKPLACE}"
 InResponseTo="{ID included in the SAML request}"
 IssueInstant="{SAML response creation date and time}"
  Version="2.0">
  <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
  {Response Issuer}
  </saml2:Issuer>
  <ds:Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      "{Digital signature}"
  </ds:Signature>
  <saml2p:Status>
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </saml2p:Status>
  <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
  ID="{ID issued by WORKPLACE}"
  IssueInstant="{SAML response creation date and time}"
  Version="2.0">
    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">
    {Response Issuer}
    </saml2:Issuer>
    <saml2:Subject>
      <saml2:NameID Format="unspecified">
      "{Login ID of the logged in user}"
      </saml2:NameID>
      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml2:SubjectConfirmationData
        InResponseTo="{ID included in the SAML request}"
        NotOnOrAfter="{SAML response end date and time}"
        Recipient="{ACS URL}"/>
      </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="{SAML response start date and time}"
    NotOnOrAfter="{SAML response end date and time}">
      <saml2:AudienceRestriction>
        <saml2:Audience>{SP issuer registered in WORKPLACE}
        </saml2:Audience>
      </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="{SAML response creation date and time}"
     SessionIndex="{ID issued by WORKPLACE}">
      <saml2:AuthnContext>
        <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
      </saml2:AuthnContext>
    </saml2:AuthnStatement>
  </saml2:Assertion>
</saml2p:Response>

SAML Response Example

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response ID="4ec6c869-4f1f-4027-adc2-90a5dc5cb597"
    InResponseTo="ajinaekefnokobjefcegddakfdphcchikhgphael" IssueInstant="2021-12-29T06:24:26.000Z"
    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://Companyid.ncpworkplace.com/authn/saml/metadata</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
            <ds:Reference URI="#4ec6c869-4f1f-4027-adc2-90a5dc5cb597">
                <ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <ds:DigestValue>EcKuJWielgJv1XCEeb1lDR6yP7w=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
       <ds:SignatureValue>oE1jjGQhtkRVxSp4....</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDHDCCAgSgAwIBAgIGAWm....</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status>
    <saml2:Assertion ID="cf10bea7-f97d-4273-b431-36b1228244e3" IssueInstant="2021-12-29T06:24:26.000Z"
        Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>http://Companyid.ncpworkplace.com/authn/saml/metadata</saml2:Issuer>
        <saml2:Subject>
            <saml2:NameID NameQualifier="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">test@samltest.com</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData InResponseTo="ajinaekefnokobjefcegddakfdphcchikhgphael"
                NotBefore="2021-12-29T06:24:26.000Z" NotOnOrAfter="2021-12-29T06:34:26.000Z"
                Recipient="https://AuthenticationCompany/acs/samltest.com"/></saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2021-12-29T06:24:26.000Z" NotOnOrAfter="2021-12-30T06:24:26.000Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>worksmobile.com</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2021-12-29T06:24:26.000Z"
            SessionIndex="ajinaekefnokobjefcegddakfdphcchikhgphael"
            SessionNotOnOrAfter="2021-12-30T06:24:26.000Z">
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

Each item of a SAML response is as follows.

SP Method Linkage

The SP method can perform SSO linkage by using Security Assertion Markup Language (SAML) 2.0 or OAuth 2.0. If WORKPLACE and the company's system are linked, then WORKPLACE becomes the service provider. You'll automatically log in to the company's system by logging in to WORKPLACE.

The following describes how to set up linkage with the SP method.

1. From the NAVER Cloud Platform console, click the Services > Business applications > WORKPLACE menus, in that order.
2. Click the Developers menu.
   • If the notification pop-up window appears, check the details in the pop-up window, and then click the [Close] button.
3. Click SSO Settings.
4. Click the [Link Login] button next to the service to set up SSO.
5. Set the login integration by referring to below.
   • Integrate Login to Google Workspace
   • Link Login With Other Services

Integrate Login to Google Workspace

You can integrate login with Google Workspace using SSO of the SAML 2.0 method.

The following describes how to integrate login with Google Workspace.

1. Separately log in to Google Admin and the NAVER Cloud Platform console.

2. In the Google Admin page, click Apps > Web and mobile apps, in that order. In the next page, click Add App > Add custom SAML app.
   

3. In the Google Admin page, enter the app name in the App Details page. Upload the app logo for the app icon. Download the logo image from Developers > Set SSO in the NAVER Cloud Platform console.
   

4. In the Option 2 of the Step 2 Google Identity Provider Details from the Google Admin page, copy the URL of the SSO URL field, click the [Download] button for the certificate of the Certificate field to download it, and then click Continue.

5. From the NAVER Cloud Platform console, click the Services > Business Applications > WORKPLACE > Developers menus, in that order.

6. Click the [Integrate Login] button next to Google Workspace.

7. Paste the SSO URL copied in Step 4 onto the SSO URL input field of the NAVER Cloud Platform console.
   

8. After downloading the Certificate in Step 4, upload it by clicking the [Attach File] button of the Certificate field on the NAVER Cloud Platform console.
   

9. Separately copy the URL and ID displayed in the ACS URL and Entity ID items of the SSO Settings screen on the NAVER Cloud Platform console, and then separately paste them onto the ACS URL and Entity ID input fields in the Detailed Information of Service Provider pop-up window of Google Admin.
   

   

10. Click Continue in the Service Provider Details pop-up window of Google Admin.

11. Click Finish in the Attribute Mapping pop-up window of Google Admin.
    

12. Click Modify Service.
    

13. Select Turn ON for everyone, and then click Save.
    

14. Click the icon at the top right of Google Admin to check the registered SAML app.
    

15. From the NAVER Cloud Platform console, click the [Apply] button.

Link Login With Other Services

you can link login with various services that support SSO linkage based on the OAuth 2.0 or Security Assertion Markup Language (SAML) 2.0 method.

1. From the NAVER Cloud Platform console, click the Services > Business applications > WORKPLACE menus, in that order.

2. Click the Developers menu.

   • If the notification pop-up window appears, check the details in the pop-up window, and then click the [Close] button.

3. Click SSO Settings.

4. Click the [Link Login] button next to Other Services.

5. Select the linkage method.

6. Enter the setting items according to the selected linkage method.

   • SAML 2.0 SSO Setting Items
   • Web Login URL: Enter the Request URL produced in SAML 2.0 1. Web Login Page.
   • Logout URL: Enter the Request URL created in Client Logout.
   • Logout Domain: Enter the Request URL created in WORKPLACE Logout.
   • Register File (*.pem): Register the certificate used when electronically signing a SAML response. (The certificate is used for validation.)

7. Click the [Apply] button.

SAML 2.0 1. Web Login Page

After validating the SAML request and processing the client login, create the SAML response and return to the ACS URL.

https://ClientCompanyDomain/ClientCompanyLoginPage

HTTP Method: GET

Request:

SAML 2.0 2. Validate SAML Request

The SAML request is encoded using Deflate + Base64. Validate the SAML request.

SAML Request Details:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
  xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
  AssertionConsumerServiceURL="{ACS URL}"
  ID="{ID issued by WORKPLACE authentication system}"
  IssueInstant="{Request creation date and time}"
  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
  ProviderName="ncpworkplace.com"
  Version="2.0">
  <saml2:Issuer
      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">ncpworkplace.com</saml2:Issuer>
  <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
</saml2p:AuthnRequest>

SAML Request Items:

SAML Request Example:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
  xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
  AssertionConsumerServiceURL="https://Companyid.ncpworkplace.com/...."
  ID="bemkplgpdoemkhjmncgmbcdibglpngclfombpmed"
  IssueInstant="2018-02-14T03:33:49.999Z"
  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
  ProviderName="ncpworkplace.com"
  Version="2.0">
  <saml2:Issuer
      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">ncpworkplace.com</saml2:Issuer>
  <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
</saml2p:AuthnRequest>

WORKPLACE Logout

This feature is used when logging out from WORKPLACE after logging out from the customer's system. Upon receiving a logout request, the WORKPLACE account logged in to WORKPLACE is logged out and redirected to redirect_uri received.

Since redirect_uri is managed as white_url, it should be registered as Logout Redirection Domain in SSO Settings of Developers on the NAVER Cloud Platform console.

https://Companyid.ncpworkplace.com/authn/logoutProcess

HTTP Method: GET/POST

Request:

Response:

Redirect to redirect_uri.

Customer Logout

This feature is used to log out from the client's system after logging out from WORKPLACE.

https://ClientCompanyDomain/Logout

HTTP Method: GET

Request:

After Completion of SSO Linkage

When the SSO linkage is complete, you can log in to WORKPLACE using the login information of the existing corporate information system, which makes it convenient for managing login information.

User Login

• If the user accesses the WORKPLACE company URL (https://Companyid.ncpworkplace.com), then the user is taken directly to the login page for the corporate information system or other services (e.g., Google).

• When the user accesses the WORKPLACE basic URL (https://www.ncpworkplace.com):

  • Click the [SSO Linkage Settings] button at the bottom of the login page.
  • Enter the company ID and click the Log In button.
  • You will be taken to the login page for other integrated services (e.g., Google, company's enterprise information system). By logging in to other services, you can immediately start using WORKPLACE.