SSO via SAML or JWT

[carolinainnovative]

This goes more toward an "enterprise" feature, but it would be awesome if you guys could integrate the user's web portal - or even the admin console - with a SAML or JWT/OpenID based single sign-on. It wouldn't take a huge amount of work - most of the work has been done by others multiple times over with lots of code "out there" - would just take integrating it.

That way, users do not have to ever login to the web portal - they can login to whatever centralized system they have, in our case OneLogin, and with one click, get to "their page" in the phone system.

RingCentral has this. Others are following suit. Pretty please?

 

[SweetAction]

I'm going to bump this up.

There are many other requests EVERYWHERE that this request can fulfill.

A proper SAML integration would provide for:
(Items in " are items that SAML could be "used" to provide, although not actually part of the protocol)

1. Single Sign On
2. MFA
3. "AD integration"
4. "Password Sync"
5. "LDAP"
6. and much more

Some 3CX threads asking for this:
https://www.3cx.com/community/threads/ldap-active-directory-authentication.49680
https://www.3cx.com/community/threads/3cx-multi-factor-authentication.50642
https://www.3cx.com/community/threads/final-word-on-ad-integration.67807/

From a development standpoint, this actually isn't too complicated. I am not proposing any changes to the 3CX standalone authentication system - that can stay as is. So no reworking SIP passwords, webclient password, permissions, or anything else.

The workflow would look like this:

1. User hits SAML provider webpage (Not 3CX's responsibility)
2. SAML authenticates user via authentication database. This is likely AD in most cases (Not 3CX's responsibility)
3. IDP (SAML Provider) passes along needed attributes to 3CX in the claim. (Not 3CX's responsibility)
4. SP (3CX) matches an attribute like email to an extension number's email address. (3CX needs to build a listener)
5. 3CX sends back authorization and logs user in as matched extension (3CX needs to build this)
6. User is logged in and happy.

How does this address the 5 concerns above?

1. Single Sign On - Core focus here...
2. MFA - you can almost always enforce MFA on your SAML provider, allowing instant MFA. For example, DUO, a MFA provider, has plugins for ADFS, a SAML 2.0 IDP.
3. "AD integration" - Most SAML IDPs can use AD as the authentication database. ADFS can and does.
4. "Password Sync" - Most SAML IDPs can use your current password provider as the authentication database. Mostly the same as 3.
5. "LDAP" - see above. While not providing LDAP exactly, most people requesting it are doing so for password sync.

And while this doesn't cover every use case of "AD Integration" or similar, it covers 90% of what people want.

 

[Evolute IT]

I'm going to bump this up.

There are many other requests EVERYWHERE that this request can fulfill.

A proper SAML integration would provide for:
(Items in " are items that SAML could be "used" to provide, although not actually part of the protocol)

1. Single Sign On
2. MFA
3. "AD integration"
4. "Password Sync"
5. "LDAP"
6. and much more

Some 3CX threads asking for this:
https://www.3cx.com/community/threads/ldap-active-directory-authentication.49680
https://www.3cx.com/community/threads/3cx-multi-factor-authentication.50642
https://www.3cx.com/community/threads/final-word-on-ad-integration.67807/

From a development standpoint, this actually isn't too complicated. I am not proposing any changes to the 3CX standalone authentication system - that can stay as is. So no reworking SIP passwords, webclient password, permissions, or anything else.

The workflow would look like this:

1. User hits SAML provider webpage (Not 3CX's responsibility)
2. SAML authenticates user via authentication database. This is likely AD in most cases (Not 3CX's responsibility)
3. IDP (SAML Provider) passes along needed attributes to 3CX in the claim. (Not 3CX's responsibility)
4. SP (3CX) matches an attribute like email to an extension number's email address. (3CX needs to build a listener)
5. 3CX sends back authorization and logs user in as matched extension (3CX needs to build this)
6. User is logged in and happy.

How does this address the 5 concerns above?

1. Single Sign On - Core focus here...
2. MFA - you can almost always enforce MFA on your SAML provider, allowing instant MFA. For example, DUO, a MFA provider, has plugins for ADFS, a SAML 2.0 IDP.
3. "AD integration" - Most SAML IDPs can use AD as the authentication database. ADFS can and does.
4. "Password Sync" - Most SAML IDPs can use your current password provider as the authentication database. Mostly the same as 3.
5. "LDAP" - see above. While not providing LDAP exactly, most people requesting it are doing so for password sync.

And while this doesn't cover every use case of "AD Integration" or similar, it covers 90% of what people want.

THIS.

 

[MannyL]

I'm going to bump this up.

There are many other requests EVERYWHERE that this request can fulfill.

A proper SAML integration would provide for:
(Items in " are items that SAML could be "used" to provide, although not actually part of the protocol)

1. Single Sign On
2. MFA
3. "AD integration"
4. "Password Sync"
5. "LDAP"
6. and much more

Some 3CX threads asking for this:
https://www.3cx.com/community/threads/ldap-active-directory-authentication.49680
https://www.3cx.com/community/threads/3cx-multi-factor-authentication.50642
https://www.3cx.com/community/threads/final-word-on-ad-integration.67807/

From a development standpoint, this actually isn't too complicated. I am not proposing any changes to the 3CX standalone authentication system - that can stay as is. So no reworking SIP passwords, webclient password, permissions, or anything else.

The workflow would look like this:

1. User hits SAML provider webpage (Not 3CX's responsibility)
2. SAML authenticates user via authentication database. This is likely AD in most cases (Not 3CX's responsibility)
3. IDP (SAML Provider) passes along needed attributes to 3CX in the claim. (Not 3CX's responsibility)
4. SP (3CX) matches an attribute like email to an extension number's email address. (3CX needs to build a listener)
5. 3CX sends back authorization and logs user in as matched extension (3CX needs to build this)
6. User is logged in and happy.

How does this address the 5 concerns above?

1. Single Sign On - Core focus here...
2. MFA - you can almost always enforce MFA on your SAML provider, allowing instant MFA. For example, DUO, a MFA provider, has plugins for ADFS, a SAML 2.0 IDP.
3. "AD integration" - Most SAML IDPs can use AD as the authentication database. ADFS can and does.
4. "Password Sync" - Most SAML IDPs can use your current password provider as the authentication database. Mostly the same as 3.
5. "LDAP" - see above. While not providing LDAP exactly, most people requesting it are doing so for password sync.

And while this doesn't cover every use case of "AD Integration" or similar, it covers 90% of what people want.

+100

 

[olivier lafamme]

+1

 

[sbrooks]

+1

SAML is essential in an enterprise environment. Not having it is reducing the usability of 3CX.

 

[nseatonedu]

+1
It's almost 2020. This should be a minimum requirement for a modern telephony company..

 

[tamediAlex]

+1
We are using OKTA (SAML auth) as IDP and would be very nice to benefit of SAML SSO.

 

[ANT-Solutions]

+1

 

[RickG]

It's now 2020 how is this not a thing?
+1

 

[VoIPTools]

SweetAction,

Confirming 3CX credentials is fairly straightforward using the 3CX Call Control API. How you pass those credentials to the Web client or 3CX Management console is unclear. There is no API for that. I think we would need some help from 3CX to address passing credentials to the web clients.

 

[davec]

+1 - Just starting a trial and very surprised there's no SSO.

 

[mcoacollins]

+1 - Boggles my mind how a modern "cloud-ready" solution doesn't have SAML and MFA/TOTP. Not sure how creating extensions based on Office 365 accounts got on the roadmap and implemented - but authenticating with them didn't.

Having this would have saved a great many number of admins "what's my password" help desk tickets in the past few weeks.

 

[scharles]

+1

 

[Shuichi Menrai]

+1

 

[Andy vdG]

+1

 

[m.jeu]

+1

 

[Greentube-ASM]

+1

 

[m.jeu]

I'm wandering why security features which will open the door for thousands of new customers are getting ignored. I would love to see at least a reaction or a comment from the 3CX to these requests.

 

[hwohlert]

Important: SSO / SAML

 

[Smartnet]

+1