Description
NethVoice CTI users can currently authenticate only with their account-provider password (PAM/LDAP bind). Organizations using a federated Identity Provider (e.g. universities with Shibboleth/SAML2, as in legacy NethVoice 7 deployments integrated with the Cineca IdP) need users to log into NethVoice CTI through the IdP, without typing a password in NethVoice.
Goal: introduce a generic, pluggable "authentication method" in the NS8 NethVoice module: SAML2 now, ready for OIDC later, with minimal changes to the core components.
Design
Two orthogonal concepts:
- Account provider (existing, unchanged): where users live (NS8 OpenLDAP or external LDAP/AD). Still required with SSO: it remains the source of user records, extensions and CTI profiles.
- Authentication method (new): how users prove their identity:
password (default, current behavior) or saml2 (delegated to an external IdP). The SAML identity attribute (e.g. uid, eppn) must match the account-provider username.
Trusted-mint contract (protocol agnostic):
- A Shibboleth SP container, generated from the module settings, authenticates the user against the IdP.
- Traefik guards a dedicated mint route (
POST /api/sso-login) with forwardAuth against the SP check endpoint; the verified identity is injected as Remote-User (client-supplied values are overridden, the SP fails closed on spoofing).
- nethcti-middleware forwards the identity with a shared secret to nethcti-server, which mints the token without a password.
Adding OIDC later only requires a new front door (e.g. oauth2-proxy) speaking the same contract.
Security
- Per-install high-entropy secrets generated by the module (mint-authorization secret and a separate HMAC token key), never shown in the UI, revoked when SSO is disabled.
- Privileged/local accounts (
admin, administrator, root) always denied over SSO; optional user allowlist.
- SP attribute filter scoped to the single identity attribute, single-attribute
REMOTE_USER, optional value regex.
- Optional IdP metadata signature verification (federation signing certificate, settable via API).
- SSO is off by default: with
authentication_method=password nothing changes.
User experience
- Cluster-admin settings: "Authentication method" selector; with
saml2: the service-provider metadata URL to register on the IdP (copy to clipboard), IdP metadata URL, identity attribute, SSO button label.
- CTI login page: SSO button instead of the password form;
https://<cti>/?login=sso starts the flow directly (like the legacy ?login=shibboleth).
- NethLink: two-step login (host first, then credentials or SSO button based on the host authentication method); the SAML flow runs in a dedicated window and SSO accounts are stored without a password.
Validated end-to-end on NS8 with a Shibboleth SP and a SimpleSAMLphp test IdP (login, phone-island and calls working).
Description
NethVoice CTI users can currently authenticate only with their account-provider password (PAM/LDAP bind). Organizations using a federated Identity Provider (e.g. universities with Shibboleth/SAML2, as in legacy NethVoice 7 deployments integrated with the Cineca IdP) need users to log into NethVoice CTI through the IdP, without typing a password in NethVoice.
Goal: introduce a generic, pluggable "authentication method" in the NS8 NethVoice module: SAML2 now, ready for OIDC later, with minimal changes to the core components.
Design
Two orthogonal concepts:
password(default, current behavior) orsaml2(delegated to an external IdP). The SAML identity attribute (e.g.uid,eppn) must match the account-provider username.Trusted-mint contract (protocol agnostic):
POST /api/sso-login) with forwardAuth against the SP check endpoint; the verified identity is injected asRemote-User(client-supplied values are overridden, the SP fails closed on spoofing).Adding OIDC later only requires a new front door (e.g. oauth2-proxy) speaking the same contract.
Security
admin,administrator,root) always denied over SSO; optional user allowlist.REMOTE_USER, optional value regex.authentication_method=passwordnothing changes.User experience
saml2: the service-provider metadata URL to register on the IdP (copy to clipboard), IdP metadata URL, identity attribute, SSO button label.https://<cti>/?login=ssostarts the flow directly (like the legacy?login=shibboleth).Validated end-to-end on NS8 with a Shibboleth SP and a SimpleSAMLphp test IdP (login, phone-island and calls working).