{"action":"opened","issue":{"url":"https://api.github.com/repos/Netflix/asgard/issues/638","labels_url":"https://api.github.com/repos/Netflix/asgard/issues/638/labels{/name}","comments_url":"https://api.github.com/repos/Netflix/asgard/issues/638/comments","events_url":"https://api.github.com/repos/Netflix/asgard/issues/638/events","html_url":"https://github.com/Netflix/asgard/issues/638","id":54780684,"number":638,"title":"Configuring Authentication and Authorization is Not Obvious","user":{"login":"grahamc","id":76716,"avatar_url":"https://avatars.githubusercontent.com/u/76716?v=3","gravatar_id":"","url":"https://api.github.com/users/grahamc","html_url":"https://github.com/grahamc","followers_url":"https://api.github.com/users/grahamc/followers","following_url":"https://api.github.com/users/grahamc/following{/other_user}","gists_url":"https://api.github.com/users/grahamc/gists{/gist_id}","starred_url":"https://api.github.com/users/grahamc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grahamc/subscriptions","organizations_url":"https://api.github.com/users/grahamc/orgs","repos_url":"https://api.github.com/users/grahamc/repos","events_url":"https://api.github.com/users/grahamc/events{/privacy}","received_events_url":"https://api.github.com/users/grahamc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-19T15:59:05Z","updated_at":"2015-01-19T15:59:05Z","closed_at":null,"body":"The current documentation makes it pretty difficult to understand and follow how to use the OneLogin SAML authentication provider. After a few hours of debugging and digging I discovered you need to specify `authorizationProviders` in order for any pages to be made private.\r\n\r\nNOTE: The current AuthorizationProviders only require auth for *browser* requests, so scripts using the API may not require authorization. YMMV, be careful.\r\n\r\nThis is the configuration I ended up with which successfully uses OneLogin's SAML authentication mechanism:\r\n\r\n```\r\ngrails {\r\n        awsAccounts=['YOURACCTNUMBER']\r\n        awsAccountNames=['YOURACCTNUMBER':'accountnickname']\r\n}\r\n\r\nplugin {\r\n        authenticationProvider='oneLoginAuthenticationProvider'\r\n        authorizationProviders=['restrictBrowserAuthorizationProvider','restrictEditAuthorizationProvider']\r\n}\r\n\r\nsecret {\r\n        accessId='YOURACCESSID'\r\n        secretKey='YOURSECRETKEY'\r\n}\r\n\r\nsecurity {\r\n        onelogin {\r\n                url='https://app.onelogin.com/trust/saml2/http-post/sso/...'\r\n                logoutUrl='https://app.onelogin.com/logout'\r\n                certificate = 'certificate-base64-encoded'\r\n        }\r\n}\r\n\r\ncloud {\r\n        envStyle='prod'\r\n        accountName='accountnickname'\r\n        publicResourceAccounts=['amazon']\r\n}\r\n```"}}