On the configuration file you can find the security section, in this section option like the encryptionKey, inactive timeout, roles and authentication can be found:

enable ( type=boolean | default= false | required ) - Enables the server authentication, including login page (if need)
inactiveInterval ( type=integer | default=600 | optional ) - Defines the timeout for an inactive session, after the timeout is trigger, the session will expire and the user will need to login again
- Every action perform by the user, restarts the timeout
encryptionKeyFile ( type=string | default=./bin/saga.ek | required ) - Location of the file holding the encryption key, Saga server provides one by default
- Change the encyptionKeyFile as soon as you start a working on a new project
defaultRole ( type=string | default=admin | optional ) - Default role to be use in the users if no role is provided. At the moment Saga Server has 2 roles admin and editor
type ( type=string | default=config | optional ) - Defines the type of authentication to be use by the server
- Additional configuration is required depending on the type of security selected

"security": {
      "enable": true,
      "inactiveInterval": 600,
      "encryptionKeyFile" : "./bin/saga.ek",
      "defaultRole": "admin",

      "type": "<AUTHENTICATION_TYPE>",

.
.
.
}

Saga Server counts with 4 authentication types

Config - Uses usernames and passwords defined in the configuration file
LDAP - Uses the LDAP protocol to connect to a Directory Server
SAML - (Removed in 1.3.3) SSO login method offering more secure authentication. (Currently on development, available Microsoft SSO)
OIDC - (Added in 1.3.3) OpenID Connect (OIDC) is an open authentication protocol that works on top of the OAuth 2.0 framework.

Authentication Type

Config

Config authentication is the most basic of all, ideal for demos, but not recommended for production environments, unless in a close environment. This authentication uses Users, Passwords and Roles defined in the same config file, under the users field, one entry per user.

Config will allow you to login via Form and Basic Authentication

"security": {
 	"enable": true,
    "inactiveInterval": 600,
    "encryptionKeyFile" : "./bin/saga.ek",
    "defaultRole": "admin",
    "type": "config",

    "users": [
     	{
         	"username": "admin",
         	"password": "password",
         	"roles": "admin"
        },
        {
         	"username": "user1",
         	"password": "p@ssword",
         	"roles": "editor"
        },
        {...}
        .
        .
        .
 	]
}

LDAP

LDAP, the Lightweight Directory Access Protocol, is a mature, flexible, and well supported standards-based mechanism for interacting with directory servers.

LDAP will allow you to login via Form and Basic Authentication

server ( type=string | required ) - Url to the LDAP server
userAccountField ( type=string | default=cn | optional ) - Field to use as the user account
bindDN ( type=string | required ) - LDAP distinguished name to the location of the users
idField ( type=string | default=uid | optional ) - Field to use as the user ID
passwordField ( type=string | default=password | optional ) - Field to use as the user password
attributes ( type=string array | required ) - Names of the attributes to return for the user profile

"security": {
	"enable": true,
 	"inactiveInterval": 600,
    "encryptionKeyFile" : "./bin/saga.ek",
    "defaultRole": "admin",
    "type": "ldap",

    "ldap": {
     	"server": "ldap://localhost:10389",
        "userAccountField": "cn",
        "bindDN": "ou=Users,dc=example,dc=com",
        "idField": "uid",
        "passwordField": "userPassword",
        "attributes": [
         	"givenName",
            "mail"
    	]
	},
}

SAML (Removed on 1.3.3)

Security Assertion Markup Language (SAML) is a login standard that helps users access applications based on sessions in another context. It’s a single sign-on (SSO) login method offering more secure authentication (with a better user experience) than usernames and passwords.

SAML will redirect you to the provider login page, so no login page is required.

keystorePath ( type=string | required ) - Path to the keystore holding the certificates
keystorePassword ( type=string | required ) - password to the keystore
privateKeyPassword ( type=string | required ) - Password to the keys in the keystore
identityProviderUseFileSystem ( type=string | required ) - If true, the identityProviderMetadataPath receives the path to an XML file. If false, the identityProviderMetadataPath receives a web url to find the xml file with the information of de IDP.
identityProviderMetadataPath ( type=string | required ) - Path to the identity provider, provided by the SAML Service. Consult the How to Article for saml in SAGA developers space to see how to obtain this field.
timeOut ( type=string | default=3600 | required ) - The time out in seconds for the SAML server to provide an answer.
mappedAttributes ( type=string | required ) - Each value correspond to a field of the IDP that must be mapped to a new variable name. For example http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name mapped to a key called username.
serverURL ( type=string | required ) - Server url of the Saga Server. Called by the authentication provider
- This will be used to generate the callback url which is form like this <Server_URL>/saga/auth/callback
- You need to add the callback url (e.g. http://localhost:8080/saga/auth/callback or https://localhost:443/saga/auth/callback) to your Authentication provider
nameIdAttribute ( type=string | optional ) - Attribute to use as the user ID

Without FileSystem:

"security": {
      "enable": true,
      "encryptionKeyFile" : "./bin/saga.ek",
      "inactiveInterval": 600,
      "type": "saml",
      "defaultRole": "admin",

      "saml": {
        "keystorePath": "bin/samlKeystore.jks",
        "keystorePassword": "pac4j-demo-passwd",
        "privateKeyPassword": "pac4j-demo-passwd",
        "identityProviderUseFileSystem": false,
        "identityProviderMetadataPath": "https://your.provider.com/identityProvider.xml",
        "serverURL": "http://localhost:8080",
        "timeOut": 86400,
        "nameIdAttribute": "nameId",
        "mappedAttributes": {
          "username": "field.name",
          "displayName":  "field.displayname",
          "email":  "field.emailaddress",
          "id": "field.objectidentifier"
        }
      }
    },

OpenId Connect (Added on 1.3.3)

OpenID Connect (OIDC) is an open authentication protocol that works on top of the OAuth 2.0 framework. It allows third-party applications to verify the identity of the end-user and obtain basic user profile information in an interoperable and REST-like manner.

OIDC will redirect you to the provider login page, so no login page is required.

serverURL ( type=string | required ) - Server url of the Saga Server. Called by the authentication provider
clientId ( type=string | required ) - Provided by the OpenID Connect provider
discoveryURI ( type=string | required ) - Provided by the OpenID Connect provider (to read the metadata of the identity provider)
scope ( type=string | default=openid email profile | optional ) - Scopes are used by an application during authentication to authorize access to a user's details, like name and picture
- This will be used to generate the callback url which is form like this <Server_URL>/saga/auth/callback?client_name=OidcClient
- You need to add the callback url (e.g. http://localhost:8080/saga/auth/callback?client_name=OidcClient or https://localhost/saga/auth/callback?client_name=OidcClient) to your Authentication provider

Without FileSystem:

"security": {
      "enable": true,
      "encryptionKeyFile" : "./bin/saga.ek",
      "inactiveInterval": 600,
      "type": "openid",
      "defaultRole": "admin",

   	  "openid": {
        "serverURL": "http://localhost:8080",
        "clientId": "clientId",
        "discoveryURI": "discoveryURI"
      }
    },

Login Methods

Currently Saga Server has 3 methods to login, (besides the login of SAML)

Form

The Form login , will enable the login page for the Saga Server, here you can user your username and password to access. This method uses a POST HTTP request.

Basic Authentication

When employing Basic Authentication, users include an encoded string in the Authorization header of each request they make. The string is used by the request’s recipient to verify user’s identity and rights to access a resource.

The Authorization header follows this format:

Authorization: Basic <credentials>

We then construct the credentials like this:

The user’s username and password are combined with a colon.
The resulting string is base64 encoded.

curl --location --request GET 'http://localhost:8080/saga/api/client/process/units' \
--header 'Authorization: Basic <Base64(USERNAME:PASSWORD)>'

API Key

This method is recommended when having communication between services without user interaction.

When employing API Keys, the service include an API Key string in the Authorization header of each request they make. The string is used by the request’s recipient to verify service’s identity and rights to access a resource.