Shibboleth Only

This method is a good choice, when there is no information provider other than Shibboleth available. For this to work the groups for Admin, SuperUser and View available and also they should follow a regex syntax that can be to filter out the domains.

Configuration

There are two ways of configuring the system:

Using Admin Panel (Recommended)

After you activate the ShibbolethLogin plugin using the basic configuration, in the Menu set the following options:

View Groups in the Shibboleth: It can be something like this cn=Piwik-View-(.*),ou=groups,o=org; the regex (.*) should be the domain the user should have view access to.

Admin Group in the Shibboleth: It can be something like this cn=Piwik-Admin-(.*),ou=groups,o=org; the regex (.*) should be the domain the user should have admin access to.

Activate the Fetch Domain View/Admin Groups. This leads to regex check by the application to extract the domain name from the name of the group added in the Admin/View groups field.

SuperUser Group No change here if you can see the admin page.

Using config.ini.php directly

If you can not make the system work or no admin panel is available you can add the LoginShibboleth Settings directly to the config.ini.php:

[LoginShibboleth]
shibboleth_user_login = "uid"
shibboleth_user_alias = "fullName"
shibboleth_user_email = "mail"
shibboleth_separator = ";"
shibboleth_admin_groups_option = "shibboleth_admin_groups_domains_active"
shibboleth_view_groups_option = "shibboleth_admin_groups_domains_active"
shibboleth_view_groups = "cn=Piwik-View-(.*),ou=groups,o=org"
shibboleth_admin_groups = "cn=Piwik-View-(.*),ou=groups,o=org"
shibboleth_superuser_groups = "cn=Piwik-Admin,ou=groups,o=org"

The settings are the same as the first option.