Wiki source code of SAML 2.0

Hide last authors

version	line-number	content
1.1	1	{{content/}}
	2
12.1	3	When adding a //SAML 2.0// identity provider (e.g. //Shibboleth 2.0//) the parameters listed below can be configured.
1.1	4
12.1	5	== Base settings ==
1.1	6
12.1	7	{{figure image="saml_base_settings_en.png" clear="h1"}}Basic settings for the configuration of the SAML 2.0 identity provider.{{/figure}}
1.1	8
10.1	9	=== Name ===
	10
12.1	11	Name of the identity provider in {{formcycle/}}.
1.1	12
12.1	13	=== Different name on form login button ===
1.1	14
12.1	15	If a form has been configured to offer several authentication options, a dialog will be displayed when opening the form in which an authentication type has to be selected. The text content that should be on the button for this identity provider can be configured here.
1.1	16
12.1	17	If nothing is entered here, the name entered under //Name// is used.
1.1	18
12.1	19	=== Alias for callback URL (UUID) ===
1.1	20
12.1	21	Unique identifier that is used when the identity provider returns to {{formcycle/}}. This value is generated automatically, but can be changed if necessary.
1.1	22
12.1	23	=== Callback URL ===
1.1	24
12.1	25	The URL which is used when returning from the identity provider to {{formcycle/}} is shown here and can be copied to the clipboard by clicking the copy icon to the right of the URL.
1.1	26
12.1	27	== Initially visible buttons ==
1.1	28
12.1	29	Below the base settings there are initially 3 buttons whose functions are intended to help with the configuration of the Facebook identity provider.
1.1	30
12.1	31	=== Send email to provider ===
1.1	32
12.1	33	Opens the e-mail program set up in the system with a pre-formulated request regarding the information required for the configuration of the identity provider in {{formcycle/}}.
1.1	34
12.1	35	=== Help ===
1.1	36
12.1	37	Opens this help page in the browser.
1.1	38
12.1	39	=== Add configuration ===
1.1	40
12.1	41	If the required information has been provided by the identity provider, the area for the configuration of the identity provider can be opened by clicking on this button. Afterwards the area //configuration// which is described below opens.
1.1	42
12.1	43	{{figure image="saml_configuration_en.png" clear="h2"}}Configuration options for an SAML 2.0 identity provider.{{/figure}}
	44	== Configuration ==
1.1	45
12.1	46	* Upload configuration: Pressing this button opens a file selection dialog, with which the configuration file supplied by the Identity Provider can be selected. By confirming the selection in the dialog, the file is uploaded.
1.1	47
12.1	48	* //FileName.xml//: After a configuration file has been uploaded and the configuration was saved, it is possible to download the file here. The download is started by clicking on the file name or the {{ficon name="download-circle-outline"/}} symbol.
10.1	49
12.1	50	=== Mapping to user attributes ===
1.1	51
12.1	52	By clicking on //Mapping to user attributes// the configuration fields for mapping individual attributes can be made visible. SAML attributes can be configured for the following data. In each case, the name of the //saml:attributes// node must be specified.
1.1	53
12.1	54	* Given name (firstname): first name of the user
	55	* Last name (familyName): Last name of the user
	56	* Display name (displayName): Display name of the user
	57	* Username (userName): User name of the user
	58	* Email (mail): Email address of the user
	59	* Language (locale): Language of the user
	60	* Location (location): Location of the user
	61	* Picture url (pictureUrl): Picture URL of the user
	62	* Profile url (profileUrl): Profile URL of the user
1.1	63
12.1	64	{{id name="keystore" /}}
	65	=== Manage keystore ===
1.1	66
12.1	67	By clicking on //Manage keystore// the settings for the keystore become visible. There are the following two buttons:
1.1	68
12.1	69	* Create new keystore: Creates a new keystore with a new key pair
	70	* Update keystore file: Opens a file selection dialog with which an existing keystore can be selected and uploaded.
1.1	71
12.1	72	After uploading your own keystore, the following input fields also appear:
	73	* Keystore password: Password of the keystore
	74	* Keypair password: Password of the key pair
10.1	75
12.1	76	{{info}}Own keystores must be Java keystores of type JKS, which contain a corresponding 2048-bit RSA key pair. Such a keystore can be generated, for example, with the utility program keytool for a certificate lifetime of approximately 10 years (3650 days) using the following command: {{code language="none"}}keytool -genkeypair -alias ihr-alias -keypass ihr-passwort -keystore samlKeystore.jks -storepass ihr-passwort -keyalg RSA -keysize 2048 -validity 3650{{/code}}{{/info}}
1.1	77
12.1	78	{{figure image="saml_extended_settings_en.png" clear="h2"}}Extended settings for configuring an SAML 2.0 identity provider.{{/figure}}
	79	=== Extended settings ===
1.1	80
12.1	81	With a click on //Extended settings// further parameters for the connection with the Identity Provider can be configured.
1.1	82
10.1	83	==== Service provider entity ID ====
1.1	84
12.1	85	Optional ID for identification against the Identity Provider.
1.1	86
10.1	87	==== Force authentication ====
1.1	88
12.1	89	Specifies whether a user should be forced to log in even if a valid session is still present.
1.1	90
10.1	91	==== Passive authentication ====
1.1	92
12.1	93	Specifies whether an authentication without interaction with the user should be tried.
1.1	94
10.1	95	==== User name qualifier ====
1.1	96
12.1	97	Specifies whether the authentication request should also send the //NameQualifier//. This is not required by the SAML standard, but for some identity providers it is necessary.
1.1	98
10.1	99	==== Authentication request signed ====
1.1	100
12.1	101	Specifies whether the authentication request should be digitally signed.
1.1	102
10.1	103	==== Logout request signed ====
1.1	104
12.1	105	Specifies whether the logout request should be digitally signed.
1.1	106
10.1	107	==== Wants assertions signed ====
1.1	108
12.1	109	Specifies whether the SAML statements (assertions) are requested to be digitally signed.
1.1	110
10.1	111	==== Wants response signed ====
1.1	112
12.1	113	Specifies whether the SAML responses should be digitally signed.
1.1	114
12.1	115	==== Max. authentication lifetime (seconds) ====
1.1	116
12.1	117	Maximum duration of an exisitng login to the identity provider. The default value is {{code language="none"}}3600{{/code}} seconds.
1.1	118
12.1	119	==== Max. clock skew (seconds) ====
1.1	120
12.1	121	Maximum allowed difference in system clock times between the {{fcserver/}} and the identity provider. The default value is {{code language="none"}}300{{/code}} seconds.
1.1	122
10.1	123	==== Assertion consumer service index ====
1.1	124
12.1	125	Specifies the index of the Assertion Consuming Service to be used in the login request. The default value is {{code language="none"}}-1{{/code}}, which is the default of the identity provider.
1.1	126
10.1	127	==== Attribute consumer service index ====
1.1	128
12.1	129	Specifies the index of the attribute consuming services which should be used for the authentication request. The default value is {{code language="none"}}-1{{/code}}, which is the default of the identity provider.
1.1	130
10.1	131	==== Authentication request binding type ====
1.1	132
12.1	133	Specifies the transmission type with which {{formcycle/}} requests a login to the identity provider.
1.1	134
10.1	135	==== Response binding type ====
1.1	136
12.1	137	Specifies the transmission type with which the identity provider responds to a {{formcycle/}} login.
1.1	138
10.1	139	==== Logout request binding type ====
1.1	140
12.1	141	Specifies the transmission type with which {{formcycle/}} requests a logoff from identity provider.
1.1	142
10.1	143	==== Logout response binding type ====
1.1	144
12.1	145	Specifies the transmission type with which the identity provider responds to a logoff from {{formcycle/}}.
1.1	146
10.1	147	==== Signature canonicalization algorithm ====
1.1	148
12.1	149	Specifies the algorithm to be used to convert the signed request into a standardized XML form. {{code language="none"}}http://www.w3.org/2001/10/xml-exc-c14n#{{/code}} is used by default.
1.1	150
10.1	151	==== Black listed signature signing algorithms ====
1.1	152
12.1	153	Algorithms that are forbidden for signing.
1.1	154
10.1	155	==== Signature algorithms ====
1.1	156
12.1	157	Algorithms allowed for signing.
1.1	158
10.1	159	==== Signature reference digest methods ====
1.1	160
12.1	161	Specifies the hash algorithms that are allowed when signing the SAML statements (assertions).
	162