Wiki source code of SAML 2.0

Show last authors
1 {{content/}}
2
3 When adding a //SAML 2.0// identity provider (e.g. //Shibboleth 2.0//) the parameters listed below can be configured.
4
5 == Base settings ==
6
7 {{figure image="saml_base_settings_en.png" clear="h1"}}
8 Basic settings for the configuration of the SAML 2.0 identity provider.
9 {{/figure}}
10
11 === Name ===
12
13 Name of the identity provider in {{formcycle/}}.
14
15 === Different name on form login button ===
16
17 If a form has been configured to offer several authentication options, a dialog will be displayed when opening the form in which an authentication type has to be selected. The text content that should be on the button for this identity provider can be configured here.
18
19 If nothing is entered here, the name entered under //Name// is used.
20
21 === Alias for callback URL (UUID) ===
22
23 Unique identifier that is used when the identity provider returns to {{formcycle/}}. This value is generated automatically, but can be changed if necessary.
24
25 === Callback URL ===
26
27 URLs for each {{formcycle/}}-Server (master server as well as frontend servers) which can be used when returning from the identity provider to {{formcycle/}}. Each URL can be copied to the clipboard by clicking the copy icon to the right of the URL.
28
29 == Initially visible buttons ==
30
31 Below the base settings there are initially 3 buttons whose functions are intended to help with the configuration of the Facebook identity provider.
32
33 === Send email to provider ===
34
35 Opens the e-mail program set up in the system with a pre-formulated request regarding the information required for the configuration of the identity provider in {{formcycle/}}.
36
37 === Help ===
38
39 Opens this help page in the browser.
40
41 === Add configuration ===
42
43 If the required information has been provided by the identity provider, the area for the configuration of the identity provider can be opened by clicking on this button. Afterwards the area //configuration// which is described below opens.
44
45 {{figure image="saml_configuration_en.png" clear="h2"}}
46 Configuration options for an SAML 2.0 identity provider.
47 {{/figure}}
48
49 == Configuration ==
50
51 * **Upload configuration**: Pressing this button opens a file selection dialog, with which the configuration file supplied by the Identity Provider can be selected. By confirming the selection in the dialog, the file is uploaded.
52
53 * **//FileName.xml//**: After a configuration file has been uploaded and the configuration was saved, it is possible to download the file here. The download is started by clicking on the file name or the {{ficon name="download-circle-outline"/}} symbol.
54
55 === Mapping to user attributes ===
56
57 By clicking on //Mapping to user attributes// the configuration fields for mapping individual attributes can be made visible. SAML attributes can be configured for the following data. In each case, the name of the //saml:attributes// node must be specified.
58
59 * **Given name (firstname)**: first name of the user
60 * **Last name (familyName)**: Last name of the user
61 * **Display name (displayName)**: Display name of the user
62 * **Username (userName)**: User name of the user
63 * **Email (mail)**: Email address of the user
64 * **Language (locale)**: Language of the user
65 * **Location (location)**: Location of the user
66 * **Picture url (pictureUrl)**: Picture URL of the user
67 * **Profile url (profileUrl)**: Profile URL of the user
68
69 {{id name="keystore"/}}
70
71 === Manage keystore ===
72
73 By clicking on //Manage keystore// the settings for the keystore become visible. There are the following two buttons:
74
75 * **Create new keystore**: Creates a new keystore with a new key pair
76 * **Update keystore file**: Opens a file selection dialog with which an existing keystore can be selected and uploaded.
77
78 After uploading your own keystore, the following input fields also appear:
79
80 * **Keystore password**: Password of the keystore
81 * **Keypair password**: Password of the key pair
82
83 {{info}}
84 Own keystores must be Java keystores of type JKS, which contain a corresponding 2048-bit RSA key pair. Such a keystore can be generated, for example, with the utility program keytool for a certificate lifetime of approximately 10 years (3650 days) using the following command: {{code language="none"}}keytool -genkeypair -alias ihr-alias -keypass ihr-passwort -keystore samlKeystore.jks -storepass ihr-passwort -keyalg RSA -keysize 2048 -validity 3650{{/code}}
85 {{/info}}
86
87 {{figure image="saml_extended_settings_en.png" clear="h2"}}
88 Extended settings for configuring an SAML 2.0 identity provider.
89 {{/figure}}
90
91 === Extended settings ===
92
93 With a click on //Extended settings// further parameters for the connection with the Identity Provider can be configured.
94
95 ==== Service provider entity ID ====
96
97 Optional ID for identification against the Identity Provider.
98
99 ==== Force authentication ====
100
101 Specifies whether a user should be forced to log in even if a valid session is still present.
102
103 ==== Passive authentication ====
104
105 Specifies whether an authentication without interaction with the user should be tried.
106
107 ==== User name qualifier ====
108
109 Specifies whether the authentication request should also send the //NameQualifier//. This is not required by the SAML standard, but for some identity providers it is necessary.
110
111 ==== Authentication request signed ====
112
113 Specifies whether the authentication request should be digitally signed.
114
115 ==== Logout request signed ====
116
117 Specifies whether the logout request should be digitally signed.
118
119 ==== Wants assertions signed ====
120
121 Specifies whether the SAML statements (assertions) are requested to be digitally signed.
122
123 ==== Wants response signed ====
124
125 Specifies whether the SAML responses should be digitally signed.
126
127 ==== Max. authentication lifetime (seconds) ====
128
129 Maximum duration of an exisitng login to the identity provider. The default value is {{code language="none"}}3600{{/code}} seconds.
130
131 ==== Max. clock skew (seconds) ====
132
133 Maximum allowed difference in system clock times between the {{fcserver/}} and the identity provider. The default value is {{code language="none"}}300{{/code}} seconds.
134
135 ==== Assertion consumer service index ====
136
137 Specifies the index of the Assertion Consuming Service to be used in the login request. The default value is {{code language="none"}}-1{{/code}}, which is the default of the identity provider.
138
139 ==== Attribute consumer service index ====
140
141 Specifies the index of the attribute consuming services which should be used for the authentication request. The default value is {{code language="none"}}-1{{/code}}, which is the default of the identity provider.
142
143 ==== Authentication request binding type ====
144
145 Specifies the transmission type with which {{formcycle/}} requests a login to the identity provider.
146
147 ==== Response binding type ====
148
149 Specifies the transmission type with which the identity provider responds to a {{formcycle/}} login.
150
151 ==== Logout request binding type ====
152
153 Specifies the transmission type with which {{formcycle/}} requests a logoff from identity provider.
154
155 ==== Logout response binding type ====
156
157 Specifies the transmission type with which the identity provider responds to a logoff from {{formcycle/}}.
158
159 ==== Signature canonicalization algorithm ====
160
161 Specifies the algorithm to be used to convert the signed request into a standardized XML form. {{code language="none"}}http://www.w3.org/2001/10/xml-exc-c14n#{{/code}} is used by default.
162
163 ==== Black listed signature signing algorithms ====
164
165 Algorithms that are forbidden for signing.
166
167 ==== Signature algorithms ====
168
169 Algorithms allowed for signing.
170
171 ==== Signature reference digest methods ====
172
173 Specifies the hash algorithms that are allowed when signing the SAML statements (assertions).
174
175 ==== Download service provider metadata ====
176
177 By clicking on this button, the service metadata is generated as XML based on the previously specified settings and made available as a download.
178 This metadata can then be integrated directly into the respective identity provider.