SAML-P Account Provider
The Identity Hub supports all identity providers that support SAML-P protocol. To allow users to sign in with your SAML-P enabled identity provider:
- Set up and configure a Service Provider (Relying Party) on the identity provider
- Activate a SAML-P Account Provider (see Activate an Account Provider)
- Set the configuration parameters on the SAML-P Account Provider
Configure a SAML-P Account Provider
To configure a SAML-P Account Provider you have two options:
- Supply the metadata of the identity provider via a URL or file.
- Configure the parameters manually.
Supply the metadata of the identity provider via a URL or file.
- In Federation Metadata URL type the URL where the metadata of the identity provider is available or select a file in Federation Metadata file.
- On the General tab set a Name.
- On the Service Provider tab select a Service Provider Certificate and type the certificate password in the Service Provider Certificate Password.
- Click Save.
For more information on other configuration parameters see Specific configuration parameters for the SAML-P Account Provider
Configure the parameters manually.
For more information on the configuration parameters see Specific configuration parameters for the SAML-P Account Provider
Configure a Service Provider on the identity provider
Specific configuration steps depend on the type of SAML-P identity provider. After activation of the SAML-P Account Provider the identity provider can use the metadata (Metadata document parameter of the General tab) to configure the Service Provider.
Specific configuration parameters for the SAML-P Account Provider
The following parameters are required as a minimum:
- The Service Provider Certificate on the Service Provider tab.
- The Sign On Endpoint Url on the Identity Provider tab.
For more information on the parameters see the SAML specification
General
| Parameter | Description |
|---|---|
| Metadata document | The URL to the metadata file of the SAML-P Account Provider. |
Service Provider
| Parameter | Description |
|---|---|
| Service Provider Identifier | The unique identifier of the Account Provider available after activation. Will be used as Entity Id. See also Service Provider Entity Id Advanced parameter. |
| Assertion Consumer Endpoint URL | This is always https://www.theidentityhub.com/{tenant}/authenticate/processaccountproviderresponse |
| Assertion Consumer Endpoint Protocol Binding | Http-Post and Http-Artifact binding are supported. |
| Single Log Out Response Endpoint URL | This is always https://www.theidentityhub.com/{tenant}/samlp/signout |
| Service Provider Certificate | The certificate used to sign Authentication Requests and to decrypt Authentication Responses and Assertions. |
Identity Provider
| Parameter | Description |
|---|---|
| Federation Metadata URL | The URL of the metadata of the SAML-P Identity Provider. If provided this URL will be queried for configuration during SAML-P Account Provider activation and also each time the SAML-P Account Provider is edited. |
| Federation Metadata File | The file with the metadata of the SAML-P Identity Provider. If provided will be used to configure the SAML-P Account Provider. |
| Sign On Endpoint URL | Sign On Endpoint URL of the identity provider. |
| Sign On Endpoint Protocol Binding | Http-Post and Http-Redirect binding are supported. |
| Single Log Out Endpoint URL | Sign Log Out Endpoint URL of the identity provider. |
| Sign Log Out Endpoint Protocol Binding | Http-Post and Http-Redirect binding are supported. |
| Artifact Endpoint URL | Artifact Endpoint URL of the identity provider. Required when the Assertion Consumer Endpoint Protocol Binding is set to Http-Artifact. |
| Artifact Endpoint Requires Client Certificate Authentication | To perform client certificate authentication using the Service Provider Certificate when calling the Artifact Endpoint URL. |
| Compensate for IOS/Safari Cookie limits | Safari on IOS imposes limitations on the size of the cookies. To prevent issues The Identity Hub will use Http-Redirect protocols instead of the configured protocols when needed. |
| Unique Identity Assertion Attribute Name | When set The Identity Hub will use the specified Assertion attribute as unique identifier of the authenticated identity. |
| Identity Provider Certificate (Primary) | The primary certificate used by the identity provider to sign the Authentication Responses and Assertions. |
| Identity Provider Certificate (Secondary) | The secondary certificate used by the identity provider to sign the Authentication Responses and Assertions. Used for rollover scenario when the primary certificate is about to expire. |
Claim Mappings
By default no incoming claims are mapped except http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name and the http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier claim.
To map all incoming claims (even those not specified in the claim mappings) uncheck Remove all incoming claims that are not mapped.
| Parameter | Description |
|---|---|
| Remove all incoming claims that are not mapped | Only explicitly mapped incoming claims by type and value (when specified) are mapped. All other incoming claims are ignored. |
| Source claim | The type of the incoming claim to be mapped. |
| Source claim value (optional) | The value of the incoming claim type to be mapped. When omitted all incoming claims of the type will be mapped. |
| Destination claim | The claim type to map the incoming claim to. |
| Destination claim value | The claim value to set for the mapped incoming claim. When omitted the value of the incoming claim is used. |
Advanced
| Parameter | Description |
|---|---|
| Secure Hash Algorithm | The hash algorithm to use when encrypting, signing, decrypting based on the Service Provider Certificate. |
| Secondary Secure Hash Algorithm | The hash algorithm to use as an alternative when encrypting, signing, decrypting based on the Service Provider Certificate fails using the Secure Hash Algorithm. |
| Maximum allowed clock skew | Allowed clock skew when validating time constraints for responses received from the identity provider. |
| Name Id Policy Format | The Name Id Policy format to request when sending an Authentication Request to the identity provider. |
| Service Provider Entity Id | The Entity Id used when sending an Authentication Request to the identity provider. When specified this value is used instead of the Service Provider Identifier. |
| Authn Context Class Reference | The Authn Context Class Reference used when sending an Authentication Request to the identity provider. |
| Authn Context Comparison | The Authn Context Comparison used when sending an Authentication Request to the identity provider. |
| Assertions must be signed | Whether or not the Assertions in the Authentication Response must be signed. |
| Single log out request must be signed | Whether or not the Single Log Out Request must be signed. |
| Use embedded certificates | Whether or not to use embedded certificates to validate Authentication Responses and Assertions. |
| Sign on response must be signed | Whether or not the Authentication Response must be signed. |
| Single log out response must be signed | Whether or not the Single Log Out Response must be signed. |
| Max-Age | See Account Providers Max-Age |
Related
Amazon Account Provider
Activate an Account Provider
Built-in Username and Password Account Provider
Custom Account Providers)
Facebook Account Provider
GitHub Account Provider
Google Account Provider
Instagram Account Provider
LinkedIn Account Provider
Microsoft Account Provider
PayPal Account Provider
SAML-P Account Provider
StackExchange Account Provider
Twitter Account Provider
WS-Federation Account Provider