Connect a Service Provider using SAMLP
You can use a SAML-P Service provider to connect to The Identity Hub.
A. Create an App
- Create an App for your application. See Create an App for details.
- Go to the WS-Federation and SAML-P parameters section and fill out the different parameters based on the SAML-P metadata (see next steps) you have received for the app:
- Set the Relying Party (~ SAML-P Issuer) to reflect the entityID attribute in the EntityDescriptor node
- Add the SAML-P Assertion Consumer Endpoints according to the Bindings attributes of the AssertionConsumerService node as found in the SSPSSODescriptor node;
Supported is Http-Post - Set the SingleLogout Service Url based on the Location attribute of the SingleLogOutService node and its Protocol Binding
- Open the App Certificates node and upload the Service Provider Signing and Encryption Certificate
6.1. Extract the dsig:X509Certificate and save it to a local .cer file on your desktop
6.2. Upload the certificate to the App - Decide if this app will Use the Tenant Token Signing certificate or not. If not: upload a separate certificate
- Set the Secure Hash Algorithm
Note
It might be that your tenant settings do not allow to use self-signed certificates.
B. Download the SAML-P metadata to exchange with the Service Provider
- Navigate to the Apps list (https://www.theidentityhub.com/{tenant}/Admin/App) and select the application you are connecting.
- Open the SAML-P Service Providers section (you might need to scroll down to find the section) and click the download link for the Metadata document.
- Provide this metadata to your contact implementing the Service Provider