SAML IdP

To learn more about how Fortified ID Access supports SAML, please click LINK.

Overview

Fortified ID Access can acts as a SAML 2 Identity provider (IdP). This is the first point of contact for a SAML SP. No identification is done by the SAML IdP, that is done by credential validators associated with the SAML IdP.

Configuration

Authenticator type: SAMLIDP

Common Authenticator configuration can be found here.

Properties

Name	Description	Default value	Mandatory
force_re_auth	Regardless of the incoming auth request. Should IdP require re-authentication.	false
idp	Value of the entity id when issuing the assertion.	N/A
assertion_config	Section for when issuing assertion. Customized for one or more SP's. Assertion configuration may also be configured directly on the SAML app. object.	N/A
unsolicited_target_sp	Entity id of SP used for unsolicited authentication.	N/A

Example

Assertion Configuration

Properties

Name	Description	Default value	Mandatory
target_sp	Must include at least one SP entity id. The id must be loaded and known to the system. Use "*" to catch all SP entity ID's.	N/A
pre_assertion_pipe	ID of pipe to execute before issuing assertion. Not required.	N/A
sign_response	Should SAML assertion be signed. Signing is performed using http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	true
sign_assertion	Should SAML assertion be signed. Signing is performed using http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	false
encrypt_assertion	Should assertion be encrypted. Encryption algorithm used is: http://www.w3.org/2009/xmlenc11#aes128-gcm	false
nameid_parameter	Attribute where value of nameID is located.	N/A
name_id_format	Format of nameID attribute.	"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
additional_attribute_parameter	List of parameter names where additional attributes is located.	N/A
auth_context_parameter	Attribute where value of auth context ref is located.	"AuthnContextClassRef"
hokap_parameter	Attribute where value of certificate is located. PEM format is expected. The public key is extracted from the certificate and added to the KeyValue element in the assertion. Only RSA public keys are supported.	N/A
send_failed_response	If pipe fails should a SAML response be sent back to the sp.	false
custom_identifier	Identifier used in event logging to differentiate event logg entries.	N/A

Example

Logging

On authentication request event is logged containing following:

• WEB_100103("Received authentication request")

• IDENTIFIER (user traceid)

• AUTHENTICATOR_ID (config id + display_name if present)

• SOURCE_SERVICE_NAME (entity id calling SAML SP)

• SOURCE_ADDRESS (user IP address)

• CUSTOMER_IDENTIFIER (if configured)

On a successful authentication event is logged containing following:

• WEB_100101

• IDENTIFIER (user traceid)

• AUTHENTICATOR_ID (config id + display_name if present)

• SOURCE_SERVICE_NAME (entity id of target SAML SP)

• SOURCE_ADDRESS (user IP address)

• CUSTOMER_IDENTIFIER (if configured)

On a failed authentication event is logged containing following:

• WEB_100102

• IDENTIFIER (user traceid)

• AUTHENTICATOR_ID (config id + display_name if present)

• SOURCE_SERVICE_NAME (entity id of target SAML SP)

• SOURCE_ADDRESS (user IP address)

• CUSTOMER_IDENTIFIER (if configured)

SLO - Single logout

By default saml slo endpoints are added to the metadata template. Both POST & Redirect bindings are supported and will be injected into the metadata when requested.

Currently, only POST binding is supported for outbound request/reponse.

Data sent to PIPE

All data put into the shared authentication state along with the HTTP headers are exposed and sent into the pipe.

Data put into the state by this authenticator is:

• SAMLRequest - mainly for internal use

• requestedAuthnContextClassRefs - Multi value property of the "RequestedAuthnContext" -> "AuthnContextClassRef" if any.

• spEntityID - entityID of the "calling" SP .

• A subset of the sent request-headers from user-Agent.

• All data returned from the assertion pipe

Expected data from PIPE

In order to use data from PIPE the response must contain one item. All data from that item will be available when creating SAML assertion.