> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/saml/saml-broker.md).

# SAML Broker

Fortified ID can act as a SAML Broker (sometimes also referred to as an IdP proxy).

To learn more about how Fortified ID Access supports SAML, please click [LINK](/access/key-components/modules/saml.md).

## Overview

This authenticator acts as a SAML Broker (sometimes also referred to as an IdP proxy).

Typically used in SAML brokering scenarios when one or more methods of identification reside on a remote IdP.\
Note. Fortified ID Access has native authenticators for some remote IdPs, for example [Swedish BankID](/access/key-components/authenticators/credential-validators/bankid.md) and [Freja](/access/key-components/authenticators/credential-validators/freja-e-id.md). However, if you use BankID or Freja through a third-party provider, you need to configure them using a SAML Broker.

## Configuration

{% hint style="info" %}
**Authenticator type:** `SAMLSPBroker`
{% endhint %}

Common Authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>issue_as_sp_entity</code></td><td>When sending authentication request, what is the entity id used.</td><td>N/A</td><td>true</td></tr><tr><td><code>target_idp_entity</code></td><td>The remote IDP entity id to trust.</td><td>N/A</td><td>true</td></tr><tr><td><code>custom_identifier</code></td><td>Custom identifier to be set in the event logging entry</td><td>N/A</td><td>false</td></tr><tr><td><code>force_auth_request</code></td><td>Should the auth request force re-authentication</td><td>false</td><td>false</td></tr><tr><td><code>sign_algorithm</code></td><td>Which signature algorithm to use if signing authn-requests. Ensure it is working with the private key used. <strong>This will only affect requests sent to idp's requiring signing requests.</strong></td><td><a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256%22">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a></td><td>false</td></tr><tr><td><code>sign_digest_method</code></td><td>Which digest method to use if signing authn-requests. Ensure it is working with the selected signature algorithm. <strong>This will only affect requests sent to idp's requiring signing requests.</strong></td><td><a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a></td><td>false</td></tr><tr><td><code>validate_in_response_to</code></td><td>Optional validation rule (true/false)</td><td>false</td><td>false</td></tr><tr><td><code>validate_audience_restrictions</code></td><td>Optional validation rule (true/false)</td><td>false</td><td>false</td></tr><tr><td><code>validate_destination</code></td><td>Optional validation rule (true/false)</td><td>false</td><td>false</td></tr><tr><td><code>validate_authn_instant</code></td><td>Optional validation rule (true/false)</td><td>false</td><td>false</td></tr><tr><td><code>validate_session_timestamp</code></td><td>Optional validation rule (true/false)</td><td>false</td><td>false</td></tr><tr><td><code>skew_time_seconds</code></td><td>Maximum acceptable time difference (seconds)</td><td>60</td><td>false</td></tr><tr><td><code>authn_context_class_ref</code></td><td>Value sent in AuthnContextClassRef</td><td>N/A</td><td>false</td></tr><tr><td><code>cache_ttl_seconds</code></td><td>Time to live for the cache</td><td>300</td><td>false</td></tr><tr><td><code>allowed_authn_context_class_ref</code></td><td>When requesting authn_context_class_ref, comparison is done with exact match. Use this parameter to allow other return values. Configure as array: "<code>allowed_authn_context_class_ref</code>":["xxx","yyy"]</td><td>N/A</td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
    "id": "sp",
    "type": "SAMLSPBroker",
    "config": {
        "base_path": "/saml/authn",
        "issue_as_sp_entity":"https://your_sp_entity",
        "target_idp_entity":"https://your_target_idp_entity"
    }
}
```

{% endtab %}
{% endtabs %}

##

* The incoming SAML response must be signed.
* Signed assertion is not validated.
* Encrypted assertion is not supported.

## Validation

The SAML response from the IdP is validated according to a set of rules. Some rules are mandatory and always validated, other rules are optional and can be activated in the configuration.

#### Mandatory validation rules

* Response Issuer must match `target_idp_entity`
* There must be at least one valid signature present
* Response status must indicate success
* Response issue timestamp (not before current timestamp)
* Assertion NotBefore timestamp
* Assertion NotOnOrAfter timestamp

#### Optional validation rules

* Ensure the response matches a pending request by ID
* Response destination
* Audience restrictions
* Assertion AuthnInstant
* Assertion SessionNotOnOrAfter
* AuthContextClassRef, "equals" or "any of"

## Logging

On request sent to remote IDP:

* WEB\_100027("Sent auth request to remote IDP")
* IDENTIFIER (user traceid)
* SOURCE\_SERVICE\_NAME (entity id from requesting SP)
* SOURCE\_ADDRESS (user IP address)
* AUTHENTICATOR\_ID, Configured id and display\_anme
* CUSTOMER\_IDENTIFIER (if configured)

On a successful authentication event is logged containing the following:

* WEB\_100014("Authenticated using SP-broker method")
* IDENTIFIER (user traceid)
* SOURCE\_SERVICE\_NAME (entity id from the SAML response)
* SOURCE\_USER\_NAME (name id from the issued assertion)
* SOURCE\_ADDRESS (user IP address)
* AUTHENTICATOR\_ID, Configured id and display\_anme
* CUSTOMER\_IDENTIFIER (if configured)
* All attributes in the incoming assertion with value(s). Multivalued attributes att joined using comma ",".

On a failed response from remote IDP

* WEB\_100026("Authenticated failed using SP-broker method")
* IDENTIFIER (user traceid)
* SOURCE\_SERVICE\_NAME (entity id from the SAML response)
* SOURCE\_ADDRESS (user IP address)
* AUTHENTICATOR\_ID, Configured id and display\_anme
* CUSTOMER\_IDENTIFIER (if configured)

## SAML response requirements

When consuming and validating the response only one assertion is allowed. Either response or assertion must be signed. No signatures will produce error.

{% hint style="warning" %}
**Currently, only POST binding is supported for outbound and incoming request/response.**
{% endhint %}

## Data exposed to global state

After successful validation, data stored in the global state are:

* nameID - containing the name-id reported in the assertion.
* remoteIssuer - value of the IDP entityID issuing the assertion.
* All additional attributes from the assertion. Multivalued attributes are merged into a comma-separated string. FriendlyName is favoured over Name.
  * if an incoming attribute with Name *urn:oid:2.5.4.42* and FriendlyName *givenName,* givenName is used as key in global state.
  * If no FriendlyNAme attribute is present Name is used.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/protocol-managers/saml/saml-broker.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.