SAML application

This section explains how to manage a SAML trusted application.

When a SAML SP is added to Fortified ID Access, it is represented as a SAML trusted application. On the SAML application object, you specify where the metadata is located, what assertion data to needed, whether a profile should be used, etc.

A SAML application relies on metadata configuration to establish trust. Valid metadata is the minimum requirement. Each metadata element may also specify custom settings to enable tailored behaviour.

Using configuration, the SAML application object can control:

• Metadata (names, description, URL, IdP affiliation).

• Cryptography (signing and digest algorithms, encryption of assertions).

• Session handling (timeouts, session information, client IP address).

• NameID handling (format, source parameters, qualifiers).

• Attributes (which attributes are returned, their format, requirements, and types).

This allows each application to precisely define how its SAML Response is constructed and returned.

Note. If you have several SAML applications that should have similar configuration, you can use SAML profiles. Click the following link for more information about SAML Profiles.

Settings for a SAML application can come from settings on the SAML application itself, or from a SAML profile, or from the IdP object. 1. If a profile is configured, the properties of the profile object will override everything else. 2. If a profile is not configured, the application settings will apply. 3. If nothing is configured on the application, the IdP settings will be used. Important! Settings are not merged but applied as a single source of truth.

---

Below are the properties that can be configured for a SAML application.

Properties

Name	Description	Default value	Mandatory
url	URL location of metadata	N/A
path	File path to metadata	N/A
assertion_pre_pipe	Overrides IDP default prepipe empty means NO pipe. IDP pipe is not used as fallback.	N/A
belongs_to_idp	entity id of allowed IDP. Only use if configuring multiple IDP's	N/A
signature_algorithm	Algorithm used for signing.	ttp://www.w3.org/2001/04/xmldsig-more#rsa-sha256
digest_algorithm	Algorithm used for digest calculation.	http://www.w3.org/2001/04/xmlenc#sha256
static_audience	Overrides SP audience.	N/A
include_entity_id	If multiple entities are in meta data. Array of entity id's to trust.	N/A
exclude_entity_id	If multiple entities are in meta data. Array of entity id's to filter out. Settings this will override include_entity_id.	N/A
profile	Name of a SAML application profile. Settings this will render local app-settings useless.	N/A
app_tag	JsonArray containing strings used for filtering and similar operations.	N/A
assertion_config	Parent holder for assertion configuration.	{}
assertion_config.encrypt	Whether the assertion should be encrypted. Requires encryption certificate in SP meta data	false
assertion_config.include_session_information	Include session information in the assertion (trace id).	true
assertion_config.include_session_not_on_or_after	Include the SessionNotOnOrAfter attribute.	false
assertion_config.include_remote_address	Include the client’s IP address.	false
assertion_config.sign_assertion	Whether the assertion itself should be signed.	true
assertion_config.sign_response	Whether the full response should be signed.	true
assertion_config.session_not_on_or_after_minutes	Session expiration time in minutes.	60
assertion_config.assertion_valid_for_no_of_minutes	Assertion validity period in minutes.	2
assertion_config.name_id	Configuration of the NameID element.	{}
assertion_config.name_id.format	NameID format	urn:oasis:names:tc:SAML:1.1:nameid-format:transient
assertion_config.name_id.from_parameter	State parameter containing value of Name ID	nameID
assertion_config.name_id.include_sp_name_qualifier	Whether to include SPNameQualifier.	false
assertion_config.name_id.include_name_qualifier	Whether to include NameQualifier.	false
assertion_config.attributes	Each entry in attributes describes one attribute in the assertion	N/A
assertion_config.attributes.name	Attribute name (URN or custom identifier).	N/A
assertion_config.attributes.value	Name of the state attribute holding the value.	N/A
assertion_config.attributes.name_format	Attribute name format, usually unspecified.	urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
assertion_config.attributes.friendly_name	Human-readable (friendlyName) alias.	N/A
assertion_config.attributes.required	Indicates if the attribute is required. If true value may be empty	false
assertion_config.attributes.include_if_empty	Include the attribute even if the source value is missing value	false

Example (native)

Example (using profile)