SAML IDP

About

Acts as a SAML 2 Identity provider. No identification is done by this authenticator. It acts as a controller for issuing SAML assertions. Typically this authenticator is the first point of contact coming from a SAML Service provider, requesting identification.

This authenticator can be considered a start and end touch point. The main purpose is to handle SAML specifics.

Actual user identification is done elsewhere.

SAML data arrives from SAML Service provider

Configuration

Authenticator type: SAMLIDP

Common Authenticator configuration can be found here.

Properties

Name	Description	Default value	Mandatory
force_re_auth	Regardless of the incoming auth request. Should IDP require re-authentication.	false
idp	Value of the entity id when issuing the assertion.	N/A
assertion_config	Section for when issuing assertion. Customized for one or more SP's.	N/A

Example

{
"id": "auth00",
"type": "SAMLIDP",
"config": {
    "context_path": "/test/authn/chain",
    "base_path": "/test/authn",
    "force_re_auth": false,
    "idp": "aandrenidp",
    "chain": [{
        "id": "auth01",
        "required": true
    }],
    "assertion_config": [{
        "target_sp": ["https://sp.example.org/shibboleth", "https://samltest.id/saml/sp"],
        "pre_assertion_pipe": "auhtZPipe",
        "encrypt_assertion": false,
        "sign_response": false,
        "sign_assertion": true,
        "send_failed_response":false
        "name_id_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
        "nameid_parameter": "givenName",
        "additional_attribute_parameter": ["givenName", "sn", "objectClass"],
        "auth_context_parameter": "AuthnContextClassRef"
    }]
}
}

Assertion Configuration

Properties

Name	Description	Default value	Mandatory
target_sp	Must include at least one SP entity id. The id must be loaded and known to the system. Use "*" to catch all SP entity ID's.	N/A
pre_assertion_pipe	ID of pipe to execute before issuing assertion. Not required.	N/A
sign_response	Should SAML assertion be signed. Signing is performed using http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	true
sign_assertion	Should SAML assertion be signed. Signing is performed using http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	false
encrypt_assertion	Should assertion be encrypted. Encryption algorithm used is: http://www.w3.org/2009/xmlenc11#aes128-gcm	false
nameid_parameter	Attribute where value of nameID is located.	N/A
name_id_format	Format of nameID attribute.	"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
additional_attribute_parameter	List of parameter names where additional attributes is located.	N/A
auth_context_parameter	Attribute where value of auth context ref is located.	"AuthnContextClassRef"
hokap_parameter	Attribute where value of certificate is located. PEM format is expected. The public key is extracted from the certifiacted and added to the KeyValue element in the assertion. Only RSA public keys are supported.	N/A
send_failed_response	If pipe fails should a SAML response be sent back to the sp.	false

Example

"assertion_config": [{
    "target_sp": ["https://sp.example.org/shibboleth", "https://samltest.id/saml/sp"],
    "pre_assertion_pipe": "auhtZPipe",
    "encrypt_assertion": false,
    "sign_response": false,
    "sign_assertion": true,
    "send_failed_response":false
    "name_id_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
    "nameid_parameter": "givenName",
    "additional_attribute_parameter": ["givenName", "sn", "objectClass"],
    "auth_context_parameter": "AuthnContextClassRef"
}]

Logging

On a successful authentication event is logged containing following:

• WEB_100101

• IDENTIFIER (user traceid)

• DESTINATION_SERVICE_NAME (target SP entity id)

• SOURCE_ADDRESS (user IP address)

SLO - Single logout

By default saml slo endpoints are added to the metadata template. Both POST & Redirect bindings are supported and will be injected into the metadata when requested.

Currently, only POST binding is supported for outbound request/reponse.

Data sent to PIPE

All data put into the shared authentication state along with exposed HTTP headers and "remoteAddress".

Data stored in global state

• SAMLRequest - mainly for internal use

• RelayState (if any) - mainly for internal use

• Signature (if any) - mainly for internal use

• httpMethod - mainly for internal use

• requestedAuthnContextClassRefs - mainly for internal use

• firstKnownLogin - manily for internal use

• spEntityID

• isPassive - mainly for internal use

• assertedDestination - mainly for internal use

• All data returned from the assertion pipe

Expected data from PIPE

In order to use data from PIPE the response must contain one item. All data from that item will be available when creating SAML assertion.

References made to data not present will result in omitting data in SAML assertion for additional attributes.

Missing data for nameID will cause the flow to fail unless nameID is configured to be transient.