SAML Broker

To learn more about how Fortified ID Access supports SAML, please click LINK.

Overview

This authenticator acts as a SAML Broker (sometimes also referred to as an IdP proxy).

Typically used in SAML brokering scenarios when one or more methods of identification reside on a remote IdP.
Note. Fortified ID Access has native authenticators for some remote IdPs, for example Swedish BankID and Freja. However, if you use BankID or Freja through a third-party provider, you need to configure them using a SAML Broker.

Configuration

Note

Authenticator type: SAMLSPBroker

Common Authenticator configuration can be found here.

Properties

Name	Description	Default value	Mandatory
issue_as_sp_entity	When sending authentication request, what is the entity id used.	N/A	true
target_idp_entity	The remote IDP entity id to trust.	N/A	true
custom_identifier	Custom identifier to be set in the event logging entry	N/A	false
force_auth_request	Should the auth request force re-authentication	false	false
sign_algorithm	Which signature algorithm to use if signing authn-requests. Ensure it is working with the private key used. This will only affect requests sent to idp's requiring signing requests.	http://www.w3.org/2001/04/xmldsig-more#rsa-sha256	false
sign_digest_method	Which digest method to use if signing authn-requests. Ensure it is working with the selected signature algorithm. This will only affect requests sent to idp's requiring signing requests.	http://www.w3.org/2001/04/xmlenc#sha256	false
validate_in_response_to	Optional validation rule (true/false)	false	false
validate_audience_restrictions	Optional validation rule (true/false)	false	false
validate_destination	Optional validation rule (true/false)	false	false
validate_authn_instant	Optional validation rule (true/false)	false	false
validate_session_timestamp	Optional validation rule (true/false)	false	false
skew_time_seconds	Maximum acceptable time difference (seconds)	60	false
authn_context_class_ref	Value sent in AuthnContextClassRef	N/A	false
cache_ttl_seconds	Time to live for the cache	300	false
allowed_authn_context_class_ref	When requesting authn_context_class_ref, comparison is done with exact match. Use this parameter to allow other return values. Configure as array: "allowed_authn_context_class_ref":["xxx","yyy"]	N/A	false

Example

{
    "id": "sp",
    "type": "SAMLSPBroker",
    "config": {
        "base_path": "/saml/authn",
        "issue_as_sp_entity":"https://your_sp_entity",
        "target_idp_entity":"https://your_target_idp_entity"
    }
}

• The incoming SAML response must be signed.
• Signed assertion is not validated.
• Encrypted assertion is not supported.

Validation

The SAML response from the IdP is validated according to a set of rules. Some rules are mandatory and always validated, other rules are optional and can be activated in the configuration.

Mandatory validation rules

• Response Issuer must match target_idp_entity
• There must be at least one valid signature present
• Response status must indicate success
• Response issue timestamp (not before current timestamp)
• Assertion NotBefore timestamp
• Assertion NotOnOrAfter timestamp

Optional validation rules

• Ensure the response matches a pending request by ID
• Response destination
• Audience restrictions
• Assertion AuthnInstant
• Assertion SessionNotOnOrAfter
• AuthContextClassRef, "equals" or "any of"

Logging

On request sent to remote IDP:

• WEB_100027("Sent auth request to remote IDP")
• IDENTIFIER (user traceid)
• SOURCE_SERVICE_NAME (entity id from requesting SP)
• SOURCE_ADDRESS (user IP address)
• AUTHENTICATOR_ID, Configured id and display_anme
• CUSTOMER_IDENTIFIER (if configured)

On a successful authentication event is logged containing the following:

• WEB_100014("Authenticated using SP-broker method")
• IDENTIFIER (user traceid)
• SOURCE_SERVICE_NAME (entity id from the SAML response)
• SOURCE_USER_NAME (name id from the issued assertion)
• SOURCE_ADDRESS (user IP address)
• AUTHENTICATOR_ID, Configured id and display_anme
• CUSTOMER_IDENTIFIER (if configured)
• All attributes in the incoming assertion with value(s). Multivalued attributes att joined using comma ",".

On a failed response from remote IDP

• WEB_100026("Authenticated failed using SP-broker method")
• IDENTIFIER (user traceid)
• SOURCE_SERVICE_NAME (entity id from the SAML response)
• SOURCE_ADDRESS (user IP address)
• AUTHENTICATOR_ID, Configured id and display_anme
• CUSTOMER_IDENTIFIER (if configured)

SAML response requirements

When consuming and validating the response only one assertion is allowed. Either response or assertion must be signed. No signatures will produce error.

Caution

Currently, only POST binding is supported for outbound and incoming request/response.

Data exposed to global state

After successful validation, data stored in the global state are:

• nameID - containing the name-id reported in the assertion.
• remoteIssuer - value of the IDP entityID issuing the assertion.
• All additional attributes from the assertion. Multivalued attributes are merged into a comma-separated string. FriendlyName is favoured over Name.
  • if an incoming attribute with Name urn:oid:2.5.4.42 and FriendlyName givenName, givenName is used as key in global state.
  • If no FriendlyNAme attribute is present Name is used.