1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title></title>
<!-- metadata -->
<meta name="generator" content="Offline" />
<meta name="version" content="Offline 0.1" />
<!-- style sheet links -->
<link rel="stylesheet" media="all" type="text/css" href="../../../css/all.css" />
<link rel="stylesheet" media="screen" type="text/css" href="../../../css/screen.css" />
<link rel="stylesheet" media="print" type="text/css" href="../../../css/print.css" />
</head>
<body>
<div class="dokuwiki export">
<h1><a name="saml_service_configuration" id="saml_service_configuration">SAML service configuration</a></h1>
<div class="level1">
<p>
<p><div class="noteclassic"><acronym title="Security Assertion Markup Language">SAML</acronym> service configuration is a common step to configure <acronym title="LemonLDAP::NG">LL::NG</acronym> as <a href="../../documentation/1.3/authsaml.html" class="wikilink1" title="documentation:1.3:authsaml">SAML SP</a> or <a href="../../documentation/1.3/idpsaml.html" class="wikilink1" title="documentation:1.3:idpsaml">SAML IDP</a>.
</div></p>
</p>
</div>
<!-- SECTION "SAML service configuration" [1-169] -->
<h2><a name="presentation" id="presentation">Presentation</a></h2>
<div class="level2">
<p>
This documentation explains how configure <acronym title="Security Assertion Markup Language">SAML</acronym> service in <acronym title="LemonLDAP::NG">LL::NG</acronym>, in particular:
</p>
<ul>
<li class="level1"><div class="li"> Install prerequisites</div>
</li>
<li class="level1"><div class="li"> Import or generate security keys</div>
</li>
<li class="level1"><div class="li"> Set <acronym title="Security Assertion Markup Language">SAML</acronym> end points</div>
</li>
</ul>
<p>
<p><div class="noteimportant">Service configuration will be used to generate <acronym title="LemonLDAP::NG">LL::NG</acronym> <acronym title="Security Assertion Markup Language">SAML</acronym> metadata, that will be shared with other providers. It means that if you modify some settings here, you will have to share again the metadata with other providers. In other words, take the time to configure this part before sharing metadata.
</div></p>
</p>
</div>
<!-- SECTION "Presentation" [170-689] -->
<h2><a name="prerequisites" id="prerequisites">Prerequisites</a></h2>
<div class="level2">
</div>
<!-- SECTION "Prerequisites" [690-716] -->
<h3><a name="lasso" id="lasso">Lasso</a></h3>
<div class="level3">
<p>
<a href="/_detail/documentation/lasso.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:lasso.png"><img src="../../../media/documentation/lasso.png" class="mediacenter" alt="" /></a>
</p>
<p>
SAML2 implementation is based on <a href="http://lasso.entrouvert.org" class="urlextern" title="http://lasso.entrouvert.org" rel="nofollow">Lasso</a>. You will need a very recent version of Lasso (>= 2.3.0).
</p>
</div>
<h4><a name="debianubuntu" id="debianubuntu">Debian/Ubuntu</a></h4>
<div class="level4">
<p>
There are packages available here: <a href="http://deb.entrouvert.org/" class="urlextern" title="http://deb.entrouvert.org/" rel="nofollow">http://deb.entrouvert.org/</a>.
</p>
<p>
You will only need to install liblasso3-perl package:
</p>
<pre class="code">
sudo apt-get install liblasso3-perl
</pre>
</div>
<h4><a name="rhelcentosfedora" id="rhelcentosfedora">RHEL/CentOS/Fedora</a></h4>
<div class="level4">
<p>
RPMs are available at
<a href="http://repo.cyrus-project.org/centos$releasever-$basearch/RPMS.cyrus-extras/" class="urlextern" title="http://repo.cyrus-project.org/centos$releasever-$basearch/RPMS.cyrus-extras/" rel="nofollow">http://repo.cyrus-project.org/centos$releasever-$basearch/RPMS.cyrus-extras/</a>
</p>
<p>
<p><div class="notetip">Fill $releasever and $basearch with the correct values to get packages for your environment, for example <a href="http://repo.cyrus-project.org/centos5-i386/RPMS.cyrus-extras/" class="urlextern" title="http://repo.cyrus-project.org/centos5-i386/RPMS.cyrus-extras/" rel="nofollow">http://repo.cyrus-project.org/centos5-i386/RPMS.cyrus-extras/</a>
</div></p>
</p>
<p>
Then install lasso and lasso-perl packages.
</p>
</div>
<h4><a name="other" id="other">Other</a></h4>
<div class="level4">
<p>
<a href="http://lasso.entrouvert.org/download/" class="urlextern" title="http://lasso.entrouvert.org/download/" rel="nofollow">Download the Lasso tarball</a> and compile it on your system.
</p>
</div>
<!-- SECTION "Lasso" [717-1651] -->
<h3><a name="apache_rewrite_rules" id="apache_rewrite_rules">Apache rewrite rules</a></h3>
<div class="level3">
<p>
Be sure that mod_rewrite is installed and that SAML2 rewrite rules are activated in <a href="../../documentation/1.3/configlocation.html#portal" class="wikilink1" title="documentation:1.3:configlocation">Apache portal configuration</a>:
</p>
<pre class="code file apache"><<span class="kw3">IfModule</span> mod_rewrite.c>
<span class="kw1">RewriteEngine</span> <span class="kw2">On</span>
<span class="kw1">RewriteRule</span> ^/saml/metadata /metadata.pl
<span class="kw1">RewriteRule</span> ^/saml/.* /index.pl
</<span class="kw3">IfModule</span>></pre>
</div>
<!-- SECTION "Apache rewrite rules" [1652-1997] -->
<h2><a name="service_configuration" id="service_configuration">Service configuration</a></h2>
<div class="level2">
<p>
Go in Manager and click on <code><acronym title="Security Assertion Markup Language">SAML</acronym> 2 Service</code> node.
</p>
<p>
<p><div class="notetip">You can use #PORTAL# in values to replace the portal <acronym title="Uniform Resource Locator">URL</acronym>.
</div></p>
</p>
</div>
<!-- SECTION "Service configuration" [1998-2161] -->
<h3><a name="entry_identifier" id="entry_identifier">Entry Identifier</a></h3>
<div class="level3">
<p>
Your EntityID, often use as metadata <acronym title="Uniform Resource Locator">URL</acronym>, by default #PORTAL#/saml/metadata.
</p>
<p>
<p><div class="noteclassic">
The value will be use in metadata main markup:
</p>
<pre class="code file xml"><span class="sc3"><span class="re1"><EntityDescriptor</span> <span class="re0">entityID</span>=<span class="st0">"http://auth.example.com/saml/metadata"</span><span class="re2">></span></span>
...
<span class="sc3"><span class="re1"></EntityDescriptor<span class="re2">></span></span></span></pre>
<p>
</div></p>
</p>
<p>
<p><div class="notewarning">If you modify <code>/saml/metadata</code> suffix you have to change corresponding Apache rewrite rule.
</div></p>
</p>
</div>
<!-- SECTION "Entry Identifier" [2162-2559] -->
<h3><a name="security_parameters" id="security_parameters">Security parameters</a></h3>
<div class="level3">
<p>
You can define keys for <acronym title="Security Assertion Markup Language">SAML</acronym> message signature and encryption. If no encryption keys are defined, signature keys are used for signature and encryption.
</p>
<p>
To define keys, you can:
</p>
<ul>
<li class="level1"><div class="li"> import your own private and public keys (<code>Load from a file</code> input)</div>
</li>
<li class="level1"><div class="li"> generate new public and private keys (<code>Generate</code> button)</div>
</li>
</ul>
<p>
<p><div class="notetip">You can enter a password to protect private key with a password. It will be prompted if you generate keys, else you can set it in the <code>Private key password</code>.
</div></p>
</p>
<p>
<a href="/_detail/documentation/manager-saml-private-key.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:manager-saml-private-key.png"><img src="../../../media/documentation/manager-saml-private-key.png" class="mediacenter" alt="" /></a>
</p>
<p>
<p><div class="notetip">You can import a certificate containing the public key instead the raw public key. However, certificate will not be really validated by other <acronym title="Security Assertion Markup Language">SAML</acronym> components (expiration date, common name, etc.), but will just be a public key wrapper.
</div></p>
</p>
</div>
<!-- SECTION "Security parameters" [2560-3388] -->
<h3><a name="nameid_formats" id="nameid_formats">NameID formats</a></h3>
<div class="level3">
<p>
<a href="/_detail/documentation/manager-saml-namid-formats.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:manager-saml-namid-formats.png"><img src="../../../media/documentation/manager-saml-namid-formats.png" class="mediacenter" alt="" /></a>
</p>
<p>
<acronym title="Security Assertion Markup Language">SAML</acronym> can use different NameID formats. The NameID is the main user identifier, carried in <acronym title="Security Assertion Markup Language">SAML</acronym> messages. You can configure here which field of <acronym title="LemonLDAP::NG">LL::NG</acronym> session will be associated to a NameID format.
</p>
<p>
<p><div class="noteclassic">This parameter is used by <a href="../../documentation/1.3/idpsaml.html" class="wikilink1" title="documentation:1.3:idpsaml">SAML IDP</a> to fill the NameID in authentication responses.
</div></p>
</p>
<p>
Customizable NameID formats are:
</p>
<ul>
<li class="level1"><div class="li"> Email</div>
</li>
<li class="level1"><div class="li"> X509</div>
</li>
<li class="level1"><div class="li"> Windows</div>
</li>
<li class="level1"><div class="li"> Kerberos</div>
</li>
</ul>
<p>
<p><div class="notetip">For example, if you are using <a href="../../documentation/1.3/authldap.html" class="wikilink1" title="documentation:1.3:authldap">AD as authentication backend</a>, you can use sAMAccountName for the Windows NameID format.
</div></p>
</p>
<p>
Other NameID formats are automatically managed:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Transient</strong>: NameID is generated</div>
</li>
<li class="level1"><div class="li"> <strong>Persistent</strong>: NameID is restored from previous sessions</div>
</li>
<li class="level1"><div class="li"> <strong>Undefined</strong>: Default NameID format is used</div>
</li>
</ul>
</div>
<!-- SECTION "NameID formats" [3389-4201] -->
<h3><a name="authentication_contexts" id="authentication_contexts">Authentication contexts</a></h3>
<div class="level3">
<p>
<a href="/_detail/documentation/manager-saml-service-authn-contexts.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:manager-saml-service-authn-contexts.png"><img src="../../../media/documentation/manager-saml-service-authn-contexts.png" class="mediacenter" alt="" /></a>
</p>
<p>
Each <acronym title="LemonLDAP::NG">LL::NG</acronym> authentication module has an authentication level, which can be associated to an <a href="http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf" class="urlextern" title="http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf" rel="nofollow">SAML authentication context</a>.
</p>
<p>
<p><div class="noteclassic">This parameter is used by <a href="../../documentation/1.3/idpsaml.html" class="wikilink1" title="documentation:1.3:idpsaml">SAML IDP</a> to fill the authentication context in authentication responses. It will use the authentication level registered in user session to match the <acronym title="Security Assertion Markup Language">SAML</acronym> authentication context. It is also used by <a href="../../documentation/1.3/authsaml.html" class="wikilink1" title="documentation:1.3:authsaml">SAML SP</a> to fill the authentication level in user session, based on authentication response authentication context.
</div></p>
</p>
<p>
Customizable NameID formats are:
</p>
<ul>
<li class="level1"><div class="li"> Password</div>
</li>
<li class="level1"><div class="li"> Password protected transport</div>
</li>
<li class="level1"><div class="li"> TLS client</div>
</li>
<li class="level1"><div class="li"> Kerberos</div>
</li>
</ul>
</div>
<!-- SECTION "Authentication contexts" [4202-4988] -->
<h3><a name="organization" id="organization">Organization</a></h3>
<div class="level3">
<p>
<p><div class="noteclassic">
This concerns all parameters for the Organization metadata section:
</p>
<pre class="code file xml"><span class="sc3"><span class="re1"><Organization<span class="re2">></span></span></span>
<span class="sc3"><span class="re1"><OrganizationName</span> <span class="re0">xml:lang</span>=<span class="st0">"en"</span><span class="re2">></span></span>Example<span class="sc3"><span class="re1"></OrganizationName<span class="re2">></span></span></span>
<span class="sc3"><span class="re1"><OrganizationDisplayName</span> <span class="re0">xml:lang</span>=<span class="st0">"en"</span><span class="re2">></span></span>Example<span class="sc3"><span class="re1"></OrganizationDisplayName<span class="re2">></span></span></span>
<span class="sc3"><span class="re1"><OrganizationURL</span> <span class="re0">xml:lang</span>=<span class="st0">"en"</span><span class="re2">></span></span>http://www.example.com<span class="sc3"><span class="re1"></OrganizationURL<span class="re2">></span></span></span>
<span class="sc3"><span class="re1"></Organization<span class="re2">></span></span></span></pre>
<p>
</div></p>
</p>
<ul>
<li class="level1"><div class="li"> <strong>Display Name</strong>: should be displayed on IDP, this is often your society name</div>
</li>
<li class="level1"><div class="li"> <strong>Name</strong>: internal name</div>
</li>
<li class="level1"><div class="li"> <strong><acronym title="Uniform Resource Locator">URL</acronym></strong>: <acronym title="Uniform Resource Locator">URL</acronym> of your society</div>
</li>
</ul>
</div>
<!-- SECTION "Organization" [4989-5500] -->
<h3><a name="service_provider" id="service_provider">Service Provider</a></h3>
<div class="level3">
<p>
<p><div class="noteclassic">
This concerns all parameters for the Service Provider metadata section:
</p>
<pre class="code file xml"><span class="sc3"><span class="re1"><SPSSODescriptor<span class="re2">></span></span></span>
...
<span class="sc3"><span class="re1"></SPSSODescriptor<span class="re2">></span></span></span></pre>
<p>
</div></p>
</p>
</div>
<h4><a name="general_options" id="general_options">General options</a></h4>
<div class="level4">
<ul>
<li class="level1"><div class="li"> <strong>Signed Authentication Request</strong>: set to On to always sign authentication request.</div>
</li>
<li class="level1"><div class="li"> <strong>Want Assertions Signed</strong>: set to On to require that received assertions are signed.</div>
</li>
</ul>
<p>
<p><div class="notetip">These options can then be overridden for each Identity Provider.
</div></p>
</p>
</div>
<h4><a name="single_logout" id="single_logout">Single Logout</a></h4>
<div class="level4">
<p>
For each binding you can set:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Location</strong>: Access Point for SLO request.</div>
</li>
<li class="level1"><div class="li"> <strong>Response Location</strong>: Access Point for SLO response.</div>
</li>
</ul>
<p>
<a href="/_detail/documentation/manager-saml-service-sp-slo.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:manager-saml-service-sp-slo.png"><img src="../../../media/documentation/manager-saml-service-sp-slo.png" class="mediacenter" alt="" /></a>
</p>
<p>
Available bindings are:
</p>
<ul>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> Redirect</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> POST</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> <acronym title="Simple Object Access Protocol">SOAP</acronym></div>
</li>
</ul>
</div>
<h4><a name="assertion_consumer" id="assertion_consumer">Assertion Consumer</a></h4>
<div class="level4">
<p>
For each binding you can set:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Default</strong>: will this binding be used by default for authentication response.</div>
</li>
<li class="level1"><div class="li"> <strong>Location</strong>: Access Point for <acronym title="Single Sign On">SSO</acronym> request and response.</div>
</li>
</ul>
<p>
<a href="/_detail/documentation/manager-saml-service-sp-ac.png?id=documentation%3A1.3%3Asamlservice" class="media" title="documentation:manager-saml-service-sp-ac.png"><img src="../../../media/documentation/manager-saml-service-sp-ac.png" class="mediacenter" alt="" /></a>
</p>
<p>
Available bindings are:
</p>
<ul>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> Artifact</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> POST</div>
</li>
</ul>
</div>
<h4><a name="artifact_resolution" id="artifact_resolution">Artifact Resolution</a></h4>
<div class="level4">
<p>
The only authorized binding is <acronym title="Simple Object Access Protocol">SOAP</acronym>. This should be set as Default.
</p>
</div>
<!-- SECTION "Service Provider" [5501-6664] -->
<h3><a name="identity_provider" id="identity_provider">Identity Provider</a></h3>
<div class="level3">
<p>
<p><div class="noteclassic">
This concerns all parameters for the Service Provider metadata section:
</p>
<pre class="code file xml"><span class="sc3"><span class="re1"><IDPSSODescriptor<span class="re2">></span></span></span>
...
<span class="sc3"><span class="re1"></IDPSSODescriptor<span class="re2">></span></span></span></pre>
<p>
</div></p>
</p>
</div>
<h4><a name="general_parameters" id="general_parameters">General parameters</a></h4>
<div class="level4">
<ul>
<li class="level1"><div class="li"> <strong>Want Authentication Request Signed</strong>: set to On to require that received authentication request are signed.</div>
</li>
</ul>
<p>
<p><div class="notetip">This option can then be overridden for each Service Provider.
</div></p>
</p>
</div>
<h4><a name="single_sign_on" id="single_sign_on">Single Sign On</a></h4>
<div class="level4">
<p>
For each binding you can set:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Location</strong>: Access Point for <acronym title="Single Sign On">SSO</acronym> request.</div>
</li>
<li class="level1"><div class="li"> <strong>Response Location</strong>: Access Point for <acronym title="Single Sign On">SSO</acronym> response.</div>
</li>
</ul>
<p>
Available bindings are:
</p>
<ul>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> Redirect</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> POST</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> Artifact</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> <acronym title="Simple Object Access Protocol">SOAP</acronym></div>
</li>
</ul>
</div>
<h4><a name="single_logout1" id="single_logout1">Single Logout</a></h4>
<div class="level4">
<p>
For each binding you can set:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Location</strong>: Access Point for SLO request.</div>
</li>
<li class="level2"><div class="li"> <strong>Response Location</strong>: Access Point for SLO response.</div>
</li>
</ul>
<p>
Available bindings are:
</p>
<ul>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> Redirect</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> POST</div>
</li>
<li class="level1"><div class="li"> <acronym title="Hyper Text Transfer Protocol">HTTP</acronym> <acronym title="Simple Object Access Protocol">SOAP</acronym></div>
</li>
</ul>
</div>
<h4><a name="artifact_resolution1" id="artifact_resolution1">Artifact Resolution</a></h4>
<div class="level4">
<p>
The only authorized binding is <acronym title="Simple Object Access Protocol">SOAP</acronym>. This should be set as Default.
</p>
</div>
<!-- SECTION "Identity Provider" [6665-7653] -->
<h3><a name="attribute_authority" id="attribute_authority">Attribute Authority</a></h3>
<div class="level3">
<p>
<p><div class="noteclassic">
This concerns all parameters for the Attribute Authority metadata section
</p>
<pre class="code file xml"><span class="sc3"><span class="re1"><AttributeAuthorityDescriptor<span class="re2">></span></span></span>
...
<span class="sc3"><span class="re1"></AttributeAuthorityDescriptor<span class="re2">></span></span></span></pre>
<p>
</div></p>
</p>
</div>
<h4><a name="attribute_service" id="attribute_service">Attribute Service</a></h4>
<div class="level4">
<p>
This is the only service to configure, and it accept only the <acronym title="Simple Object Access Protocol">SOAP</acronym> binding.
</p>
<p>
Response Location should be empty, as <acronym title="Simple Object Access Protocol">SOAP</acronym> responses are directly returned (synchronous binding).
</p>
</div>
<!-- SECTION "Attribute Authority" [7654-8065] -->
<h3><a name="advanced" id="advanced">Advanced</a></h3>
<div class="level3">
<p>
These parameters are not mandatory to run <acronym title="Security Assertion Markup Language">SAML</acronym> service, but can help to customize it:
</p>
<ul>
<li class="level1"><div class="li"> <strong>IDP resolution cookie name</strong>: by default, it's the <acronym title="LemonLDAP::NG">LL::NG</acronym> cookie name suffixed by <code>idp</code>, for example: <code>lemonldapidp</code>.</div>
</li>
<li class="level1"><div class="li"> <strong>UTF8 metadata conversion</strong>: set to On to force partner's metadata conversion.</div>
</li>
</ul>
</div>
<h4><a name="saml_sessions_module_name_and_options" id="saml_sessions_module_name_and_options">SAML sessions module name and options</a></h4>
<div class="level4">
<p>
By default, the main session module is used to store <acronym title="Security Assertion Markup Language">SAML</acronym> temporary data (like relay-states), but <acronym title="Security Assertion Markup Language">SAML</acronym> sessions need to use a session module compatible with the <a href="../../documentation/features.html#session_restrictions" class="wikilink1" title="documentation:features">sessions restrictions feature</a>.
</p>
<p>
This is not the case of <a href="../../documentation/1.3/memcachedsessionbackend.html" class="wikilink1" title="documentation:1.3:memcachedsessionbackend">Memcached</a> for example. In this case, you can choose a different module to manage <acronym title="Security Assertion Markup Language">SAML</acronym> sessions.
</p>
<p>
<p><div class="notetip">You can also choose a different session module to split <acronym title="Single Sign On">SSO</acronym> sessions and <acronym title="Security Assertion Markup Language">SAML</acronym> sessions.
</div></p>
</p>
<ul>
<li class="level1"><div class="li"> <strong>RelayState session timeout</strong>: timeout for RelayState sessions. By default, the RelayState session is deleted when it is read. This timeout allows to purge sessions of lost RelayState.</div>
</li>
</ul>
</div>
<h4><a name="common_domain_cookie" id="common_domain_cookie">Common Domain Cookie</a></h4>
<div class="level4">
<p>
<p><div class="noteclassic">Common Domain Cookie is also know as <a href="http://www.switch.ch/aai/support/tools/wayf.html" class="urlextern" title="http://www.switch.ch/aai/support/tools/wayf.html" rel="nofollow">WAYF Service</a>.
</div></p>
</p>
<p>
The common domain is used by <a href="../../documentation/1.3/authsaml.html" class="wikilink1" title="documentation:1.3:authsaml">SAML SP</a> to find an Identity Provider for the user, and by <a href="../../documentation/1.3/idpsaml.html" class="wikilink1" title="documentation:1.3:idpsaml">SAML IDP</a> to register itself in user's IDP list.
</p>
<p>
Configuration parameters are:
</p>
<ul>
<li class="level1"><div class="li"> <strong>Activation</strong>: Set to On to enable Common Domain Cookie support.</div>
</li>
<li class="level1"><div class="li"> <strong>Common domain</strong>: Name of the common domain (where common cookie is available).</div>
</li>
<li class="level1"><div class="li"> <strong>Reader <acronym title="Uniform Resource Locator">URL</acronym></strong>: <acronym title="Uniform Resource Locator">URL</acronym> used by <acronym title="Security Assertion Markup Language">SAML</acronym> SP to read the cookie. Leave blank to deactivate the feature.</div>
</li>
<li class="level1"><div class="li"> <strong>Writer <acronym title="Uniform Resource Locator">URL</acronym></strong>: <acronym title="Uniform Resource Locator">URL</acronym> used by <acronym title="Security Assertion Markup Language">SAML</acronym> IDP to write the cookie. Leave blank to deactivate the feature.</div>
</li>
</ul>
</div>
<!-- SECTION "Advanced" [8066-] --></div><!-- closes <div class="dokuwiki export">-->
|
