Schema di autenticazione SAML 2.0 - Impostazioni avanzate
Proxy
casso1283
HID_saml2-auth-advanced
casso1283
The Advanced dialog is where you specify advanced configuration for the Message Extension Consumer API. In addition, this dialog is where you configure optional redirect URLs for assertion processing errors during authentication.
The dialog contains the following settings:
Message Consumer Plugin
Full Java Class Name
(Optional) Specifies the fully qualified Java class name of a class which implements a Message Consumer Plug-in interface for the authentication scheme.
- Parameter
If you enter a value for the Full Java Class Name field, the API passes the parameter sting in this field to the specified plugin.
Status Redirect URLs and Modes
Assertion-based authentication can fail at the site that consumes assertions for various reasons. If authentication does fail, Federation Security Services provides functionality to direct the user to different applications (URLs) for further processing. For example, when user disambiguation fails,
CA Single Sign-on
can redirect the user to a provisioning system. The provisioning system can create a user account that is based on the information found in SAML assertion.Note:
Error redirection happens only when the system can parse the request successfully and get the information necessary to identify the asserting and relying partners.The following options redirect the user to a configured URL based on the condition that caused the failure.
User Not Found URL
(Optional) Identifies the URL where
CA Single Sign-on
redirects the user when the user is not found. This status applies when the single sign-on message does not have a LoginID, or the user directory does not contain the LoginID.- Invalid SSO Message URL(Optional) Identifies the URL whereCA Single Sign-onredirects the user for one of the following conditions:
- The single sign-on message is invalid based on rules that are listed in the SAML schemas.
- The consumer requires an encrypted assertion but the single sign-on message does not contain an encrypted assertion.
- Unaccepted User Credential (SSO Message) URL(Optional) Identifies the redirect URL for all other error conditions other than when a user is not found or the single sign-on message is invalid. The assertion is valid, butCA Single Sign-ondoes not accept the message for certain reasons, such as:
- XML digital signature validation fails
- XML decryption operation fails
- XML validation of conditions fails, such as an expired message or an audience mismatch.
- None of the assertions in SSO message contain an authentication statement.
Mode
Specifies the method by which
CA Single Sign-on
redirects the user to the redirect URL. The options are:- 302 No Data (default)Redirects the user with an HTTP 302 redirect with a session cookie but no other data.
- HTTP PostRedirects the user using HTTP Post protocol.
Proxy
- ServerSpecifica le parti relative al protocollo e all'autorità dell'URL per un server proxy o un server Web che risiede all'interno dell'ambiente operativo in cui si trova l'Option Pack dell'agente Web. Il valore Server assicura che la risposta SAML venga indirizzata alla destinazione corretta.La sintassi per il valore Server èprotocol:authority, in cui:protocolcorrisponde a http: o https:authoritycorrisponde a //host.domain.com o //host.domain.com:port.Esempio: http://myproxy.ca.com.CA Single Sign-onutilizza inoltre il valore Server per la convalida degli URL in messaggi XML. Ad esempio, l'attributo Destination in un messaggio SAML 2.0.Configurare l'impostazione Server nelle situazioni seguenti:
- Un server proxy si trova tra il client e l'ambiente operativo su cui sono in esecuzione i servizi Web della federazione. I servizi Web della federazione sono installati con l'Option Pack dell'agente Web.
- CA Single Sign-oneCA Access Gatewaysi trovano nell'ambiente, anche seCA Access Gatewayè un gateway di federazione.
- Qualsiasi server Web che risiede all'interno dell'ambiente operativo su cui è installato l'Option Pack dell'agente Web.