SAML 2.0 Authentication Scheme Advanced Settings

Proxy
casso127
HID_saml2-auth-advanced
casso127
The Advanced dialog is where you specify advanced configuration for the Message Extension Consumer API. In addition, this dialog is where you configure optional redirect URLs for assertion processing errors during authentication.
The dialog contains the following settings:
Message Consumer Plugin
Full Java Class Name
(Optional) Specifies the fully qualified Java class name of a class which implements a Message Consumer Plug-in interface for the authentication scheme.
  • Parameter
If you enter a value for the Full Java Class Name field, the API passes the parameter sting in this field to the specified plugin.
Status Redirect URLs and Modes
Assertion-based authentication can fail at the site that consumes assertions for various reasons. If authentication does fail, Federation Security Services provides functionality to direct the user to different applications (URLs) for further processing. For example, when user disambiguation fails,
CA Single Sign-On
can redirect the user to a provisioning system. The provisioning system can create a user account that is based on the information found in SAML assertion.
Note:
Error redirection happens only when the system can parse the request successfully and get the information necessary to identify the asserting and relying partners.
The following options redirect the user to a configured URL based on the condition that caused the failure.
User Not Found URL
(Optional) Identifies the URL where
CA Single Sign-On
redirects the user when the user is not found. This status applies when the single sign-on message does not have a LoginID, or the user directory does not contain the LoginID.
  • Invalid SSO Message URL
    (Optional) Identifies the URL where
    CA Single Sign-On
    redirects the user for one of the following conditions:
    • The single sign-on message is invalid based on rules that are listed in the SAML schemas.
    • The consumer requires an encrypted assertion but the single sign-on message does not contain an encrypted assertion.
  • Unaccepted User Credential (SSO Message) URL
    (Optional) Identifies the redirect URL for all other error conditions other than when a user is not found or the single sign-on message is invalid. The assertion is valid, but
    CA Single Sign-On
    does not accept the message for certain reasons, such as:
    • XML digital signature validation fails
    • XML decryption operation fails
    • XML validation of conditions fails, such as an expired message or an audience mismatch.
    • None of the assertions in SSO message contain an authentication statement.
Mode
Specifies the method by which
CA Single Sign-On
redirects the user to the redirect URL. The options are:
  • 302 No Data (default)
    Redirects the user with an HTTP 302 redirect with a session cookie but no other data.
  • HTTP Post
    Redirects the user using HTTP Post protocol.
Proxy
    • Server
      Specifies the protocol and authority portions of the URL for a proxy server or a web server that sits in front of the operating environment where the Web Agent Option Pack resides. The Server value ensures that the SAML response is directed to the correct target.
      The syntax for the Server value is
      protocol:authority
      , where:
      protocol is
      http: or https:
      authority is
      //host.domain.com or //host.domain.com:port.
      Example: http://myproxy.ca.com.
      CA Single Sign-On
      also uses the Server value to validate URLs in XML messages. For example, the Destination attribute in a SAML 2.0 message.
      Configure the Server setting in the following situations:
      • A proxy server stands between the client and the operating environment where Federation Web Services is running. Federation Web Services is installed with the Web Agent Option Pack.
      • The
        CA Single Sign-On
        CA Access Gateway
        is in your environment, even if the
        CA Access Gateway
        is a federation gateway.
      • Any web server that sits in front of the operating environment where the Web Agent Option Pack is installed.