WS-Federation Auth Scheme--Advanced Settings

The Advanced section is where you configure the Message Extension Consumer plugin. You can also configure optional redirect URLs for assertion processing errors during authentication.
casso127
The Advanced section is where you configure the Message Extension Consumer plugin. You can also configure optional redirect URLs for assertion processing errors during authentication.
The section contains the following settings:
Message Consumer Plugin
Full Java Class Name
(Optional) Specifies the fully qualified Java class name of a class which implements a Message Consumer Plug-in interface for the authentication scheme.
  • Parameter
    Specifies a string of parameters the API passes to the specified plug-in. The parameter field is only relevant when you enter a value in the Full Java Class Name field.
Status Redirect URLs and Modes
Assertion-based authentication can fail at the site that consumes assertions for various reasons. If authentication does fail,
CA Single Sign-On
provides functionality to redirect the user to different applications (URLs) for further processing. For example, when user disambiguation fails,
CA Single Sign-On
can redirect the user to a provisioning system. The provisioning system can create a user account based on the information found in SAML assertion.
Note:
Error redirection happens only when the system can parse the request successfully and get the information necessary to identify the asserting and relying partners.
The following options redirect the user to a configured URL based on the condition that caused the failure.
User Not Found URL
(Optional) Identifies the URL where
CA Single Sign-On
redirects the user when the user is not found. The user not found status applies when the single sign-on message has no LoginID or the user directory does not contain the LoginID.
  • Invalid SSO Message URL
    (Optional) Identifies the URL where
    CA Single Sign-On
    redirects the user for one of the following conditions:
    • The single sign-on message is invalid based on rules specified by the SAML schemas
    • The consumer requires an encrypted assertion but the single sign-on message does not contain an encrypted assertion.
  • Unaccepted User Credential (SSO Message) URL
    (Optional) Identifies the redirect URL for all error conditions other than when a user is not found or the single sign-on message is invalid. The assertion is valid, but
    CA Single Sign-On
    does not accept the message for certain reasons, such as:
    • XML digital signature validation fails
    • XML decryption operation fails
    • XML validation of conditions fails, such as an expired message or an audience mismatch.
    • None of the assertions in SSO message contain an authentication statement.
Mode
Specifies the method by which
CA Single Sign-On
redirects the user to the redirect URL. The options are:
  • 302 No Data (default)
    Redirects user with an HTTP 302 redirect with a session cookie, but no other data.
  • HTTP Post
    Redirects user using HTTP Post protocol.