SAML Artifact Template
Use this table when configuring a SAML authentication scheme based on the profile type artifact for communicating security assertions. With the artifact profile type, the URL for retrieving the SAML assertion is referenced within the AssertionRetrievalURL portion of the Parameter string.
casso1283
Use this table when configuring a SAML authentication scheme based on the profile type
artifact
for communicating security assertions. With the artifact profile type, the URL for retrieving the SAML assertion is referenced within the AssertionRetrievalURL
portion of the Parameter string.The structure fields referenced in the table are in Sm_PolicyApi_Scheme_t.
Information Type | Value Assignment and Meaning |
Scheme type | nType =Sm_Api_SchemeType_SAMLArtifactThe scheme type SAML Artifact. |
Description | pszDesc =description The description of the authentication scheme. |
Protection level | nLevel =value A value of 1 through 1000. The higher the number, the greater degree of protection provided by the scheme. Default is 5. |
Library | pszLib ="smauthsaml"The default library for this scheme type. |
Parameter | pszParam =param The following required parameters: Name. The name of the affiliate. RedirectMode. The way in which the SAML Credentials Collector redirects to the target resource. One of the following numeric values: 0. Meaning: 302 No Data. 1. Meaning: 302 Cookie Data. 2. Meaning: Server Redirect. 3. Meaning: Persist Attributes. |
SRCID. The 20-byte source ID for the site that produces the SAML assertion. The ID is located at the SAML producer's site in the properties file AMAssertionGenerator.properties. AssertionRetrievalURL. The URL for obtaining the assertion from the SAML assertion producer's site. Audience. The URI of the document that describes the agreement between the portal and the affiliate. This value is compared with the audience value specified in the SAML assertion. Issuer. The SAML issuer specified in the assertion. AttributeXPath. A standard XPath query run against the SAML assertion. The query obtains the data that is substituted in a search specification that looks up a user-for example: //saml:AttributeValue/SM:/SMContent/SM:Smlogin/SM:Username.text() | |
This query gets the text of the Username element. SAMLVersion. The SAML version in use: 1.0 or 1.1. RetrievalMethod. One of these values: 0. Meaning: Basic authentication. 1. Meaning: Client certificate authentication. Attribute. The search string for looking up a user in a user directory of the specified type. Use a percent sign (%) to indicate where the value returned from the XPath query should be inserted. For example, if you specify attribute LDAP:uid=%s , and user1 is returned from the query, the search string used for LDAP directories is uid=user1 . At least one attribute must be specified. | |
Format of the parameter string is as follows. Separate name/value pairs with semi-colons (;). The format example includes LDAP and ODBC attributes: Name= name ;RedirectMode=0|1|2;SRCID=srcid ;AssertionRetrievalURL=url ;Audience=audience ;Issuer=issuer ;AttributeXpath=XPathQuery ;SAMLVersion=1.0|1.1;RetrievalMethod=0|1;attribute=LDAP:srch Spc;attribute=ODBC:srchSpc | |
Shared secret | pszSecret =secret The password for the affiliate site. |
Is template? | bIsTemplate =0Set to false (0) to indicate that the scheme is not a template. Any other value is ignored. |
Is used by administrator? | bIsUsedbyAdmin =0Set to false (0)-scheme is not used to authenticate administrators. |
Save credentials? | bAllowSaveCreds =0Set to false (0) to indicate that user credentials won't be saved. |
Is RADIUS? | bIsRadius =0Set to false (0)-scheme is not used with RADIUS agents. |
Ignore password check? | bIgnorePwCheck =1Set to true (1)-ignore password checking. |