JavaServer Pages

JavaServer Pages (JSP) are HTML files that contain additional code to generate dynamic content. More specifically, they contain HTML code to display static text and graphics, as well as application code to generate information. When the page is displayed in a web browser, it will contain both the static HTML content and dynamic content retrieved via the application code. The SAML v2 Plug-in for Federation Services contains JSP that can initiate SAML v2 interactions. After installation, these pages can be accessed using the following URL format:

http(s)://host:port/uri/saml2/jsp/jsp-page-name?metaAlias=xxx&...

The JSP are collected in the /AccessManager-base/product-directory/saml2/config/jsp directory or the /FederationManager-base/SUNWam/saml2/config/jsp directory. The following sections contain descriptions of, and uses for, the JSP.

• Default Display Page

• Assertion Consumer Page

• Single Sign-on Pages

• Name Identifier Pages

• Single Logout JavaServer Pages

---

Caution –

The following JSP cannot be modified:

• idpArtifactResolution.jsp

• idpMNISOAP.jsp

• spMNISOAP.jsp

---

Default Display Page

default.jsp is the default display page for the SAML v2 Plug-in for Federation Services. After a successful SAML v2 operation (single sign-on, single logout, or federation termination), a page is displayed. This page, generally the originally requested resource, is specified in the initiating request using the <RelayState> element. If a <RelayState> element is not specified, the value of the <defaultRelayState> property in the extended metadata configuration is displayed. If a <defaultRelayState> is not specified, this default.jsp is used. default.jsp can take in a message to display, for example, upon a successful authentication. The page can also be modified to add additional functionality.

---

Caution –

When the value of <RelayState> or <defaultRelayState> contains special characters (such as &), it must be URL-encoded. For more information, see Service Provider Extended Metadata Properties.

---

Assertion Consumer Page

The spAssertionConsumer.jsp processes the responses that a service provider receives from an identity provider. When a service provider wants to authenticate a user, it sends an authentication request to an identity provider. The AuthnRequest asks that the identity provider return a Response containing one or more assertions. The spAssertionConsumer.jsp receives and parses the Response (or an artifact representing it). The endpoint for this JSP is protocol://host:port/service-deploy-uri/Consumer. Some ways in which the spAssertionConsumer.jsp can be customized include:

• The localLoginUrl parameter in the spAssertionConsumer.jsp retrieves the value of the localAuthUrl property in the service provider's extended metadata configuration. The value of localAuthUrl points to the local login page on the service provider side. If localAuthUrl is not defined, the login URL is calculated using the Assertion Consumer Service URL defined in the service provider's standard metadata configuration. Changing the localLoginUrl parameter value in spAssertionConsumer.jsp is another way to define the service provider's local login URL.

• After a successful single sign-on and before the final protected resource (defined in the <RelayState> element) is accessed, the user may be directed to an intermediate URL, if one is configured as the value of the intermediateUrl property in the service provider's extended metadata configuration file. For example, this intermediate URL might be a successful account creation page after the auto-creation of a user account. The redirectUrl in spAssertionConsumer.jsp can be modified to override the intermediateUrl value.

Single Sign-on Pages

The single sign-on JSP are used to initiate single sign-on and, parse authentication requests, and generate responses. These include:

• idpSSOFederate.jsp

• idpSSOInit.jsp

• spSSOInit.jsp

idpSSOFederate.jsp

idpSSOFederate.jsp works on the identity provider side to receive and parse authentication requests from the service provider and generate a Response containing an assertion. The endpoint for this JSP is protocol://host:port/service-deploy-uri/idpSSOFederate. idpSSOFederate.jsp takes the following parameters:

• SAMLRequest: This required parameter takes as a value the XML blob that contains the AuthnRequest.

• metaAlias: This optional parameter takes as a value the metaAlias set in the identity provider's extended metadata configuration file.

• RelayState: This optional parameter takes as a value the target URL of the request.

idpSSOInit.jsp

idpSSOInit.jsp initiates single sign-on from the identity provider side (also referred to as unsolicited response). For example, a user requests access to a resource. On receiving this request for access, idpSSOInit.jsp looks for a cached assertion which, if present, is sent to the service provider in an unsolicited <Response>. If no assertion is found, idpSSOInit.jsp verifies that the following required parameters are defined:

• metaAlias: This parameter takes as a value the metaAlias set in the identity provider's extended metadata configuration file. If the metaAlias attribute is not present, an error is returned.

• spEntityID: The entity identifier of the service provider to which the response is sent.

If defined, the unsolicited Response is created and sent to the service provider. If not, an error is returned. The endpoint for this JSP is protocol://host:port/service-deploy-uri/idpssoinit. The following optional parameters can also be passed to idpSSOInit.jsp:

• RelayState: The target URL of the request.

• NameIDFormat: The currently supported name identifier formats: persistent or transient.

• binding: A URI suffix identifying the protocol binding to use when sending the Response. The supported values are:

  • HTTP-Artifact

  • HTTP-POST

spSSOInit.jsp

spSSOInit.jsp is used to initiate single sign-on from the service provider side. On receiving a request for access, spSSOInit.jsp verifies that the following required parameters are defined:

• metaAlias: This parameter takes as a value the metaAlias set in the identity provider's extended metadata configuration file. If the metaAlias attribute is not present, an error is returned.

• idpEntityID: The entity identifier of the identity provider to which the request is sent. If idpEntityID is not provided, the request is redirected to the SAML v2 IDP Discovery Service to get the user's preferred identity provider. In the event that more then one identity provider is returned, the last one in the list is chosen. If idpEntityID cannot be retrieved using either of these methods, an error is returned.

If defined, the Request is created and sent to the identity provider. If not, an error is returned. The endpoint for this JSP is protocol://host:port/service-deploy-uri/spssoinit. The following optional parameters can also be passed to spSSOInit.jsp:

• RelayState: The target URL of the request.

• NameIDFormat: The currently supported name identifier formats: persistent or transient.

• binding: A URI suffix identifying the protocol binding to use when sending the Response. The supported values are:

  • HTTP-Artifact

  • HTTP-POST

• AssertionConsumerServiceIndex: An integer identifying the location to which the Response message should be returned to the requester. requester. It applies to profiles in which the requester is different from the presenter, such as the Web Browser SSO profile.

• AttributeConsumingServiceIndex: An integer indirectly specifying information (associated with the requester) describing the SAML attributes the requester desires or requires to be supplied.

• isPassive: Takes a value of true or false with true indicating the identity provider should authenticate passively.

• ForceAuthN: Takes a value of true indicating that the identity provider must force authentication or false indicating that the identity provider can reuse existing security contexts.

• AllowCreate: Takes a value of true indicating that the identity provider is allowed to created a new identifier for the principal if it does not exist or false.

• Destination: A URI indicating the address to which the request has been sent.

• AuthnContextClassRef: Specifies a URI reference identifying an authentication context class that describes the declaration that follows. Multiple references can be pipe-separated.

• AuthnContextDeclRef: Specifies a URI reference to an authentication context declaration. Multiple references can be pipe-separated.

• AuthComparison: The comparison method used to evaluate the requested context classes or statements. Accepted values include: minimum, maximum or better.

• Consent: Indicates whether or not (and under what conditions) consent has been obtained from a principal in the sending of this request.

  ---

  Note –

  Consent is not supported in this release.

  ---

Name Identifier Pages

The various ManageNameID (MNI) JSP provide a way to change account identifiers or terminate mappings between identity provider accounts and service provider accounts. For example, after establishing a name identifier for use when referring to a principal, the identity provider may want to change its value and/or format. Additionally, an identity provider might want to indicate that a name identifier will no longer be used to refer to the principal. The identity provider will notify service providers of the change by sending them a ManageNameIDRequest. A service provider also uses this message type to register or change the SPProvidedID value (included when the underlying name identifier is used to communicate with it) or to terminate the use of a name identifier between itself and the identity provider.

• idpMNIRequestInit.jsp

• idpMNIRedirect.jsp

• spMNIRequestInit.jsp

• spMNIRedirect.jsp

idpMNIRequestInit.jsp

idpMNIRequestInit.jsp initiates the ManageNameIDRequest at the identity provider by user request. The endpoint for this JSP is protocol://host:port/service-deploy-uri/IDPMniInit. It takes the following required parameters:

• metaAlias: The value of the metaAlias property set in the identity provider's extended metadata configuration file. If the metaAlias attribute is not present, an error is returned.

• spEntityID: The entity identifier of the service provider to which the response is sent.

• requestType: The type of ManageNameIDRequest. Accepted values include Terminate and NewID.

  ---

  Note –

  NewID is not supported in this release.

  ---

Some of the other optional parameters are :

• binding: A URI specifying the protocol binding to use for the <Request>. The supported values are:

  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

• RelayState: The target URL of the request

idpMNIRedirect.jsp

idpMNIRedirect.jsp processes the ManageNameIDRequest and the ManageNameIDResponse received from the service provider using HTTP-Redirect. The endpoint for this JSP is protocol://host:port/service-deploy-uri/IDPMniRedirect. It takes the following required parameters:

• SAMLRequest: The ManageNameIDRequest from the service provider.

• SAMLResponse: The ManageNameIDResponse from the service provider.

Optionally, it can also take the RelayState parameter which specifies the target URL of the request.

spMNIRequestInit.jsp

spMNIRequestInit.jsp initiates the ManageNameIDRequest at the service provider by user request. The endpoint for this JSP is protocol://host:port/service-deploy-uri/SPMniInit. It takes the following required parameters:

• metaAlias: This parameter takes as a value the metaAlias set in the identity provider's extended metadata configuration file. If the metaAlias attribute is not present, an error is returned.

• idpEntityID: The entity identifier of the identity provider to which the request is sent.

• requestType: The type of ManageNameIDRequest. Accepted values include Terminate and NewID.

  ---

  Note –

  NewID is not supported in this release.

  ---

Some of the other optional parameters are :

• binding: A URI specifying the protocol binding to use for the Request. The supported values are:

  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

• RelayState: The target URL of the request.

spMNIRedirect.jsp

spMNIRedirect.jsp processes the ManageNameIDRequest and the <ManageNameIDResponse> received from the identity provider using HTTP-Redirect. The endpoint for this JSP is protocol://host:port/service-deploy-uri/SPMniRedirect. It takes the following required parameters:

• SAMLRequest: The ManageNameIDRequest from the identity provider.

• SAMLResponse: The ManageNameIDResponse from the identity provider.

Optionally, it can also take the RelayState parameter which specifies the target URL of the request.

Single Logout JavaServer Pages

The single logout JSP provides the means by which all sessions authenticated by a particular identity provider are near-simultaneously terminated. The single logout protocol is used either when a user logs out from a participant service provider or when the principal logs out directly from the identity provider.

• idpSingleLogoutInit.jsp

• idpSingleLogoutRedirect.jsp

• spSingleLogoutInit.jsp

• spSingleLogoutRedirect.jsp

idpSingleLogoutInit.jsp

idpSingleLogoutInit.jsp initiates a LogoutRequest at the identity provider by user request. The endpoint for this JSP is protocol://host:port/service-deploy-uri/IDPSloInit. There are no required parameters. Optional parameters include:

• RelayState: The target URL after single logout.

• binding: A URI specifying the protocol binding to use for the <Request>. The supported values are:

  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

• Destination: A URI indicating the address to which the request has been sent.

• Consent: Indicates whether or not (and under what conditions) consent has been obtained from a principal in the sending of this request.

  ---

  Note –

  Consent is not supported in this release.

  ---

• Extension: Specifies permitted extensions as a list of string objects.

  ---

  Note –

  Extension is not supported in this release.

  ---

• logoutAll: Specifies that the identity provider send log out requests to all service providers without a session index. It will logout all sessions belonging to the user.

idpSingleLogoutRedirect.jsp

idpSingleLogoutRedirect.jsp processes the LogoutRequest and the LogoutResponse received from the service provider using HTTP-Redirect. The endpoint for this JSP is protocol://host:port/service-deploy-uri/IDPSloRedirect. It takes the following required parameters:

• SAMLRequest: The LogoutRequest from the service provider.

• SAMLResponse: The LogoutResponse from the service provider.

Optionally, it can also take the RelayState parameter which specifies the target URL of the request.

spSingleLogoutInit.jsp

spSingleLogoutInit.jsp initiates a LogoutRequest at the identity provider by user request. The endpoint for this JSP is protocol://host:port/service-deploy-uri/SPSloInit. There are no required parameters. Optional parameters include:

• RelayState: The target URL after single logout.

• binding: A URI specifying the protocol binding to use for the <Request>. The supported values are:

  • urn:oasis:names:tc:SAML:2.0:bindings:SOAP

  • urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

• Destination: A URI indicating the address to which the request has been sent.

• Consent: Indicates whether or not (and under what conditions) consent has been obtained from a principal in the sending of this request.

  ---

  Note –

  Consent is not supported in this release.

  ---

• Extension: Specifies permitted extensions as a list of string objects.

  ---

  Note –

  Extension is not supported in this release.

  ---

spSingleLogoutRedirect.jsp

spSingleLogoutRedirect.jsp processes the LogoutRequest and the LogoutResponse received from the identity provider using HTTP-Redirect. The endpoint for this JSP is protocol://host:port/service-deploy-uri/SPSloRedirect. It takes the following required parameters:

• SAMLRequest: The LogoutRequest from the identity provider.

• SAMLResponse: The LogoutResponse from the identity provider.

Optionally, it can also take the RelayState parameter which specifies the target URL of the request.