Dual Purpose Provider Metadata Files (Sun Java System SAML v2 Plug-in for Federation Services User's Guide)

Sun Java System SAML v2 Plug-in for Federation Services User's Guide

Dual Purpose Provider Metadata Files

According to the SAML v2 specifications, one metadata file can contain configuration data for one identity provider and one service provider. Thus, it is possible to create one standard metadata configuration file and one extended configuration file which, when imported, will configure one member of a circle of trust to act as both an identity provider and a service provider. Sample files and instructions on how to generate them are found in the following sections.

Dual Purpose Standard Metadata Configuration File

The dual purpose standard metadata file would contain one <EntityDescriptor> element containing both <IDPSSODescriptor> and <SPSSODescriptor> elements. The following sample is a standard metadata configuration file in which the data configures zosma21.central.sun.com as both a service provider and an identity provider.

<EntityDescriptor
    xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="zosma21.central.sun.com/">
    <IDPSSODescriptor
        WantAuthnRequestsSigned="false"
        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <ArtifactResolutionService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/ArtifactResolver/
             metaAlias/idp"
            index="0"
            isDefault="1"/>
        <SingleLogoutService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
            Location="http://zosma21.central.sun.com:80/amserver/IDPSloRedirect/
             metaAlias/idp"
            ResponseLocation="http://zosma21.central.sun.com:80/amserver/
             IDPSloRedirect/metaAlias/idp"/>
        <SingleLogoutService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/
             IDPSloSoap/metaAlias/idp"/>
        <ManageNameIDService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
            Location="http://zosma21.central.sun.com:80/amserver/IDPMniRedirect/
             metaAlias/idp"
            ResponseLocation="http://zosma21.central.sun.com:80/amserver/
             IDPMniRedirect/metaAlias/idp"/>
        <ManageNameIDService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/IDPMniSoap/
             metaAlias/idp"/>
        <NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
        </NameIDFormat>
        <NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:transient
        </NameIDFormat>
        <SingleSignOnService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
            Location="http://zosma21.central.sun.com:80/amserver/SSORedirect/
             metaAlias/idp"/>
        <SingleSignOnService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/SSOSoap/
             metaAlias/idp"/>
    </IDPSSODescriptor>
    <SPSSODescriptor
        AuthnRequestsSigned="false"
        WantAssertionsSigned="false"
        protocolSupportEnumeration=
            "urn:oasis:names:tc:SAML:2.0:protocol">
        <SingleLogoutService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
            Location="http://zosma21.central.sun.com:80/amserver/SPSloRedirect/
             metaAlias/sp"
            ResponseLocation="http://zosma21.central.sun.com:80/amserver/
             SPSloRedirect/metaAlias/sp"/>
        <SingleLogoutService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/SPSloSoap/
             metaAlias/sp"/>
        <ManageNameIDService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
            Location="http://zosma21.central.sun.com:80/amserver/SPMniRedirect/
             metaAlias/sp"
            ResponseLocation="http://zosma21.central.sun.com:80/amserver/
             SPMniRedirect/metaAlias/sp"/>
        <ManageNameIDService
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
            Location="http://zosma21.central.sun.com:80/amserver/SPMniSoap/
             metaAlias/sp"
            ResponseLocation="http://zosma21.central.sun.com:80/amserver/
             SPMniSoap/metaAlias/sp"/>
        <NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
        </NameIDFormat>
        <NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:transient
        </NameIDFormat>
        <AssertionConsumerService
            isDefault="true"
            index="0"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
            Location="http://zosma21.central.sun.com:80/amserver/Consumer/
             metaAlias/sp"/>
        <AssertionConsumerService
            index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="http://zosma21.central.sun.com:80/amserver/Consumer/
             metaAlias/sp"/>
    </SPSSODescriptor>
</EntityDescriptor>

Dual Purpose Extended Metadata Configuration File

The dual purpose extended metadata file would contain one <EntityConfig> element containing both <IDPSSOConfig> and <SPSSOConfig> elements. The following sample is an extended metadata configuration file in which the data configures zosma21.central.sun.com as both a service provider and an identity provider.

<EntityConfig xmlns="urn:sun:fm:SAML:2.0:entityconfig"
    xmlns:fm="urn:sun:fm:SAML:2.0:entityconfig"
    hosted="1"
    entityID="zosma21.central.sun.com/">
    <IDPSSOConfig metaAlias="/idp">
       <Attribute name="signingCertAlias">
           <Value></Value>
       </Attribute>
       <Attribute name="encryptionCertAlias">
           <Value></Value>
       </Attribute>
       <Attribute name="basicAuthOn">
           <Value>false</Value>
       </Attribute>
       <Attribute name="basicAuthUser">
           <Value></Value>
       </Attribute>
       <Attribute name="basicAuthPassword">
           <Value></Value>
       </Attribute>
       <Attribute name="autofedEnabled">
           <Value>false</Value>
       </Attribute>
       <Attribute name="autofedAttribute">
           <Value></Value>
       </Attribute>
       <Attribute name="assertionEffectiveTime">
           <Value>600</Value>
       </Attribute>
       <Attribute name="idpAuthncontextMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultIDPAuthnContextMapper</Value>
       </Attribute>
       <Attribute name="idpAuthncontextClassrefMapping">
           <Value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</Value>
       </Attribute>
       <Attribute name="idpAccountMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultIDPAccountMapper</Value>
       </Attribute>
       <Attribute name="idpAttributeMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultIDPAttributeMapper</Value>
       </Attribute>
       <Attribute name="attributeMap">
           <Value></Value>
       </Attribute>
       <Attribute name="wantNameIDEncrypted">
           <Value></Value>
       </Attribute>
       <Attribute name="wantArtifactResolveSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantLogoutRequestSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantLogoutResponseSigned ">
           <Value></Value>
       </Attribute>
       <Attribute name="wantMNIRequestSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantMNIResponseSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="cotlist">
       </Attribute>
    </IDPSSOConfig>
    <SPSSOConfig metaAlias="/sp">
       <Attribute name="signingCertAlias">
           <Value></Value>
       </Attribute>
       <Attribute name="encryptionCertAlias">
           <Value></Value>
       </Attribute>
       <Attribute name="basicAuthOn">
           <Value>false</Value>
       </Attribute>
       <Attribute name="basicAuthUser">
           <Value></Value>
       </Attribute>
       <Attribute name="basicAuthPassword">
           <Value></Value>
       </Attribute>
       <Attribute name="autofedEnabled">
           <Value>false</Value>
       </Attribute>
       <Attribute name="autofedAttribute">
           <Value></Value>
       </Attribute>
       <Attribute name="transientUser">
           <Value></Value>
       </Attribute>
       <Attribute name="spAccountMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultSPAccountMapper</Value>
       </Attribute>
       <Attribute name="spAttributeMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultSPAttributeMapper</Value>
       </Attribute>
       <Attribute name="spAuthncontextMapper">
           <Value>com.sun.identity.saml2.plugins.DefaultSPAuthnContextMapper</Value>
       </Attribute>
       <Attribute name="spAuthncontextClassrefMapping">
           <Value>PasswordProtectedTransport|0|default</Value>
       </Attribute>
       <Attribute name="spAuthncontextComparisonType">
           <Value>exact</Value>
       </Attribute>
       <Attribute name="attributeMap">
           <Value></Value>
       </Attribute>
       <Attribute name="saml2AuthModuleName">
           <Value></Value>
       </Attribute>
       <Attribute name="localAuthURL">
           <Value></Value>
       </Attribute>
       <Attribute name="intermediateUrl">
           <Value></Value>
       </Attribute>
       <Attribute name="defaultRelayState">
           <Value></Value>
       </Attribute>
       <Attribute name="assertionTimeSkew">
           <Value>300</Value>
       </Attribute>
       <Attribute name="wantAttributeEncrypted">
           <Value></Value>
       </Attribute>
       <Attribute name="wantAssertionEncrypted">
           <Value></Value>
       </Attribute>
       <Attribute name="wantNameIDEncrypted">
           <Value></Value>
       </Attribute>
       <Attribute name="wantArtifactResponseSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantLogoutRequestSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantLogoutResponseSigned ">
           <Value></Value>
       </Attribute>
       <Attribute name="wantMNIRequestSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="wantMNIResponseSigned">
           <Value></Value>
       </Attribute>
       <Attribute name="cotlist">
       </Attribute>
    </SPSSOConfig>
</EntityConfig>

To Generate Dual Purpose Metadata Configuration Files

This procedure creates one standard metadata file and one extended metadata file that contains configuration information for one provider that, when imported, will define it as capable of both functions. See The saml2meta Command-line Reference for more information on the saml2meta command line interface.

Generate the dual purpose standard and extended metadata configuration files.

saml2meta [-i staging-directory] template -u amadmin -w password -e dual -s /sp1 -d /idp1 -m dualMeta.xml -x dualExtended.xml

Import the generated standard and extended metadata configuration files.

saml2meta [-i staging-directory] import -u amadmin -w password -m dualMeta.xml -x dualExtended.xml