Setting the following flags indicate to the identity provider how the service provider signs specific messages:
Authentication Request |
All authentication requests received by this identity provider must be signed. |
Artifact Resolve |
The service provider must sign the ArtifactResolve element. |
Logout Request |
The service provider must sign the LogoutRequest element. |
Logout Response |
The service provider must sign the LogoutResponse element. |
Manage Name ID Request |
The service provider must sign the ManageNameIDRequst element. |
Manage Name ID Response |
The service provider must sign the ManageNameIDResponse element. |
Select the checkbox to enable encryption for the following elements:
NameID |
The service provider must encrypt all NameID elements. |
This attribute defines the certificate alias elements for the identity provider. Signing specifies the provider certificate alias used to find the correct signing certificate in the keystore. Encryption specifies the provider certificate alias used to find the correct encryption certificate in the keystore.
Defines the name identifier formats supported by the identity provider. Name identifiers are a way for providers to communicate with each other regarding a user. Single sign-on interactions support the following types of identifiers:
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName
urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos
urn:oasis:names:tc:SAML:2.0:nameid-format:entity
The Name ID format list is an ordered list and the first Name ID has the highest priority in determining the Name ID format to use. If the user does not specify a Name ID to use when initiating single sign-on, the first one in this list is chosen and supported by the remote Identity Provider.
A persistent identifier is saved to a particular user's data store entry as the value of two attributes. A transient identifier is temporary and no data will be written to the user's persistent data store
This attribute specifies mapping between the NameID Format attribute and a user profile attribute. If the defined Name ID format is used in protocol, the profile attribute value will be used as NameID value for the format in the Subject. The syntax of each entry is:
NameID Format=User profile attribute
For example:
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress=mail
To add new NameID format, the NameID Value Map attribute needs to be updated with a corresponding entry. The exceptions are persistent, transient and unspecified. For persistent and transient, the NameID value will be generated randomly. For this attribute, unspecified is optional. If it is specified, the NameID value will be the value of the user profile attribute. If it is not specified, an random number will be generated.
This attribute maps the SAMLv2-defined authentication context classes to authentication methods available from the identity provider.
Specifies the implementation of the IDPAuthnContextMapper interface used to create the requested authentication context. The default implementation is com.sun.identity.saml2.plugins.DefaultIDPAttributeMapper.
Specifies the default authentication context type used by the identity provider if the service provider does not send an authentication context request.
Select the check box next to the authentication context class if the identity provider supports it.
The SAMLv2-defined authentication context classes are:
InternetProtocol
InternetProtocolPassword
Kerberos
MobileOneFactorUnregistered
MobileTwoFactorUnregistered
MobileOneFactorContract
MobileTwoFactorContract
Password
Password-ProtectedTransport
Previous-Session
X509
PGP
SPKI
XMLDSig
Smartcard
Smartcard-PKI
Software-PKI
Telephony
NomadTelephony
PersonalTelephony
AuthenticaionTelephony
SecureRemotePassword
TLSClient
Time-Sync-Token
Unspecified
Choose the OpenSSO Enterprise authentication type to which the context is mapped.
Type the OpenSSO Enterprise authentication option.
Takes as a value a positive number that maps to an authentication level defined in the OpenSSO Enterprise Authentication Framework. The authentication level indicates how much to trust a method of authentication.
In this framework, each identity provider is configured with a default authentication context (preferred method of authentication). However, the provider might like to change the assigned authentication context to one that is based on the defined authentication level. For example, provider B would like to generate a local session with an authentication level of 3 so it requests the identity provider to authenticate the user with an authentication context assigned that level. The value of this query parameter determines the authentication context to be used by the identity provider.
Assertions are valid for a period of time and not before or after. This attribute specifies a grace period (in seconds) for the Not Before Time Skew value. The default value is 600. It has no relevance to the notAfter value.
Effective Time specifies (in seconds) the amount of time that an assertion is valid counting from the assertion's issue time. The default value is 600 seconds.
Basic authentication can be enabled to protect SOAP endpoints. Any provider accessing these endpoints must have the user and password defined in the following two properties: User Name and Password.
If enabled, this allows the identity provider to cache assertions to be retrieved later.
Select the check box if you want a Discovery Service Resource Offering to be generated during the Liberty-based single sign-on process for bootstrapping purposes.