SAML properties
You can configure SAML as required.
General
Binding
Description
Specifies the binding used for sending authentication requests to the identity provider. Defines how the redirecting of the authentication is performed. The options are Redirect or POST.
Selected input
POST, Redirect
POST
Identity provider ID
Description
Specifies the ID of the identity provider.
Valid input
String
IdP
Service provider ID
Description
Specifies the ID of the service provider.
Valid input
String
UMC@<yourarisserver>
Where <yourarisserver> is the actual name of your server.
Single sign-on URL
Description
Specifies the endpoint of the identity provider that is used for single sign-on.
Valid input
URL
https://yourserver:8443/openam/SSOPOST/metaAlias/MSAD/idp
Single logout URL
Description
Specifies the endpoint of the identity provider that is used for single log-out.
Valid input
URL
https://yourserver:8443/openam/IDPSloPOST/metaAlias/MSAD/idp
Signature
Enforce signing of assertions
Description
Enforces that SAML assertions must be signed. If set, all assertions received by the application must be signed. Assertions sent by the application are signed.
Valid input
enabled, disabled
Enforce signing of requests
Description
Enforces that the SAML authentication requests must be signed. If set, all requests received by the application must be signed. Requests sent by the application are signed.
Valid input
enabled, disabled
Enforce signing of responses
Description
Enforces that the SAML response must be signed. If set, all responses received by the application must be signed. Responses sent by the application are signed.
Valid input
enabled, disabled
Enforce signing of metadata
Description
Enforces that the SAML metadata must be signed. If set, the service provider metadata file provided by the application is signed.
Valid input
enabled, disabled
Signature algorithm
Description
Specifies the algorithm for the signature. The algorithm can be selected from the list.
Valid input
String
Keystore
Keystore
Description
Specify all values for the keystore and then upload the keystore file. Specify all values for the keystore and then upload the keystore file.
Valid input
File with extension .jks.
Alias
Description
Specifies the alias name that is used to access the keystore.
Valid input
String
Password
Description
Specifies the password that is used to access the keystore.
Valid input
String
Type
Description
Specifies the type of the keystore to be used. The keystore type can be selected from a list.
Valid input
JKS file
Truststore
Truststore
Description
Specifies the location of the truststore file used for validating SAML assertions. Specify all values for the truststore and then upload the truststore file.
Key
com.aris.umc.saml.truststore.location
Valid input
File with extension .jks.
Alias
Description
Specifies the alias to be used for accessing the truststore.
Valid input
String
Password
Description
Specifies the password to be used for accessing the truststore.
Key
com.aris.umc.saml.truststore.password
Valid input
String
Type
Description
Specifies the type of the truststore.
Valid input
JKS file
User attributes
First name
Description
Specifies the attribute name to be used for reading first names from a SAML assertion.
Valid input
String
Last name
Description
Specifies the attribute name to be used for reading last names from a SAML assertion.
Valid input
String
E-mail address
Description
Specifies the attribute name to be used for reading e-mail addresses from a SAML assertion.
Valid input
E-mail address
Telephone number
Description
Specifies the attribute name to be used for reading phone numbers from a SAML assertion.
Valid input
String
Member of
Description
Attribute that references the groups of a user.
Valid input
String
Main group
Advanced settings
Authentication context classes
Description
Specifies the authentication context classes to request, meaning which strength of the authentication is defined. For example, you specify that users must use Kerberos if you define Microsoft® Windows as the Authentication context class and the Authentication context comparison as exact.
Valid input
Selection
Passwort/ProtectedTransport
Authentication context comparison
Description
Specifies the authentication context comparison to request, meaning you specify whether other authentication procedures are allowed or not. For example, you specify that users must use Kerberos if you define Microsoft® Windows as the Authentication context class and the Authentication context comparison as exact.
Valid input
String
NameID format
Description
Specifies in which format the user ID is transferred to ARIS Administration.
Valid input
String
Clock skew (in seconds)
Description
Specifies the time offset between identity provider and service provider in seconds. Assertions are accepted if they are received within the permitted time frame.
Valid input
Integer > 0
Assertion lifetime (in seconds)
Description
Specifies the maximum lifetime of a SAML assertion in seconds.
Key
com.aris.umc.saml.assertion.ttl
Valid input
Integer > 0