#### WS-FED Service Provider Customization

The following attributes apply to the WS-FED service provider role:

##### Assertion Signed

All assertions received by this service provider must be signed.

##### Account Mapper

This attribute specifies the implementation of the `AccountMapper` interface used to map a remote user account to a local user account for purposes of single sign-on. The default value is `com.sun.identity.wsfed.plugins.`

`DefaultADFSPartnerAccountMapper` is the default implementation.

##### Attribute Mapper

This defines the class used to map attributes in the assertion to user attributes defined locally by the identity provider. The default class is `com.sun.identity.wsfederation.plugins.DefaultSPAttributeMapper`.

##### Attribute Map

Specifies values to define the mappings used by the default attribute mapper plug-in. Mappings should be configured in the format:

SAML_attr=local-attribute

For example, `EmailAddress=mail` or `Address=postaladdress`. Type the mapping as a New Value and click Add.

##### Assertion Effective Time

Assertions are valid for a period of time and not before or after.

`Effective Time` specifies (in seconds) the amount of time that an assertion is valid counting from the assertion's issue time. The default value is `600` seconds.

##### Assertion Skew Time

Assertions are valid for a period of time and not before or after. This attribute specifies a grace period (in seconds) for the `notBefore` value. The default value is `300`. It has no relevance to the `notAfter` value.

##### Default Relay State

After a successful WS-FED operation (single sign-on, single logout, or federation termination), a page is displayed. This page, generally the originally requested resource, is specified in the initiating request using the `RelayState` element. If a `RelayState` is not specified, the value of this `defaultRelayState` property is displayed.

Caution – When `RelayState` or `defaultRelayState` contains special characters (such as `&`), it must be URL-encoded. For example, if the value of `RelayState` is `http://www.sun.com/apps/myapp.jsp?param1=abc&param2=xyz`, it must be URL-encoded as:

`http%3A%2F%2Fwww.sun.com%2Fapps%2Fmyapp.jsp%3Fparam1%3Dabc%26param2%3Dxyz`

and then appended to the URL. For example, the service provider initiated single sign-on URL would be:

`http://`host`:`port`/`deploy-uri`/saml2/jsp/spSSOInit.jsp?metaAlias=/sp&idpEntityID=http://www.idp.com&RelayState=http%3A%2F%2Fwww.sun.com%2Fapps%2Fmyapp.jsp%3Fparam1%3Dabc%26param2%3Dxyz`

##### Home Realm Discovery

Specifies the service so that the service provider can identify the preferred identity provider. The service URL is specified as a contact endpoint by the service provider.

##### Account Realm Selection

Specifies the identity provider selection mechanism and configuration. Either the `cookie` or `HTTP Request` header attribute can be used to locate the identity provider.