#### SAMLv2 Service Provider Customization

SAMLv2 service providers contain the following attribute groups:

- Assertion Content

- Assertion Processing

- Services

- Advanced

##### Assertion Content

- Request/Response Signing

- Encryption

- Certificate Aliases

- Name ID Format

- Authentication Context

- Assertion Time Skew

- Basic Authentication

##### Request/Response Signing

Select any checkbox to enable signing for the following SAMLv2 service prover requests or responses:

Authentication Requests Signed | All authentication requests received by this service provider must be signed.
Assertions Signed | All assertions received by this service provider must be signed.
POST Response Signed | The identity provider must sign the `PostResponse` element.
Artifact Response | The identity provider must sign the `ArtifactResponse` element.
Logout Request | The identity provider must sign the `LogoutRequest` element.
Logout Response | The identity provider must sign the `LogoutResponse` element.
Manage Name ID Request | The identity provider must sign the `ManageNameIDRequst` element.
Manage Name ID Response | The identity provider must sign the `ManageNameIDResponse` element.

##### Encryption

Select any checkbox to enable encryption for the following elements:

Attribute | The identity provider must encrypt all `AttributeStatement` elements.
Assertion | The identity provider must encrypt all `Assertion` elements.
NameID | The identity provider must encrypt all `NameID` elements.

##### Certificate Aliases

This attribute defines the certificate alias elements for the service provider. `signing` specifies the provider certificate alias used to find the correct signing certificate in the keystore. `Encryption` specifies the provider certificate alias used to find the correct encryption certificate in the keystore.

##### Name ID Format

Defines the name identifier formats supported by the service provider. Name identifiers are a way for providers to communicate with each other regarding a user. Single sign-on interactions support the following types of identifiers:

- `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`

- `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`

- `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`

- `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

A persistent identifier is saved to a particular user's data store entry as the value of two attributes. A transient identifier is temporary and no data will be written to the user's persistent data store

##### Authentication Context

This attribute maps the SAMLv2-defined authentication context classes to authentication methods available from the service provider.

Mapper

  Specifies the implementation of the `SPAuthnContextMapper` interface used to create the requested authentication context. The default implementation is `com.sun.identity.saml2.plugins.DefaultSPAuthnContexteMapper`.

Supported

  Select the check box next to the authentication context class if the identity provider supports it.

Context Reference

  The SAMLv2-defined authentication context classes are:

  - InternetProtocol

  - InternetProtocolPassword

  - Kerberos

  - MobileOneFactorUnregistered

  - MobileTwoFactorUnregistered

  - MobileOneFactorContract

  - MobileTwoFactorContract

  - Password

  - Password-ProtectedTransport

  - Previous-Session

  - X509

  - PGP

  - SPKI

  - XMLDSig

  - Smartcard

  - Smartcard-PKI

  - Software-PKI

  - Telephony

  - NomadTelephony

  - PersonalTelephony

  - AuthenticaionTelephony

  - SecureRemotePassword

  - TLSClient

  - Time-Sync-Token

  - Unspecified

Level

  Takes as a value a positive number that maps to an authentication level defined in the OpenSSO Authentication Framework. The authentication level indicates how much to trust a method of authentication.

  In this framework, each service provider is configured with a default authentication context (preferred method of authentication). However, the provider might like to change the assigned authentication context to one that is based on the defined authentication level. For example, provider B would like to generate a local session with an authentication level of 3 so it requests the identity provider to authenticate the user with an authentication context assigned that level. The value of this query parameter determines the authentication context to be used by the identity provider.

Comparison Type

  Specifies what the resulting authentication context must be when compared to the value of this property. Accepted values include:

  - exact where the authentication context statement in the assertion must be the exact match of, at least, one of the authentication contexts specified.

  - minimum where the authentication context statement in the assertion must be, at least, as strong (as deemed by the identity provider) one of the authentication contexts specified.

  - maximum where the authentication context statement in the assertion must be no stronger than any of the authentication contexts specified.

  - better where the authentication context statement in the assertion must be stronger than any of the authentication contexts specified.

  The default value is exact.

##### Assertion Time Skew

Assertions are valid for a period of time and not before or after. This attribute specifies a grace period (in seconds) for the `notBefore` value. The default value is `300`. It has no relevance to the `notAfter` value.

##### Basic Authentication

Basic authentication can be enabled to protect SOAP endpoints. Any provider accessing these endpoints must have the user and password defined in the following two properties: `User Name` and `Password`.

##### Assertion Processing

- Attribute Mapper

- Auto Federation

- Account Mapper

- Transient User

- URL

- Default Relay State

- Adapter

##### Attribute Mapper

Specifies the values to define the mappings used by the default attribute mapper plug-in. The default plug-in class is `com.sun.identity.saml2.plugins.DefaultSPAttributeMapper`.

Mappings should be configured in the format:

SAML-attribute=local-attribute

For example, `EmailAddress=mail` or `Address=postaladdress`. Type the mapping as a New Value and click Add.

##### Auto Federation

If enabled, Auto-federation automatically federates a user's different provider accounts based on a common attribute. The Attribute field specifies the attribute used to match a user's different provider accounts when auto-federation is enabled.

##### Account Mapper

Specifies the implementation of the `AccountMapper` interface used to map a remote user account to a local user account for purposes of single sign-on. The default value is `com.sun.identity.saml2.plugins.DefaultSPAccountMapper`, the default implementation.

##### Artifact Message Encoding

This attribute defines the message encoding format for artifact, either `URI` or `FORM`.

##### Transient User

This attribute specifies the identifier of the user to which all identity provider users will be mapped on the service provider side in cases of single sign-on using the transient name identifier.

##### URL

The Local Authentication URL specifies the URL of the local login page.

The Intermediate URL specifies a URL to which a user can be directed after authentication and before the original request's URL. An example might be a successful account creation page after the auto-creation of a user account.

The External Application Logout URL defines the logout URL for an external application. Once the server receives logout request from the remote partner, a request will be sent to the logout URL using back channel `HTTP POST` with all cookies. Optionally, a user session property could be sent as `HTTP header` and `POST` parameter if a query parameter `appsessionproperty` (set to the session property name) is included in the URL.

##### Default Relay State

After a successful SAML v2 operation (single sign-on, single logout, or federation termination), a page is displayed. This page, generally the originally requested resource, is specified in the initiating request using the `RelayState` element. If a `RelayState` is not specified, the value of this `defaultRelayState` property is displayed..

Caution – When `RelayState` or `defaultRelayState` contains special characters (such as `&`), it must be URL-encoded. For example, if the value of `RelayState` is `http://www.sun.com/apps/myapp.jsp?param1=abc&param2=xyz`, it must be URL-encoded as:

`http%3A%2F%2Fwww.sun.com%2Fapps%2Fmyapp.jsp%3Fparam1%3Dabc%26param2%3Dxyz`

and then appended to the URL. For example, the service provider initiated single sign-on URL would be:

`http://`host`:`port`/`deploy-uri`/saml2/jsp/spSSOInit.jsp?metaAlias=/sp&idpEntityID=http://www.idp.com&RelayState=http%3A%2F%2Fwww.sun.com%2Fapps%2Fmyapp.jsp%3Fparam1%3Dabc%26param2%3Dxyz`

##### Adapter

Defines the implementation class for the `com.sun.identity.federation.plugins.FederationSPAdapter` interface, used to add application-specific processing during the federation process.

##### Services

- Meta Alias

- Single Logout Service

- Manage Name ID Service

- Assertion Artifact Consumer Service

##### Meta Alias

Specifies a `metaAlias` for the provider being configured. The `metaAlias` is used to locate the provider's entity identifier and the organization in which it is located. The value is a string equal to the realm or organization name (dependent on whether the SAML v2 Plug-in for Federation Services is installed in OpenSSO) coupled with a forward slash and the provider name. For example, `/suncorp/travelprovider`.

Caution – The names used in the `metaAlias` must not contain a `/`.

##### Single Logout Service

The Single Logout Service synchronizes the logout functionality across all sessions authenticated by the service provider.

`Location` specifies the URL of the provider to which the request is sent. `Response Location` specifies the URL the expected response provider. The binding types are:

- HTTP Redirect

- POST

- SOAP

##### Manage Name ID Service

This services defines the URLs that will be used when communicating with the service provider to specify a new name identifier for the principal. (Registration can occur only after a federation session is established.)

`Location` specifies the URL of the provider to which the request is sent. `Response Location` specifies the URL the expected response provider. The binding types are:

- HTTP Redirect

- POST

- SOAP

##### Assertion Artifact Consumer Service

This service processes the responses that a service provider receives from an identity provider. When a service provider wants to authenticate a user, it sends an authentication request to an identity provider.

- HTTP-Artifact specifies a non-browser SOAP-based protocol.

- HTTP-Post specifies a browser-based HTTP POST protocol.

- PAOS defines the URL location for PAOS binding.

`Location` specifies the URL of the provider to which the request is sent. `Index` specifies the URL in the standard metadata. `Default`is the default URL to be used for the binding.

##### Advanced

- SP URL

- SP Logout URL

- App Secret List

- Request IDP List Finder Implementation

- Request IDP List Get Complete

- Request IDP List

- IDP Proxy

- Introduction

- Proxy Count

- IDP Proxy List

##### SP URL

Defines URL endpoint on Service Provider that can handle SAE (Secure Attribute Exchange) requests. If this URL is empty (not configured), SAE single sign-on will not be enabled. Normal SAMLv2 single sign-on responses will be sent to the service provider.

##### SP Logout URL

Defines the URL endpoint on a Service Provider that can handle SAE global logout requests.

##### App Secret List

This attribute defines the application security configuration. Each application must have one entry. Each entry has the following format:

`url=SPAppURL|type=`symmetric_orAsymmetric`|secret=`ampassword encoded shared secret``

##### Request IDP List Finder Implementation

Defines the implementation class of the IDP list finder SPI. This returns a list of preferred identity providers that are trusted by the ECP.

##### Request IDP List Get Complete

Specifies a URI reference that can be used to retrieve the complete identity provider list if the `IDPList` element is not complete.

##### Request IDP List

Defines a list of identity providers for the ECP to contact. This is used by the default implementation of the IDP Finder (for example, `com.sun.identity.saml2.plugins.ECPIDPFinder`) .

##### IDP Proxy

Proxy Authentication Configuration attributes define values for dynamic identity provider proxying. Select the check box to enable proxy authentication for a service provider.

##### Introduction

Select the check box if you want introductions to be used to find the proxying identity provider.

##### Proxy Count

Enter the maximum number of identity providers that can be used for proxy authentication.

##### IDP Proxy List

Add a list of identity providers that can be used for proxy authentication. Type the URI defined as the provider's identifier in New Value and click Add.