Externe Benutzer - SAML 2.0 

Page / - last modified by gru on 16.07.2020, 14:14 

SAML 2.0 
last modified by gru
on 16.07.2020, 14:14

Table of Contents
Base settings
Name
Different name on form login button
Alias for callback URL (UUID)
Callback URL
Initially visible buttons
Send email to provider
Help
Add configuration
Configuration
Mapping to user attributes
Manage keystore
Extended settings

Content [ Hide ] 
•	Base settings
•	Name
•	Different name on form login button
•	Alias for callback URL (UUID)
•	Callback URL
•	Initially visible buttons
•	Send email to provider
•	Help
•	Add configuration
•	Configuration
•	Mapping to user attributes
•	Manage keystore
•	Extended settings
When adding a SAML 2.0 identity provider (e.g. Shibboleth 2.0) the parameters listed below can be configured.
Please note that it will only be possible in a future version of Xima® Formcycle to generate an XML file with the configurations made here, which can be read by the identity provider.
 
If such an XML configuration file is absolutely necessary for theidentity provider, it must be generated manually based on the settings made in Xima® Formcycle. The structure and the required information of such an XML file is usually documented by the identity provider. Alternatively, there are free online services that can assist in generating a suitable XML configuration file from the corresponding information. Please note that it is not possibile to download a standard keystore that was generated in Xima® Formcycle or to access its public key. If the public key is required for the configuration of the identity provider, a new JKS keystore with a suitable key pair must be created outside of Xima® Formcycle, whose public key can then be extracted and transferred to the XML configuration file. Further information about such keystores can be found in the submenu Manage keystore.
Base settings
 
Basic settings for the configuration of the SAML 2.0 identity provider.
Name
Name of the identity provider in Xima® Formcycle.
Different name on form login button
If a form has been configured to offer several authentication options, a dialog will be displayed when opening the form in which an authentication type has to be selected. The text content that should be on the button for this identity provider can be configured here. 
If nothing is entered here, the name entered under Name is used.
Alias for callback URL (UUID)
Unique identifier that is used when the identity provider returns to Xima® Formcycle. This value is generated automatically, but can be changed if necessary.
Callback URL
The URL which is used when returning from the identity provider to Xima® Formcycle is shown here and can be copied to the clipboard by clicking the copy icon to the right of the URL. 
Initially visible buttons
Below the base settings there are initially 3 buttons whose functions are intended to help with the configuration of the Facebook identity provider.
Send email to provider
Opens the e-mail program set up in the system with a pre-formulated request regarding the information required for the configuration of the identity provider in Xima® Formcycle. 
Help
Opens this help page in the browser.
Add configuration
If the required information has been provided by the identity provider, the area for the configuration of the identity provider can be opened by clicking on this button. Afterwards the area configuration which is described below opens.
 
Configuration options for an SAML 2.0 identity provider.
Configuration
•	Upload configuration: Pressing this button opens a file selection dialog, with which the configuration file supplied by the Identity Provider can be selected. By confirming the selection in the dialog, the file is uploaded.
•	FileName.xml: After a configuration file has been uploaded and the configuration was saved, it is possible to download the file here. The download is started by clicking on the file name or the symbol.
Mapping to user attributes
By clicking on Mapping to user attributes the configuration fields for mapping individual attributes can be made visible. SAML attributes can be configured for the following data. In each case, the name of the saml:attributes node must be specified.
•	Given name (firstname): first name of the user
•	Last name (familyName): Last name of the user
•	Display name (displayName): Display name of the user
•	Username (userName): User name of the user
•	Email (mail): Email address of the user
•	Language (locale): Language of the user
•	Location (location): Location of the user
•	Picture url (pictureUrl): Picture URL of the user
•	Profile url (profileUrl): Profile URL of the user

Manage keystore
By clicking on Manage keystore the settings for the keystore become visible. There are the following two buttons:
•	Create new keystore: Creates a new keystore with a new key pair
•	Update keystore file: Opens a file selection dialog with which an existing keystore can be selected and uploaded.
After uploading your own keystore, the following input fields also appear:
•	Keystore password: Password of the keystore
•	Keypair password: Password of the key pair
Own keystores must be Java keystores of type JKS, which contain a corresponding 2048-bit RSA key pair. Such a keystore can be generated, for example, with the utility program keytool for a certificate lifetime of approximately 10 years (3650 days) using the following command: keytool -genkeypair -alias ihr-alias -keypass ihr-passwort -keystore samlKeystore.jks -storepass ihr-passwort -keyalg RSA -keysize 2048 -validity 3650
 
Extended settings for configuring an SAML 2.0 identity provider.
Extended settings
With a click on Extended settings further parameters for the connection with the Identity Provider can be configured.
Service provider entity ID
Optional ID for identification against the Identity Provider.
Force authentication
Specifies whether a user should be forced to log in even if a valid session is still present.
Passive authentication
Specifies whether an authentication without interaction with the user should be tried.
User name qualifier
Specifies whether the authentication request should also send the NameQualifier. This is not required by the SAML standard, but for some identity providers it is necessary.
Authentication request signed
Specifies whether the authentication request should be digitally signed.
Logout request signed
Specifies whether the logout request should be digitally signed.
Wants assertions signed
Specifies whether the SAML statements (assertions) are requested to be digitally signed.
Wants response signed
Specifies whether the SAML responses should be digitally signed.
Max. authentication lifetime (seconds)
Maximum duration of an exisitng login to the identity provider. The default value is 3600 seconds.
Max. clock skew (seconds)
Maximum allowed difference in system clock times between the  Xima® Formcycle Server and the identity provider. The default value is 300 seconds.
Assertion consumer service index
Specifies the index of the Assertion Consuming Service to be used in the login request. The default value is -1, which is the default of the identity provider.
Attribute consumer service index
Specifies the index of the attribute consuming services which should be used for the authentication request. The default value is -1, which is the default of the identity provider.
Authentication request binding type
Specifies the transmission type with which Xima® Formcycle requests a login to the identity provider.
Response binding type
Specifies the transmission type with which the identity provider responds to a Xima® Formcycle login.
Logout request binding type
Specifies the transmission type with which Xima® Formcycle requests a logoff from identity provider.
Logout response binding type
Specifies the transmission type with which the identity provider responds to a logoff from Xima® Formcycle.
Signature canonicalization algorithm
Specifies the algorithm to be used to convert the signed request into a standardized XML form. http://www.w3.org/2001/10/xml-exc-c14n# is used by default.
Black listed signature signing algorithms
Algorithms that are forbidden for signing.
Signature algorithms
Algorithms allowed for signing.
Signature reference digest methods
Specifies the hash algorithms that are allowed when signing the SAML statements (assertions).