/
SAML2 SessionInitiator

SAML2 SessionInitiator

Advanced Configuration

Note, this is an advanced configuration feature. Most deployments can rely on the <SSO> shorthand element.

Indicated by type="SAML2", this initiator supports SAML 2.0 authentication requests. As a protocol handler, an entityID must be specified/known, which is then used to check for metadata with an <md:IDPSSODescriptor> role supporting SAML 2.0. The absence of either causes a warning to be logged and the handler otherwise ignores the request.

Attributes

Common Attributes

Specific Attributes

Name

Type

Default

Description

Name

Type

Default

Description

template 

local pathname

 

An HTML template used during transmission of the <samlp:AuthnRequest> message.

outgoingBindings 

space delimited list of URLs

 

List of SAML binding identifiers that determines the order of preferred <md:SingleSignOnService> bindings to use for the request. If this setting is used, failing to list a binding will prevent the use of an IdP that only supports the omitted binding.

acsByIndex

boolean

false

If true, the location of the assertion consumer service to return the assertion to is passed by reference (using an index), rather than passing an explicit URL and binding. Because of the difficulty of ensuring consistent indexing between local configuration and metadata, this is not an advisable feature

postArtifact 

boolean

false

If true, the SAML artifact binding is implemented using a form POST rather then a redirect.

isPassive 

boolean

false

If true, causes the <samlp:AuthnRequest>'s IsPassive attribute to be "true". Can be overridden by content setting or query string parameter

forceAuthn 

boolean

false

If true, causes the <samlp:AuthnRequest>'s ForceAuthn attribute to be "true". Can be overridden by content setting or query string parameter. This asks for forced reauthentication by the IdP (bypassing SSO)

authnContextClassRef 

URI

 

If set, inserts a <samlp:RequestedAuthnContext> element containing the class reference into the <samlp:AuthnRequest>. This can be a whitespace-delimited list of classes to request.
Can be overridden by content setting or query string parameter.
Tis can also be configured on a per-IdP basis via a RelyingParty setting (only applies if a more general value is not supplied)

authnContextComparison 

One of:
exact, minimum, maximum, better

exact

If set, inserts a <samlp:RequestedAuthnContext> element containing the comparison operator into the <samlp:AuthnRequest>.
Can be overridden by content setting or query string parameter. Ignored unless an authnContextClassRef value is set.