SAML2 - Generic Identity Provider node

The SAML2 - Generic Identity Provider node enables authentication through an external SAML 2.0 Identity Provider (IdP).

This node is available in: Authentication, Library

Service Provider configuration

• Name: From the dropdown select the Service Provider Configuration already created on the dedicated Service Provider section.

• Attribute Consuming Services: The Attribute Consuming Services define which user attributes the Service Provider (SP) requests from the Identity Provider (IdP) as part of the SAML authentication process. You can add attributes based on the configuration already defined on the dedicated Service Provider section.

• Signing Algorithm: The Signing Algorithm defines the cryptographic algorithm used to sign SAML messages and assertions. Available options:

  • http://www.w3.org/2000/09/xmldsig#rsa-sha1
  • http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
  • http://www.w3.org/2001/04/xmldsig-more#rsa-sha384
  • http://www.w3.org/2001/04/xmldsig-more#rsa-sha512

Identity Provider configurations

• Load from File: It is possible to load the SAML metadata information from a file to be uploaded.

• General Configurations:

  • Entity ID: Specify the unique identifier of the Identity Provider (IdP). It is used to identify the IdP in the SAML exchange.

  • Name ID Format: Define the format of the user identifier returned in the SAML assertion (e.g., persistent, transient, email).

  • Authentication Context reference: Specify the required authentication context (e.g., password, MFA).

  • Comparison of Authentication Context: Define how the requested authentication context is evaluated (Exact, Minimum, Better, Maximum).

• Single Sign-On Services: Define one or more SSO endpoints of the Identity Provider. Multiple entries can be added using the UI's repeatable list control. At least one SSO endpoint is required. For each entry, define:

  • Binding: (e.g., HTTP-Redirect, HTTP-POST)

  • Location: (URL) – IdP endpoint for authentication requests

• Single Logout Sign-On Services: Define the logout endpoints of the Identity Provider. Multiple entries can be added using the UI's repeatable list control. For each entry, define:

  • Binding: For example, HTTP-Redirect or HTTP-POST

  • Location: (URL) – IdP endpoint for authentication requests

  • Response Location: (URL) – If the response should go to a different endpoint.

• Signing Options: Defines which SAML messages must be signed:

  • IdP requires signed authentication requests
  • IDP signs POST responses
  • IDP signs Logout request
  • IDP signs Logout responses
  • IDP requires signed logout requests
  • IDP requires signed logout responses

• Signing Key: Define the Certificate used when signing is required by the IdP.

• Attributes: Define how SAML attributes are mapped. Multiple attribute mappings can be added using the UI's repeatable list control:

  • Name: Attribute name from the SAML assertion

  • Descriptive Name: Internal or friendly name

Default output node

• Success
• Failure

JSON metadata

{
    "name": "saml2",
    "active": true,
    "bundleName": "am-saml-nodes",
    "bundleVersion": "1.0",
    "nodeName": "GenericSAML2",
    "category": "federated_identity_providers",
    "deprecated": false,
    "displayName": [{
            "lang": "en",
            "value": "SAML2 - Generic Identity Provider"
        }, {
            "lang": "it",
            "value": "SAML2 - Generic Identity Provider"
        }
    ],
    "flowCategory": [
        "auth"
    ],
    "flowType": [
        "library"
    ],
    "index": 1,
    "inputs": [{
            "name": "Input"
        }
    ],
    "outputs": [{
            "name": "Success",
            "level": "success"
        }, {
            "name": "Failure",
            "level": "error"
        }
    ]
}