Problem: Customer or 3rd party vendor needs to know configuration options for setting up Identity Provider (IDP) initiated SAML.
Cause: As opposed to Service Provider (SP) initiated SAML, Identity Provider (IDP) needs more information from vendor on what is expected from webNetwork. Using IDP method can cause issues with "deep-links". For example, if there was a "deep-link" used in an email that went directly to 3rd party application it would not redirect user to webNetwork login page. This may or may not be desired behavior.
Prerequisite(s):
- webNetwork 6.3.0.198 or higher
- SAML 2.0
Solution(s): Below are configuration options available in webNetwork.
- Assertion Consumer (ACS) URL - received from vendor
- Target Resource URL (also called RelayState) - received from vendor
- Issuer* (optional) - received from vendor
- Audience** (optional) - received from vendor
- PublicKey (RSA 2048) - generated from our side, but can be shared with vendor if required
- Certificate (SHA1 or SHA256) - generated from our side, share with vendor
- SAML signature location - Response, Assertion, or both
* if not filled in will use value of https://www.opensaml.org/IDP
** if not filled in will use ACS URL
Reference(s):