This article explains how to add a remote service provider (SP) as part of the IDP configuration.
It is not about configuring Airlock IAM as SAML SP.
The article is based on the first steps of the SAML IDP setup.
This article explains how to add a remote service provider (SP) as part of the IDP configuration.
It is not about configuring Airlock IAM as SAML SP.
The article is based on the first steps of the SAML IDP setup.
Adding an SP to the IDP configuration involves the following configuration parts:
Part | Purpose |
---|---|
Metadata file | The SAML metadata file contains information about the SP in a standardized XML format. It is usually provided by the service provider. |
Extended metadata file | The extended SAML metadata file contains additional information about the remote SP in an XML file. It is not provided by the service provider (unless the SP is an Airlock IAM). |
SAML settings | The SP configuration within the IDP configuration in the IAM configuration (Config editor). |
Target application | A target application configuration for remote SP. This involves an authentication flow and an identity propagator suitable for SAML. |
The SP metadata file contains all standardized information about the remote SP. It contains public keys, SAML endpoints (URLs), supported SAML bindings, and encryption/signing preferences.
The file should be provided by the service provider.
The transfer of the SP metadata file to the IDP must be authentic, i.e., before using it, you must make sure it really belongs to the remote SP. Failing to do so, may result in severe security flaws.
If the remote SP does not provide you with a ready-to-use metadata file but only the relevant data (URLs, public keys, etc.) you may use the following template file to create a valid metadata file.
https://remote-sp1.com/auth/saml/
as entity ID.The extended metadata file contains IAM-specific information and is not provided by the service provider unless the service provider is an Airlock IAM as well.
To create the extended SP metadata file, the following XML template file may be used as starting point.
cp sp-extended-template.xml instances/auth/saml/
remote-sp1-extended.xml
https://remote-sp1.com/auth/saml/
hosted
attribute in the element EntityConfig
must be 0
or false
. To add the remote SP to the IDP settings, open the IAM Config Editor and perform the following steps.
value https://remote-sp1.com/auth/saml/
. We suggest that the entity ID should be included in the plugin identifier so it is easier to choose the right SP Entity ID plugin when configuring the target application later on.instances/auth/saml/remote-sp1.xml
instances/auth/saml/remote-sp1-extended.xml
remote-sp1-application
as ID.In this step, a target application is configured for the application accessed on the remote SP. Just like any other target application definition, it basically tells Airlock IAM how to authenticate users and how to propagate the user's identities to the protected application.
To access the remote SP's protected application - regardless of whether the SAML flow was started on the IDP (in this case Airlock IAM) or the SP - the authentication flow of the target application has to be passed.
To configure the target application for the remote SAML SP, do the following:
remote-sp1-application
.https://remote-sp1.com/auth/saml/
.If using Airlock IAM's web UI (Loginapp UI) do not forget to add a UI configuration for the target application.
See Using the Loginapp UI with SAML.
Note that the configured Target URI Resolver is ignored for SAML. The SAML implementation determines the target URI itself. In the case of IDP-initiated SSO, the URI defined in property Relay State URI (IdP-Initiated SSO) (in the SP configuration, see above) is used.
If using SAML with a custom web UI (SPA), consider using property Custom Header URI Propagation Settings in the SAML 2.0 Identity Propagator plugin. It defines how redirect URIs are made available to the custom UI so that it can redirect the browser to them after identity propagation.
Activate the configuration to make the changes effective.
Make sure to use an up-to-date Airlock Gateway mapping template file (IAM 7.6 or newer) and activate the SAML allow rule.
If any of the SAML metadata files are changed, a restart of the IAM instance may be necessary.