Integrate SAML applications

IDaaS can act as an Identity Provider (IdP) to perform SAML-based single sign-on (SSO) to third-party applications. IDaaS includes a number of cloud applications you can integrate for two-factor authentication. If you want to protect a cloud service that is not preconfigured with IDaaS, you can add it as a generic SAML service provider application.

You must have an IDaaS administrator role with View-level User Attribute Management privileges to add SAML applications to IDaaS. See Create, assign, and manage roles for more information on IDaaS roles.

For details on SAML login methods and prerequisites, see Manage login options.

note

See Preconfigured SAML applications for product-specific setup instructions.

Configure SAML assertion to include user authenticators or groups

When you add a SAML application to IDaaS, you can include an IDaaS user's authenticators (those used during an authentication session) and groups as part of the SAML assertion to an application. For example, if a user has authenticated with OTP and a Grid Card and belongs to Group1, Group2, and Group3, then the SAML Assertion can be configured to include those attributes as shown in the following example:

<AttributeStatement>
 <Attribute Name="http://schemas.xmlsoap.org/claims/Group">
   <AttributeValue>Group1</AttributeValue>
   <AttributeValue>Group2</AttributeValue>
   <AttributeValue>Group3</AttributeValue>
 </Attribute>
 <Attribute Name="Authenticators">
   <AttributeValue>NONE:OTP</AttributeValue>
   <AttributeValue>NONE:GRID</AttributeValue>
 </Attribute>
</AttributeStatement>

IDaaS supports customizing these SAML application assertions to include user-related attributes wherever an attribute is defined. These attributes are not tied directly to the user's record but are associated with the user through other entities or session information.

SAML XML request attributes and elements

IDaaS supports a configured request parameter, which can specify a login hint instead of using NameID.

IDaaS supports the following SAML XML request attributes and elements:

• NameID
• ForceAuthn
• RequestedAuthnContext class references

IDaaS does not support the following SAML XML request attributes and elements:

• AllowCreate
• IsPassive
• RequestedAuthnContext comparison semantics

note

IDaaS does not support authentication request signature verification.

Topics in this section

📄️Generic application

IDaaS includes a number of cloud applications for you to integrate with IDaaS for two-factor authentication. If you want to protect a cloud service that is not preconfigured with IDaaS, you can integrate it as a generic SAML service provider application.

📄️Signing certificates

SAML signing certificates contain a key pair that you associate with a SAML application. The private key signs the SAML responses that IDaaS returns to a SAML service provider for SAML authentication. You can export the signing certificate and import it into the SAML service provider to validate the signature that the SAML assertion returns.

📄️SAML metadata

If your SAML service provider supports updating SAML configuration using metadata, you can download the metadata from IDaaS. The download contains the signing certificate and other information you need to configure your service provider for IDaaS authentication.