SAML2ArtifactResolutionProfile

Definition

This profile is used when the Service Provider wants to resolve or check a received assertion. The profile configuration settings are quite similar to those present in SAML2SSOProfile:

Screen overview

1 &&TODO&& se repite sign assertion, la segunda es sign Requests

2 &&TODO&&  En encrypt assertions no hay lista desplegable

3 &&TODO&& ¿Que ocurre si selecciono la opcion en blanco? ¿cómo se comportaría?

Standard attributes

• Class: class name.name (readOnly field).
• Enabled: if it is checked (selected option is Yes) that protocol will be enabled.enable.
• Sign Responses:​ ausually it can be set to never, as long as the assertions are signed. Its preferable to sign responseassertions guaranteesrather than responses, because the assertion can be forwarded by the service provider thatto another service provider, but the response has been issued by the Identity Provider &&TODO&&
  • Conditional ¿Como funciona?
  • Always
  • Never
  •  
  not.
• Sign Assertions: it's advisable to sign every assertion, so it avoids assertion spoofing. The &&TODO&&assertion can be forwarded by the service provider to another service provider.
• Sign AssertionsRequest: &&TODO&&the identity provider will issue requests to service providers in order to perform the single logout process. Unless it is needed by any service provider, leave it to conditional.
• Encrypt Assertions: it'sis a gooddesired practicefeature, but some service providers, mainly public cloud service providers do not support it. Thus, the default value is to never encrypt, but you can set it to optional or always as needed.
  • If you set it to optional and the public key of the service provider who is going to receive the assertion is available, it will be used to encrypt assertions.it.
  Nevertheless,
  • If you set it makesto morenever, dificultit will not ever be encrypted in any case.
  • If you set it to diagnosealways, misconfigurationbut ofthe SAMLremote federation.service Disableprovider itencryption onlykey whenis needed.unknown, an exception will be raised.
• Encrypt NameIds: encryptshould Namebe Idslet whento they are not part of an assertion.never.

&&TODO&&