SAML2SSOProfile

Definition

This is the most common used SAML profile. It allows the IdP to identify users and to give such information to Service Providers. 

Screen overview

&&TODO&& se repite sign assertion, la segunda es sign Requests

Standard attributes

• Class: class name (readOnly field).
• Enabled: if it is checked (selected option is Yes) that protocol will be enable.
• Sign Responses:​ ausually it can be set to never, as long as the assertions are signed. Its preferable to sign responseassertions guaranteesrather than responses, because the assertion can be forwarded by the service provider thatto another service provider, but the response has been issued by the Identity Provider &&TODO&&
  • Conditional ¿Como funciona?
  • Always
  • Never
  •  
  not.
• Sign Assertions: it's advisable to sign every assertion, so it avoids assertion spoofing. The &&TODO&&assertion can be forwarded by the service provider to another service provider.
• Sign AssertionsRequest: &&TODO&&the identity provider will issue requests to service providers in order to perform the single logout process. Unless it is needed by any service provider, leave it to conditional.
• Encrypt Assertions: it'sis a gooddesired practicefeature, but some service provider, mainly public cloud service providers do not support it. Thus, the default value is to never encrypt, but you can set it to optional or always as needed.
  • If you set it to optional and the public key of the service provider who is going to receive the assertion is available, it will be used to encrypt assertions.it.
  Nevertheless,
  • If you set it makesto morenever, dificultit will not ever be encrypted in any case.
  • If you set it to diagnosealways, misconfigurationbut ofthe SAMLremote federation.service Disableprovider itencryption onlykey whenis needed.unknown, an exception will be raised.
• Encrypt NameIds: encrypt Name Ids when they are not part of an assertion.
• Assertion Proxy Count: sets the maximum number of SAML proxieshops that can forwardbe anaccepted for any assertion. A number of 0 standsdoes fornot noset limit.any limit
• Include Attribute Statement: on
  a
  • If SSOattribute profilestatements willare givenot included (selected value is No), the service provider everywill receive the SAML assertion with the principal name, then the service provider will issue a attribute boundstatement request to the identifiedservice user,provider avoidto get them.
  • If the need for extra attribute requests.statements
    are
    • Includeincluded Attribute(selected Statementvalue :is &&TODO&&Yes), estethe esperformance unis campoincreased deas textothis debajoadditional delstep checkis anteriorno longer needed. It is particularly recommended when using public cloud service providers.