IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SAML inconsistent documentation?

    Posted 04/03/21 08:47 AM
    Can someone explain me what does the documentation mean in this page:
    https://www.ibm.com/docs/en/sva/10.0.1?topic=urls-endpoint-url-specifications
    It states that the endpoints (eg. for SSO) is 
    https://isam_hostname:port_number/junction_name/sps/federation_name/saml20/login
    But on this manual page, https://www.ibm.com/docs/en/sva/10.0.1?topic=profiles-saml-20-profile-initial-urls
    It states that the endpoints (e.g. for SSO) is
    https://isam_hostname:port_number/junction_name/sps/federation_name/saml20/logininitial
  ?RequestBinding=RequestBindingType
  &PartnerId=target_partner_provider_ID
  &NameIdFormat=NameIDFormatType
  &AllowCreate=AllowCreateValue
  &Target=target_application_location

    In other words, on manual pages states that it is login, while the other says it is logininitial????

    Which one to believe? Will both work, when to use one or the other?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: SAML inconsistent documentation?

    Posted 04/03/21 10:49 AM

    Hi Joao,

    the logininitial endpoint is the trigger endpoint. It's what you call to initiate an SSO flow. 


    the login endpoint is the endpoint that receives SAML messages. It is the true endpoint that you would configure at a partner system.

    Jon. 



    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: SAML inconsistent documentation?

    Posted 04/03/21 06:40 PM
    During the Web Browser Profile flow, and some point I am getting a Redirect to and junction/sps/wssoi.

    What is this wssoi?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: SAML inconsistent documentation?

    Posted 04/05/21 03:36 AM
    Hi Joao,

    To be more specific, the login endpoint is one of the SAML2 protocol Location urls mentioned in SAML2 metadata, for either the IdP (SingleSignOnService) or SP (AssertionConsumerService) depending on the role your federation has.

    The logininitial is a TFIM/ISAM/ISVA specific endpoint to start an SAML2 IdP initiated login (I know other products use different urls and querystring parameters to start the IdP initiated flows; Note that the use of Target in this context is IBM specific). The wssoi endpoint is meant to keep track of things as a user might or might not already have a valid session with the Point-of-Contact. 

    Peter

    ------------------------------
    Peter Gierveld
    Security Architect
    SecurIT
    Amsterdam
    ------------------------------

    Original Message


  • 5.  RE: SAML inconsistent documentation?

    Posted 04/05/21 07:20 AM
    When configuring the IdP, which parameter does the ISVA use in the SAML configuration, to fill the <saml:Audience> ??? </saml:Audience> in the <samlp:Response>
    In other words, If I need to change this parameter, where can I do it?

    I am also trying to replicate the browser behavior using "curl", but I am having a different response when invoking the SP /junction/sps/federation/saml20/login endpoint.
    In the browser I am getting an 302 while using the curl, I am getting a 200 OK?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 6.  RE: SAML inconsistent documentation?

    Posted 04/05/21 08:07 AM
    You can set by adding an AudienceRestriction attribute during the mapping rule.

    https://www.ibm.com/docs/en/sva/9.0.2?topic=mapping-local-identity-saml-20-token

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 7.  RE: SAML inconsistent documentation?

    Posted 04/05/21 08:44 AM
    Edited by Joao Goncalves 04/05/21 08:44 AM
    That link answers my question. Thanks.
    I have another question. When prompting the user for its credentials, usually Username, and password, I need to request another attribute. e. g. SSN.
    I will need to access this attribute in STSUU. How can I do it, or even use it to authenticate the user?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


Related Content