5.2 Creating a Custom Connector Definition

A SAML connector definition consists of multiple components. SocialAccess contains an interface that allows you to create the components in one place.

To create a custom connector definition:

Verify that you have gathered the Web service or application requirements listed in Section 5.1, Meeting the Web Service or Application Requirements.
Log in to the SocialAccess appliance.
Access the Access Connector Toolkit through the following URL:
```
https://dns_name/css/toolkit
```
Click New > SAML2.

NOTE:This release of SocialAccess does not support the WSFed option.
Create the connector definition. For more information, see Section 5.2.1, Creating the Connector Definition.
Create the metadata. For more information, see Section 5.2.2, Creating the SAML 2.0 Metadata.
Create the assertions. For more information, see Section 5.2.3, Creating the Assertion.
(Optional) Create the provisioning definitions. For more information, see Section 5.2.4, Creating the Provisioning Definition.
Click Save to save the new connector definition.
Proceed to Section 5.3, Exporting the Connector Definition to complete the creation of the new connector.

5.2.1 Creating the Connector Definition

You must import a connector definition into the appliance for the connector to work. SocialAccess helps you create a connector definition.

Table 5-1 Connector Definition Fields

Field	Description	Action
Type	Defines the type of connector for SocialAccess. You cannot change the value of this field. It is set when you select the type of connector to create. For example: SAML2
Type Name	Defines the type name of the connector for SocialAccess. You cannot change the value of this field. It is set when you select the type of connector to create. For example: Generic SAML2 Connector
Target Name	The target name is the name of the connector definition file.	Specify a unique name for the connector definition file.
Icon	Allows you to use a custom graphic for your new connector.	Browse to and select a graphic that you want as the icon for the new connector.
Description for Provider	Not a functional field.	.
Description for Customer	Provide enough information so the administrator knows what the connector does.	Specify a description that the Admin page displays.
Settings > Federation Instructions	SocialAccess displays the Federation Instructions when you configure the connector.	Edit the default federation instructions for your connector. You must add information that is specific to your SocialAccess configuration.
Settings > New Settings	A setting provides a way for administrators to input data when creating the connector.	Create a setting for your connector. Customer-specific sections of the Assertion Consumer Service URL. Connector-specific setting. For example, a Customer Domain.

5.2.2 Creating the SAML 2.0 Metadata

The metadata is the configuration information the Web service or application uses to communicate to SocialAccess. Some Web services and applications allow you to export the required metadata to an XML file, or it is contained in a URL provided by the Web service or application. You can either import the XML file or specify the required information.

Table 5-2 Metadata Fields

Field	Description	Example
EntityID	Select whether the entity ID comes from the federation instructions or if it comes from the new setting you created when you created the connector definition. EntityID is a field from the metadata that uniquely identifies that particular service provider.	google.com
Assertion Consumer Service URL	Select whether the Assertion Consumer Service URL comes from the federation instructions or if it comes from the new setting you created when you created the connector definition. The Assertion Consumer Service URL is a field from the metadata where the Assertion is posted by the browser.	https://www.google.com/a/${customer-domain}/acs
Logout URL	(Optional) Specify a logout URL. The logout URL corresponds to the field SingleLogoutService from the metadata.
Logout Response URL	(Optional) Specify a logout response URL. The logout response URL is required when the SingleLogoutService field has ResponseLocation specified in the metadata.	The Connector for NetIQ Access Manager requires this field.
NameID Format	Specify the format of the NameID from the metadata. The NameID format field in the metadata tells the Identity Broker what NameID formats the service provider supports.
Signing Certificate	Browse to and select a certificate to securely communicate between the service provider and the Identity Broker.
Import from a file	You can import the metadata from a file or from a URL.
Import from URL	You can import the metadata from a file or from a URL.

5.2.3 Creating the Assertion

The assertion is a package of information that supplies statements made by the identity source.

Table 5-3 Assertion Fields

Fields	Description	Example
Audience Restriction	(Optional) Audience Restriction is a field in the Assertion that defines the recipient of the Assertion. Usually this is the same value as the EntityID, and if you leave the field blank the EntityID value is used for this field.	google.com
NameID	The NameID field in the Assertion defines what the service provider receives.
Format	The NameID format is an email address or it is unspecified. It depends on the requirements of the connected system as to which format you use.
Destination URL	(Optional) The Destination URL is where the end user ends up after the Identity Broker login with the URL provided on the connector configuration page.
Protocol Binding	The only binding currently supported is POST.

5.2.4 Creating the Provisioning Definition

Provisioning is supported only through connectors created by NetIQ. At this time, you cannot create a connector definition that supports provisioning user accounts to the connected system.