5.1 Meeting the Web Service or Application Requirements

In order to create a custom SAML 2.0 connector, the application or the Web service that connects to SocialAccess must meet the following requirements:

  • The Web service supports SAML 2.0 identity federation.

    For more information about SAML, see the OASIS Web site.

  • The Web service supports a SAML Web browser single sign-on (SSO) profile, specifically with Redirect/POST bindings for service provider-initiated SSO, and POST binding for identity provider-initiated SSO.

  • The Web service must provide a way for the customer to configure the federation. This usually means providing a facility in the application’s administration console that allows the customer to enable and configure SAML SSO.

  • The Web service or application must have technical documents that describe what it requires for the following:

    • SAML Assertions: The document needs to describe the attributes that are required for authentication, such as the user’s name or email address. It can include the attributes that are required to assign roles. If possible, obtain a SAML assertion from the application.

    • Federation Requirements: The document needs to describe what is required for federation. It should require an Identity Broker certificate, which allows the application to set the trusted relationship with the Identity Broker. The document should also include URLs for logging in and logging out.

    • SAML Metadata: The application sends SAML metadata to the Identity Broker in order to establish communication. This usually includes a login URL or a customer-specific domain name. Applications that support SAML should publish a SAML metadata document that describes their service. This document is often available from a public URL. If possible, get this document.

Ask the Web service or application vendors the following types of questions to gather the required information:

  • What does your SAML assertion look like?

  • Do you have a SAML metadata document? What fields, if any, are customer‐specific?

  • Does your service support the SAML single logout protocol?

  • What are the required configuration steps in your application to set up federation?

  • What is the information that you provide to customers when you are setting up federation with your LDAP server?