Federation Manager Guide › Federation Partnerships › Back Channel Authentication for Artifact SSO

Back Channel Authentication for Artifact SSO

Artifact single sign-on requires the relying party to send an artifact to the asserting party to retrieve the assertion. The asserting party uses the artifact to retrieve the correct assertion and then it returns the assertion to the relying party over a back channel, which is typically secured.

You can require an entity to authenticate to access the back channel. The back channel can also be secured using SSL, though SSL is not required.

Securing the back channel using SSL involves:

• Enabling SSL.

  SSL is not required for Basic authentication but you can use Basic over SSL. SSL is required for Client Cert authentication.

• Configuring an incoming or outgoing back channel for the SAML 2.0 communication exchange. The direction you configure depends on the role of the local entity.

  Configuring separate channels is supported only for SAML 2.0. The back channel configuration for SAML 1.1 artifact single sign-on uses a single configuration for each partnership, and Federation Manager uses the correct direction automatically (incoming for a local producer and outgoing for a local consumer).

  Choose which direction to configure for SAML 2.0 single sign-on based on the entity you are configuring.

  • Incoming channel is used by the local asserting party
  • Outgoing channel is used by the local relying party

  Note: Although you can configure an incoming and outgoing back channel, a given channel can have only one configuration. If two services use the same channel, these two services must use the same back channel configuration. For example, if the incoming channel for a local asserting party is used for HTTP-Artifact SSO and SLO over SOAP, these two services must use the same back channel configuration.

• Choosing the type of authentication required for the relying party to gain access across the protected back channel. The authentication method applies per channel (incoming or outgoing).

  The options for back channel authentication are:

  • Basic

    Indicates that a Basic authentication scheme is protecting the back channel.

    Note: Basic authentication can be selected if SSL is enabled for the back channel; however, you can use Basic authentication without SSL.

  • Client Cert

    Indicates that SSL with an X.509 client certificate protects the asserting party back channel.

    If you select Client Cert as the authentication method, all endpoint URLs have to use SSL communication. This means that the URLs must begin with https://. Endpoint URLs locate the various SAML services on a server, such as single sign-on, single logout, the Assertion Consumer Service, Artifact Resolution Service (SAML 2.0), and the Assertion Retrieval Service (SAML 1.x).

  • NoAuth

    Indicates that the relying party is not required to supply credentials. The back channel and Artifact Resolution Service are not secured. You can still enable SSL with this option. The back channel traffic is encrypted but no credentials are exchanged between parties.

    Use the NoAuth option for testing purposes but not for production, unless Federation Manager is configured for SSL-enabled failover and sits behind a proxy server. In this case, if client certificate authentication is used to protect the back channel, the proxy server handles the authentication because it has the server certificate. In that case, all IdP->SP partnerships should use NoAuth as the authentication type.

  Important! The authentication method chosen for the incoming back channel must match the authentication method for the outgoing back channel on the other side of the partnership. Agreeing on the choice of authentication method is handled out of band.

To configure back channel authentication

1. Begin at the Back Channel group box in the SSO and SLO step of the Partnership wizard.
2. Select HTTP-Artifact in the SSO group box.

   The Authentication Method field becomes active.

3. Select the type of authentication method for the incoming and/or outgoing back channel.

   Note: You can click Help for a description of fields, controls, and their respective requirements.

   If you select No Auth as the authentication method, no additional steps are required.

4. Depending on the authentication method you choose, several additional fields are displayed for you to configure.

   Note: You can click Help for a description of fields, controls, and their respective requirements.

After entering values for all the necessary fields, the back channel configuration is complete. You can enable SSL on each side of the connection for added security.