Federation Manager Guide › Delegated Authentication for Federation Users › Delegated Authentication Configuration › Sample Configuration

Sample Configuration

The following sample configuration is from the perspective of a SAML 2.0 IdP > SP partnership. The delegated authentication settings are on the SSO and SLO tab of the Partnership wizard.

This sample configuration reflects a SAML 2.0 configuration. The Identity Provider is http://idp1.xyz.com and the third-party WAM system is http://wamservice.xyz.com.

To configure cookie delegated authentication

1. Log in to the Federation Manager UI.
2. Create a partnership or edit an existing one.

   Note: To edit a partnership, deactivate it first.

3. Navigate to the SSO and SLO step in the Partnership wizard.
4. In the Authentication group box, set the fields as follows:
   • Authentication Mode

     Delegated

   • Delegated Authentication Type

     Select the cookie option that suits your environment.

     Legacy cookie

     For Java-only applications

     Open format cookie

     For use with a web access management application. You can use a Federation Manager SDK to create a Java or .NET application or you can use an application written in another language, provided you build the open format cookie manually.

     If you require FIPS 140-2 encryption, you must create the open format cookie using the Federation Manager Java or .NET SDK.

   • Delegated Authentication URL

     http://wamservice.xyz.com

     This is the URL of the third-party WAM system that authenticates users and uses a Federation Manager SDK to create the cookie.

   • Authentication Class

     Enter the authentication method used at the third party. For example:

     urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos

5. Continue with partnership configuration.
6. Communicate all the Cookie Settings on the Infrastructure, Deployment Settings dialog to the third-party WAM system.

   These values are used in the creation of the cookie.

To configure query string delegated authentication

1. Log in to the Federation Manager UI.
2. Create a partnership or edit an existing one.

   Note: To edit a partnership, deactivate it first.

3. Navigate to the SSO and SLO step in the Partnership wizard.
4. In the Authentication group box, set the fields as follows:
   • Authentication Mode

     Delegated

   • Delegated Authentication Type

     Query String

   • Delegated Authentication URL

     http://wamservice.xyz.com

     This is the URL of the third-party WAM system that authenticates users and constructs the redirect URL back to Federation Manager with the query parameters.

   • Hash Secret

     FederatedAuth1

     The third-party WAM system uses this secret to hash the login ID.

   • Confirm Hash Secret

     FederatedAuth1

   • Authentication Class

     Enter the authentication method used at the third party. For example:

     urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos

5. Continue with partnership configuration.