At the producer site, determine how to deliver SAML assertions to a consumer. The assertion identifies the user to the consumer.
An assertion is an XML document that contains the following information:
For complete information about SAML assertions, refer to the SAML specification at the OASIS website.
To configure a SAML 1.x assertion
For the SAML 1.x artifact binding, the Assertion Consumer URL takes precedence over the SMCONSUMERURL query parameter, which is a required intersite transfer URL parameter. The user selects this URL to initiate single sign-on. Malicious users can modify the query parameter and can send the user to an unauthorized site for artifact retrieval. To prevent the user from being misdirected, specify a value for the Assertion Consumer URL.
Specifies the difference, in seconds, between the system clock at the Producer and the system clock at the Consumer. Skew Time is used for single sign-on and single logout.
For single sign-on, the value of the Skew Time and the single sign-on validity duration determine how long an assertion is valid. Review how the assertion validity is calculated to understand more about the skew time.
The Assertions page also contains the optional Attributes section. This section lets you include attributes in the assertion.
The SAML Assertion Generator creates an assertion that is based on a session for a user that has been authenticated at any authentication scheme protection level. You can control which users a producer generates assertions. You cannot control the protection level at which they are authenticated.
You can have resources that require a particular protection level. Your resources can be secured at different protection levels. Verify that when users authenticate they do so with the desired protection level.
For single sign-on, the values of the Skew Time and the Validity Duration determine how CA SiteMinder® calculates the total time that an assertion is valid. CA SiteMinder® applies the skew time to the generation and consumption of assertions.
Note: In this description, the asserting party is the SAML 1.x Producer, SAML 2.0 Identity Provider, or WS-Federation Account Partner. The relying party is the SAML 1.x Consumer, the SAML 2.0 Service Provider, or the WS-Federation Resource Partner.
In the assertion document, the NotBefore and NotOnOrAfter values represent the beginning and end of the validity interval.
At the asserting party, CA SiteMinder® sets the assertion validity. The validity interval is the system time when the assertion is generated. CA SiteMinder® sets the IssueInstant value in the assertion using this time then subtracts the skew time value from the IssueInstant value. The resulting time is the NotBefore value.
NotBefore=IssueInstant - Skew Time
To determine the end of the validity interval, CA SiteMinder® adds the Validity Duration value and the skew time to the IssueInstant value. The resulting time becomes the NotOnOrAfter value.
NotOnOrAfter=Validity Duration + Skew Time + IssueInstant
Times are relative to GMT.
For example, an assertion is generated at the asserting party at 1:00 GMT. The skew time is 30 seconds and the validity duration is 60 seconds, making the assertion validity interval between 12:59:30 GMT and 1:01:30 GMT. This interval begins 30 seconds before the time the assertion was generated and ends 90 seconds afterward.
At the relying party, CA SiteMinder® performs the same calculations as it does at the asserting party to determine if the assertion it receives is valid.
Calculating Assertion Validity with CA SiteMinder® at Both Sides of the Partnership
If CA SiteMinder® is at both sides of a partnership, the assertion validity is the sum of the validity duration plus two times the skew time. The equation is:
Assertion Validity = 2 x Skew Time (asserting party) + Validity Duration+ 2 x Skew Time (relying party)
The initial part of the equation (2 x Skew Time + Validity Duration) represents the beginning and end of the validity window at the asserting party. The second part of the equation (2 x Skew Time) represents the skew time of the system clock at the relying party. You multiply by 2 because you are accounting for the NotBefore and the NotOnOrAfter ends of the validity window.
Note: For legacy federation, the Validity Duration is only set at the asserting party.
Example
Asserting Party
The values at the asserting party are as follows:
Relying Party
The relying party uses the NotBefore and NotOnOrAfter values from the assertion and applies its skew time to those values. This formula is how the relying party calculates new NotBefore and NotOnOrAfter values.
Assertion Validity Window
Using the values in this example, the calculation for the total assertion validity window is:
120 seconds (2x60) + 60 seconds + 360 seconds (2x180) = 540 seconds (9 minutes).
In compliance with the SAML 1.x specification, CA SiteMinder® can enforce the one time use of an assertion. By generating an assertion for one-time use, the relying party knows not to retain the assertion for future transactions. Reusing an assertion beyond its validity results in authentication decisions using out-of-date identity information.
To configure an assertion for one time use
|
Copyright © 2014 CA.
All rights reserved.
|
|