Federation Security Services Guide › Deploying Federation without the FSS Sample Application › Test SAML 2.0 Single Sign-on

Test SAML 2.0 Single Sign-on

To test single sign-on in an FSS-to-FSS network, you can use the web pages included with the FSS sample application, provided you have previously run the FSS sample application script. If you do not run the FSS sample application, you have to use your own web pages to test single sign-on.

The sample application web pages are located in the following two folders.

policy_server_home/samples/federation/content/idpsample

policy_server_home/samples/federation/content/spsample

• policy_server_home

  Specifies the installed location of the SiteMinder Policy Server.

Important! If you have run the sample application, the idpsample and spsample folders are automatically copied into your web server's document root directory.

If you choose to use your own html page to test SP-initiated single sign-on, the HTML page must contain a hard-coded link to the AuthnRequest service. For this deployment, the sample link for POST binding is:

http://www.sp.demo:81/affwebservices/public/saml2authnrequest?ProviderID=idp.demo

The AuthnRequest Service redirects the user to the Identity Provider specified in the link to retrieve the user's authentication context. After the Identity Provider authenticates the user and establishes a session, it directs the user back to the target resource at the Service Provider.

Note: The ProviderID in the Authnrequest link must match the IdP ID field value specified by the SAML authentication scheme at the SP. The IdP ID field is located on the Scheme Setup tab of the Authentication Scheme Properties dialog.

After running the sample application, you should can test single sign-on.

To test federated single sign-on

1. Open up a browser.
2. Enter the URL for the web page that has links to trigger single sign-on.
   • For IdP-initiated single sign-on, access the index.jsp page at:

     http://www.idp.demo:server_port/idpsample/index.jsp
     

   • For SP-initiated single sign-on, access the index.jsp page at:

     http://www.sp.demo:server_port/spsample/index.jsp
     

   The following figure is the IdP.demo home page:

   

   The following figure is the SP.demo home page:

   

3. Click on the SAML2 POST profile link.

   A login challenge like the following is presented:

   

4. Using the login of an existing user in your user store, enter the user's credentials. For example, if Tuser1 is a user in the user store, enter the credentials for this user.

   If single sign-on is successful, you should see the following welcome page:

   

5. After you test single sign-on, you can Add Functionality to the Federation Deployment.