Federation › Federation Security Services Guide › SAML 2.0 Authentication Scheme Properties Reference › SAML 2.0 Auth. Scheme Properties Dialog--Advanced Tab

SAML 2.0 Auth. Scheme Properties Dialog--Advanced Tab

The Advanced tab is where you specify advanced configuration for the Message Extension Consumer API and optional redirect URLs for assertion processing errors during authentication.

The tab contains the following fields and controls:

Message Consumer Plugin Group Box

Full Java Class Name

(Optional) Specifies the fully qualified Java class name of a class which implements a Message Consumer Plug-in interface for the authentication scheme.

Parameter

If a value is entered in the Full Java Class Name field, this field specifies a string of parameters the API passes to the specified plug-in.

Status Redirect URLs and Modes Group Box

Assertion-based authentication can fail at the site that consumes assertions for various reasons. If authentication does fail, Federation Security Services provides functionality to redirect the user to different applications (URLs) for further processing. For example, when user disambiguation fails, SiteMinder can be configured to redirect the user to a provisioning system, which could create a user account based on the information found in SAML assertion.

The following options redirect the user to a configured URL based on the condition that caused the failure.

Redirect URL for the User Not Found Status

(Optional) Identifies the URL where SiteMinder redirects the user when the user is not found. The user not found status applies when the single sign-on message has no LoginID or the user directory does not contain the LoginID.

Redirect URL for the Invalid SSO Message Status

(Optional) Identifies the URL where SiteMinder redirects the user if one of the following conditions occur:

• The single sign-on message is not well formed, according to the XML specification
• The single sign-on message is invalid based on rules specified by the SAML schemas
• The consumer requires an encrypted assertion but the single sign-on message does not contain an encrypted assertion.

Redirect URL for the Unaccepted User Credential (SSO Message) Status

(Optional) Identifies the URL where SiteMinder redirects the user for all other error conditions other than when a user is not found or the single sign-on message is invalid. The assertion is valid, but SiteMinder does not accept the message for certain reasons, such as:

• XML digital signature validation fails
• XML decryption operation fails
• XML validation of conditions fails, such as an expired message or an audience mismatch
• None of the assertions in SSO message contain an authentication statement.

Mode

Specifies the method by which SiteMinder redirects the user to the redirect URL. The options are:

302 No Data (default)

Redirects user with an HTTP 302 redirect with a session cookie, but no other data.

Http Post

Redirects user using HTTP Post protocol.

Additional URL Configuration

Allows you to specify additional redirect URLs for HTTP status errors. The user can be redirected to a custom error page for further action.

Click this button to open the Additional URL Configuration dialog, which is described in the next topic.

Proxy Group Box

Server

If your network has a proxy server between the client and the system where Federation Web Services is running (that is, the system where Web Agent Option Pack is installed) specify the scheme and authority portions of the URL, such as protocol:authority. The scheme is http: or https: and the authority is //host.domain.com or //host.domain.com:port. For example, http://example.ca.com.