Federation › Federation Security Services Guide › WS-Federation Authentication Scheme Reference › Auth. Scheme Properties--WS-Federation--Advanced Tab

Auth. Scheme Properties--WS-Federation--Advanced Tab

The Advanced tab is where you specify advanced configuration for the Message Extension Consumer API and optional redirect URLs for assertion processing errors during authentication.

The tab contains the following fields and controls:

Message Consumer Plugin Group Box

Full Java Class Name

(Optional) Specifies the fully qualified Java class name of a class which implements a Message Consumer Plug-in interface for the authentication scheme.

Parameter

If a value is entered in the Full Java Class Name field, this field specifies a string of parameters the API passes to the specified plug-in.

Status Redirect URLs and Modes Group Box

Assertion-based authentication can fail at the site that consumes assertions for various reasons. If authentication does fail, Federation Security Services provides functionality to redirect the user to different applications (URLs) for further processing. For example, when user disambiguation fails, SiteMinder can be configured to redirect the user to a provisioning system, which could create a user account based on the information found in SAML assertion.

The following options redirect the user to a configured URL based on the condition that caused the failure.

Redirect URL for the User Not Found Status

(Optional) Identifies the URL where SiteMinder redirects the user when the user is not found. The user not found status applies when the single sign-on message has no LoginID or the user directory does not contain the LoginID.

Redirect URL for the Invalid SSO Message Status

(Optional) Identifies the URL where SiteMinder redirects the user if one of the following conditions occur:

• The single sign-on message is not well formed, according to the XML specification
• The single sign-on message is invalid based on rules specified by the SAML schemas
• The consumer requires an encrypted assertion but the single sign-on message does not contain an encrypted assertion.

Redirect URL for the Unaccepted User Credential (SSO Message) Status

(Optional) Identifies the URL where SiteMinder redirects the user for all other error conditions other than when a user is not found or the single sign-on message is invalid. The assertion is valid, but SiteMinder does not accept the message for certain reasons, such as:

• XML digital signature validation fails
• XML decryption operation fails
• XML validation of conditions fails, such as an expired message or an audience mismatch
• None of the assertions in SSO message contain an authentication statement.

Mode

Specifies the method by which SiteMinder redirects the user to the redirect URL. The options are:

302 No Data (default)

Redirects user with an HTTP 302 redirect with a session cookie, but no other data.

Http Post

Redirects user using HTTP Post protocol.