Page Comparison

...

Once you have configured your Identity Provider to accept SAML authentication requests from Ubisecure SSO Server, the IDP Proxy method has been set up.

Sending AssertionConsumerServiceURL in the Authentication Message

Ubisecure SSO can send the AssertionConsumerServiceURL of the assertion consumer service associated with the IDP proxy authentication method. This feature can be turned on with the compatibility flag 'SendAssertionConsumerServiceURL'ExplicitUnspecifiedAuthnContextClassRef

Forces value urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified to AuthnContextClassRef in an outbound SAML2 Authentication Response. This is regardless of what might have been received in an inbound SAML2 Authentication Response. This improves compatibility with third-party applications and third-party identity providers which send different values than expected.

In all cases, negotiation between connected parties for agreed values for AuthnContextClassRef should be the first approach.

Compatibility Flags

There are various compatibility flags that can be used with SAML2 Authentication Methods.

SendAssertionConsumerServiceURL

Forces sending AssertionConsumerServiceURL. Some services require this optional element.

FinnishTrustNetwork

Forces sending the Finnish Trust Network SAML 2.0 Protocol Profile version 1.0 compliant SAML2 Extension ftn.

Note that only the information listed below is included in the element:

• • UI locale of the login page

An example of the included Extensions element is shown below.

SAML2 Extension for FTN