SAML Service Provider Configuration
The Token Server can act as a SAML Service Provider during the authentication of a user, for this reason the Token Server exposes metadata. The SAML metadata exposed by the Token Server can be found via the url
oauth/saml/metadata. This section describes how to adapt the values used in the metadata for this Service Provider.
In order to configure SAML Service provider usage, go to the
Configuration section of the administration console, then
System and choose the
SAML Service provider tab.
- Configure location of the SAML velocity log file
- Configure Metadata of the SAML Service Provider
- Configure SAML requests signing
- Confgure SLO (Single logout) feature-feature)
The picture below shows the
SAML Service provider view in the Admin Console with an example configuration.
Configure location of the SAML velocity log file
In order to configure location of the SAML velocity log file set the following field:
|Field name||Default value||Description|
|Velocity log location||/tmp/velocity.log||Location on the file system where the velocity log file generated by the SAML module will be stored.|
Note: Applying this value change requires a restart of the Token Server Engine Application.
Configure Metadata of the SAML Service Provider
In order to configure Metadata for the SAML Service Provider configure the following fields:
Configure SAML requests signing
In order to configure SAML requests signing set the following fields:
|Field name||Required||Default value||Description|
|Private key||yes||empty||The private key used by the SAML Service Provider to sign requests.|
|Certificate||yes||empty||The public key / certificate of the SAML Service Provider which can be used by the IDP to validate the signature.|
|Keystore password||yes||empty||Password used to encrypt the SAML Service Provider key store.|
Confgure SLO (Single logout) feature
The goal of the SLO feature is to logout user from a web client when their SAML session is terminated by the SAML Identity Provider. In order to configure using SLO configure the following fields:
Note: Applying SLO cache TTL value change requires Token Server Engine Application to be restarted.