Define the SAML ID format
Follow these steps to define the ID format to receive from the SAML IdP.
The SAML Single sign-on (SSO) protocol allows federation of identities. This means that a single user can have different identities on different SAML IdPs. To federate the same user across several IdPs, the notion of ID format was introduced.
The default ID format is transient, meaning that the returned ID is only valid for the current session and has only a meaning for the IdP the Genero Application Server is connected to. Other formats exist such as email or persistent, but you must be sure that your IdP supports them, otherwise you will get an error. The IdP decides which format they support. See SAML core specification for more details about the supported ID format.
The ID format allows you to specify how the user is represented to a Service Provider. For GAS, it defines what piece of data is sent from the IdP to the GAS to represent the user.
To define the ID format you want to receive from your IdP, perform the following steps.
IDFORMAT
element with a valid SAML URN as a child of the SAML
DELEGATE
element in the application configuration
(xcf) file.
SAML_ID
environment
variables<?xml version="1.0"?>
<APPLICATION Parent="defaultgwc"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.4js.com/ns/gas/3.10/cfextwa.xsd">
<EXECUTION>
<PATH>$(res.path.qa)/applications/myapp</PATH>
<MODULE>App.42r</MODULE>
<DELEGATE service="services/SAMLServiceProvider">
<IDFORMAT>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</IDFORMAT>
</DELEGATE>
</EXECUTION>
</APPLICATION>
When set, the SAML_ID environment variable retrieved in the application program will be in
the format specified in the IDFORMAT
element of the configuration file.