Configure SAML in Smart ID Self-Service

Smart ID Self-Service has additional configuration options directly in the program. 

• Multiple Self-Service instances with the same tenant, but different authentication methods, are allowed. If, for example, there are two Self-Service instances and both of them use the same tenant, one instance can use SAML whereas the other one doesn't.
• Also, you can configure a button "Sign In with Single Sign-On" on the login page instead of automatically redirecting to the Identity Provider.

SAML and automatically redirecting are enabled by default, you can change this behavior in config.json.

1. To disable SAML for a Self-Service instance, add "enabled": false to its config.json. By default it is enabled. 

2. To turn of automatic redirecting to the Identity Provider, add "enforced": false to its config.json. By default it is enforced. This means that this instance of Self-Service will show a button "Sign In with Single Sign-On" on the login page. If SAML is disabled for this instance of Self-Service this property has no effect. With this option you can use Pre-Login Processes while having SAML enabled.

/prime-ussp/assets/config/config.json
 
...
{
  ...
 
  "saml": {
    "enabled": true
    "enforced": true
  }
}

Set up communication between Smart ID Self-Service and Identity Manager

1. Open the file \prime_ussp\WEB-INF\classes\application.yaml.
2. Adapt the baseUrl so that it points to where the Identity Manager main client is deployed. If you use HTTPS instead of HTTP you must ensure that the SSL server certificate of Identity Manager is trusted by the java environment that runs the Smart ID Self-Service (tomcat).
3. Make sure that cookie forwarding is activated, that is, that there are empty values for the property sensitiveHeaders for the SAML routes in the configuration file.

   This is the default configuration.
   
   

   Code Block
   title Example: application.yaml
   prime: … baseUrl: http://localhost:8080/idm … zuul: … routes: … saml: path: /saml/** sensitiveHeaders: url: ${prime.baseUrl}/saml/

   
   

After the service provider was configured successfully in the identity provider, the SAML metadata must be downloaded and uploaded in Identity Manager.

Example - Download the metadata from Digital Access: 

1. Go to Manage Resource Access > SAML Federation.
2. Click on the created service provider, to open it.
3. Go to the tab Export.
4. Click Download metadata.

5. Upload the metadata file to the SAML Authentication Profile in Identity Manager and select the Type as METADATA. No File Properties needs to be configured for the identity provider meta-data.

After the metadata files have been created they must be uploaded to the authentication profile in Identity Manager Admin. This section describes how to upload the identity provider metadata files. 

1. Open the SAML SSO authentication profile that was created earlier.
2. Go to the SAML Configuration tab.  
3. Under Identity Provider Configuration, do the following:
   1. In Configuration File, click the upload symbol to browse for and select the metadata file that has been provided from the identity provider, for example downloaded from Digital Access. 
   2. In Attribute Type, select either option for where the authentication information shall be communicated: 
      1. NameID refers to the subject of a SAML response. Use an appropriate value that matches the desired field in the CoreObject.
      2. Attribute Statement refers to attributes associated with the subject of a SAML response.
         
   3. If Attribute Statement was selected, then also enter one or more names in Attribute Name.