This article is valid for Smart ID 20.11 and later.

Configure SAML in Smart ID Self-Service

Smart ID Self-Service has additional configuration options directly in the program. 

• Multiple Self-Service instances with the same tenant, but different authentication methods, are allowed. If, for example, there are two Self-Service instances and both of them use the same tenant, one instance can use SAML whereas the other one doesn't.
• Also, you can configure a button "Sign In with Single Sign-On" on the login page instead of automatically redirecting to the Identity Provider.

SAML and automatically redirecting are enabled by default, you can change this behavior in config.json.

1. To disable SAML for a Self-Service instance, add "enabled": false to its config.json. By default it is enabled. 

2. To turn of automatic redirecting to the Identity Provider, add "enforced": false to its config.json. By default it is enforced. This means that this instance of Self-Service will show a button "Sign In with Single Sign-On" on the login page. If SAML is disabled for this instance of Self-Service this property has no effect. With this option you can use Pre-Login Processes while having SAML enabled.

/prime-ussp/assets/config/config.json
 
...
{
  ...
 
  "saml": {
    "enabled": true
    "enforced": true
  }
}

Set up communication between Smart ID Self-Service and Identity Manager

1. Open the file \prime_ussp\WEB-INF\classes\application.yaml.
2. Adapt the baseUrl so that it points to where the Identity Manager main client is deployed. If you use HTTPS instead of HTTP you must ensure that the SSL server certificate of Identity Manager is trusted by the java environment that runs the Smart ID Self-Service (tomcat).
3. Make sure that cookie forwarding is activated, that is, that there are empty values for the property sensitiveHeaders for the SAML routes in the configuration file.

   This is the default configuration.
   
   

   Code Block
   title Example: application.yaml
   prime: … baseUrl: http://localhost:8080/idm … zuul: … routes: … saml: path: /saml/** sensitiveHeaders: url: ${prime.baseUrl}/saml/

   
   

After the service provider was configured successfully in the identity provider, the SAML metadata must be downloaded and uploaded in Identity Manager.

Example - Download the metadata from Digital Access: 

1. Go to Manage Resource Access > SAML Federation.
2. Click on the created service provider, to open it.
3. Go to the tab Export.
4. Click Download metadata.

5. Upload the metadata file to the SAML Authentication Profile in Identity Manager and select the Type as METADATA. No File Properties needs to be configured for the identity provider meta-data.