...
The Service Provider is a production SAML deployment that supports SAML V2.0 HTTP-POST binding.
Please note that a list of all connected services will be made publicly available. This mean that your service can not be "hidden" or anything.
As a result, services are required to have a valid TLS configuration (including their SAML endpoints) using certificates from a trusted CA:
- For production services that are operated by GEANT this must be a TCS certificate (Digicert at the moment).
- For non-production services and services operated by 3rd parties, this can be any trusted CA, including LetsEncrypt.
Required information
Please send the following information to aai-is@lists.geanthelp@geant.org:
| Information | Description | Example | stored in/mapped to (internally) | |||
|---|---|---|---|---|---|---|
| Technical contact |
Can be a list | support@it.geant.org | contacts['technical'] | |||
| Support contact | "Generic" support questions for the actual service
Usually the application administrators or the teams that run it. Can be a list. | support@it.geant.org | contacts['support'] | |||
| entityID | The SAML entityID must be an HTTPS schema based. See https://github.com/REFEDS/MRPS/blob/v1/mrps.md#52-entityid-format and https://spaces.at.internet2.edu/display/InCFederation/Entity+IDs (which has recently moved to https://spaces.at.internet2.edu/display/federation/Entity+ID) | |||||
| SAML Metadata | A URL to the XML metadata (preferred), or an XML metadata file. This file/URL should be valid SAML metadata containing at least the following elements:
| Service name | Very
| .GÉANT Wiki | name
| |
| Service description | Longer descriptive text , for instance with details like:with at least:
Can contain URLs | Atlassian Confluence wiki, production instance. | description |
| ||
| Service URL | The actual URL to the main service, for instance https:// | wikiintranet.geant.org | url | Metadata | Valid SAML2.0 metadata | a URL to the XML metadata (preferred), or an XML metadata file. |
...
| . |
...
Supplied information
The SAML proxy will always provide the following attributes to its downstream services:
...
| SAML attribute | example value | remarks |
|---|---|---|
| uid | federated-user-1234 | Unique user ID, always available. |
| user@domain | Defaults to the string 'invalid_email_needs_updating' if none was provided by the upstream IdP | |
| displayName | Robert Wagner | Defaults to the string 'first_name last_name' or similar if bit aren't provided by the upstream IdP |
| isMemberOf |
| Multivalued attribute listing the CAMS group memberships. |
Our endpoint
EntityID | https://login.terena.org/wayf/saml2/idp/metadata.php |
Metadata URL | https://login.terena.org/wayf/saml2/idp/metadata.php |
| Metadata webpage, if your SP runs SimpleSAMLphp | https://login.terena.org/wayf/saml2/idp/metadata.php?output=xhtml |
Service monitoring
At some stage there will be some monitoring set-up, to help ensure the service is conforming to basic requirements. The monitored items are expected to include:
...