- signing and encryption of messages
- automatic creation of repository users and groups
- Service Provider and Identity Provider initiated authentication
This handler stores the encrypted SAML response message in the user-node (usernode/samlResponse) to facilitate communication with a third-party Service Provider.
The SAML 2.0 Authentication Handler is disabled by default. You must set at least one of the following properties in order to enable the handler:
- The Identity Provider POST URL.
- The Service Provider Entity ID.
SAML assertions are signed and may optionally be encrypted. In order for this to work you have to provide at least the public certificate of the Indentity Provider in the TrustStore. See Adding the IdP certificate to the TrustStore section for more information.
Repository path for which this authentication handler should be used by Sling. If this is empty, the authentication handler will be disabled.
OSGi Framework Service Ranking value to indicate the order in which to call this service. This is an integer value where higher values designate higher precedence.
IDP Certificate Alias
The alias of the IdP's certificate in the global truststore. If this property is empty the authentication handler is disabled. See the "Add the IdP Certificate to the AEM TrustStore" chapter below on how to set it up.
Identity Provider URL
URL of the IDP where the SAML Authentication Request should be sent to. If this property is empty the authentication handler is disabled.
The Identity Provider hostname must be added to the Apache Sling Referrer Filter OSGi configuration. See the Web console section for more information.
Service Provider Entity ID
ID which uniquely identifies this service provider with the identity provider. If this property is empty the authentication handler is disabled.
This location is only used if the request-path cookie is not set. If you request any page below the configured path without a valid login-token, the requested path is stored in a cookie
and the browser will be redirected to this location again after successful authentication.
The name of the attribute containing the user ID used to authenticate and create the user in the CRX repository.
The user ID will not be taken from the saml:Subject node of the SAML assertion but from this saml:Attribute.
Autocreate CRX Users
Whether or not to automatically create non-existing users in the repository after successful authentication.
If the automatic creation of CRX users is disabled, the users will have to be created manually.
Add to Groups
Whether or not a user should be automatically added to CRX groups after successful authentication.
The name of the saml:Attribute containing a list of CRX groups this user should be added to.
SAML assertions are signed and may optionally be encrypted. In order for this to work you have to provide at least the public certificate of the IdP in the repository. In order to do this you need to:
The below steps are mandatory, otherwise the following exception will be thrown: com.adobe.granite.keystore.KeyStoreNotInitialisedException: Uninitialised system trust store
The below steps are required only if handler should be able to sign or decrypt messages.
You can set up a Logger in order to debug any issues that might arise from misconfiguring SAML. You can do this by: