Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between an identity provider and a service provider. BizLibrary allows clients to create Authentication Methods through their Administration interface in the System submenu.
Once loaded, you will be presented with the Authentication Method Admin page. On this page is a New Authentication Method button, a list of existing Authentication Methods, and utility allowing the user to edit, delete, or preview specific Authentication Methods.
New Authentication Method
To create a new Authentication Method, click the New Authentication Method button in the upper right of the Authentication Method Admin page.
You will be provided with a Service Provider login URL. At this point you will need to submit this URL to your IDP (Identity Provider). The IDP, using this login URL, will generate several data points that you will use to fill out the New Authentication Method form. A description of the form and which fields are filled out with data provided by the IDP are in the following section.
Authentication Method Fields
Authentication Method Title:
Required
Title used to easily identify the Authentication Method.
IDP Name:
Required
Name of the Identity Provider (IDP).
Entity Id:
Required, Provided by IDP
A globally unique name for an Identity Provider or a Service Provider. A unique Entity ID is generated for each application.
IDP Authentication Request Endpoint:
Required, Provided by IDP
This SAML endpoint is used by the application to initiate sign-on operations.
IDP Logout Endpoint:
Required, Provided by IDP
This SAML endpoint is used by the application to initiate sign-off operations.
Name Id Format:
Required, Provided by IDP
Indicates to the Service Provider which form of NameId to expect and/or how to interpret the NameID provided by the IDP.
Provision Users:
Indicates whether the Service Provider should automatically create users in their system. Provisioning users above your contracted subscription may cause billing overages.
Provision Users Disabled Message:
Required if Provision Users not selected
Default message displayed to users if automatic provisioning of users is not enabled.
Authentication Context Class Reference:
Required, Provided by IDP
Authentication Context Class Reference is an identifier that refers to an Authentication Context.
Authentication Context is an optional field used to convey to the Service Provider additional information in determining the Level of Assurance for an Authentication request.
Response is Signed:
Indicates that a digital signature is to ensure the origin and integrity of the response to the SP.
Assertion is Signed:
Indicates that the attribute statement within the response is signed rather than the entire response.
Signing Certificate:
Provided by IDP
The certificate provided by the IDP contains the public key used to verify the IDP\'s digital signature.
BizLibrary only accepts formats in x.509 format. An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.
Assertion is Encrypted:
Provided by IDP
Indicates whether the Assertion attribute of the response should be encrypted.
Encryption Method:
Provided by IDP
The desired method of encryption.
Decryption Certificate:
Provided by IDP
The public key provided by the IDP required for decryption of encrypted assertions/responses.
BizLibrary only accepts formats in x.509 format. An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.
Assertion Attributes:
Provided by IDP, Username or email is required, others are optional.
One or more values used to identify users within the Identity Provider.
Associate Look with Authentication Method
To associate a Branded Site Look with an Authentication Method, navigate to the Administration page and select the Branded Sites option in the System submenu on the left side of the screen.
Once the Branded Sites is loaded you will have the ability to associate an Authentication Method with a New Branded Site Look or an existing Branded Site Look. Choose the New Branded Site button in the top right or click the Edit Branded Site icon to the right of the existing Branded Site.
Once the form has loaded, fill it out as normal if creating a new Branded Site or select the Authentication Method you want to associate with the Look if Editing.
Edit Authentication Method
To modify an existing Authentication Method, select the Edit icon on the row of the Authentication Method you wish to update. You will be presented with the Edit Authentication Method form.
When done updating the Authentication Method, click the Save button located on the bottom right of the form.
Delete Authentication Method
To delete an existing Authentication Method, select the Delete icon on the row of the chosen Authentication Method. You will be presented with a confirmation dialog.
To complete the delete process click the Delete Authentication Method button located at the bottom right of the dialog.
Preview Authentication Method
BizLibrary provides the ability preview an Authentication Method before associating it with a Look. To preview an Authentication Method, click the Preview button on the row of the selected Authentication Method. You will be shown a confirmation dialog, once confirmed you will be logged out of the system and forwarded to the IDP designated login endpoint.