Identity Provider Process Flow - Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manual

Attribute profiles: Profiles simplify how you configure and deploy systems that exchange
attribute data. They include:
Basic attribute profile: Supports string attribute names and attribute values drawn from
XML schema primitive type definitions.
X.500/LDAP: Supports canonical X.500/LDAP attribute names and values.
UUID attribute profile: Supports using UUIDs as attribute names.
XACML attribute profile: Defines formats suitable for processing by XACML
(Extensible Access Control Markup Language).
C.6 Identity Provider Process Flow
The following illustration provides an example of an Identity Server automatically creating an
authenticated session for the user at a trusted SAML service provider. PP indicates a Personal
Profile Service as defined by the Liberty specification.
SAML Service Provider Process Flow
Figure C-1
SAML Servicer Provider
xyz.com
User/Browser
1. A user is logged in to the Identity Server at abc.com (the user's identity provider) and clicks a
link to xyz.com, a trusted SAML service provider.
The Identity Server at abc.com generates the artifact. This starts the process of generating and
sending the SAML assertion. An example of the HREF might be http://nidp.com/saml/
genafct?TARGET=http://xyz.com/index.html&AID=XYZ.
2. The Identity Server processes attributes as follows:
a. The server looks up LDAP or Liberty-LDAP mapped attributes. (See
"Mapping LDAP and Liberty Attributes," on page
attributes such as PP: sn instead of surname. PP: sn and PP: ph# are attributes that you
are sending to xyz.com.
b. The Identity Server processes these attributes with a SAML implementation-specific
attribute.
Because the identity provider must interoperate with other SAML service providers that
probably do not use consistent attribute names, you can map the service provider attributes
to your Liberty and LDAP attributes on the Identity Server. In this example, the service
4 5
3
1
2
3
Identity Server
abc.com
Liberty/LDAP Local Attributes for Assertion
a
PP: sn
PP: ph#
Mapped Attributes to SAML Service Provider
PP: sn = lastname
b
PP: ph# = phonenumber
Web Service Personal Profile (PP)
c
PP: sn = Jones
PP: ph# = 555-1212
235.) In this example, you use Liberty
Understanding How Access Manager Uses SAML 315
Section 10.9,