Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manual page 317

SAML Consumer Process Flow
Figure C-2
SAML Servicer Provider
User/Browser
Target Resource
User Authentication
1. The user clicks a link at xyz.com.
This generates a SAML assertion intended for the Identity Server at abc.com, which is the
identity provider in an Access Manager configuration. After the SAML server generates the
artifact, it sends the browser a redirect containing the artifact. The browser is redirected to the
identity provider, which receives the artifact. The URL sent to the Identity Server looks
something like: http://nidp.com/auth/afct?TARGET=http://abc.com/
index.html&SAMLArtifact =<<artifact>>
2. The Identity Server at abc.com receives the assertion.
The assertion is sent to the Identity Server packaged in a SOAP envelope. In this example, the
assertion contains the attributes lastname=Jones, and phonenumber=555-1212.
3. The Identity Server determines which attributes to use when locating the user.
The Identity Server must determine how to locate the user in the directory. When you created
the SAML service provider reference for xyz.com, you specified which Liberty attributes
should be used for this purpose. In this case, the you specified that PP: sn and PP: ph# should
be used.
a. The Identity Server processes the Liberty attribute map (see
LDAP and Liberty Attributes," on page
attributes (see Section 5.4.3, "Selecting Attributes for a Trusted Provider," on page
Because this SAML implementation must interoperate with other SAML implementations
that probably do not use consistent attribute names, you can map the attributes used by
each third-party SAML implementation to Liberty attributes on the Identity Server.
b. The Identity Server receives implementation-specific SAML attribute names.
The trusted service provider's names for the Liberty PP: sn and PP: ph# attributes are
returned. Using the attribute map, the Identity Server knows that the service provider's
names for these attributes are lastname and phonenumber, respectively.
xyz.com
1
5
2
5
3
4
Identity Server
abc.com
235) to the SAML implementation-specific
Liberty/LDAP Local Attributes for Assertion
a
PP: sn
PP: ph#
Mapped Attributes to SAML Service Provider
PP: sn = lastname
b
PP: ph# = phonenumber
Web Service Personal Profile (PP)
c
PP: sn = Jones
PP: ph# = 555-1212
Section 10.9, "Mapping
Understanding How Access Manager Uses SAML 317
155).