Saml Service Provider Process Flow - Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual

B.7 SAML Service Provider Process Flow
The following illustration provides an example of the authentication process on the consumer side,
when a user clicks a link at the SAML service provider (xyz.com) in order to begin an authentication
session with an identity provider (such as abc.com). PP indicates a Personal Profile Service as
defined by the Liberty specification.
SAML Consumer Process Flow
Figure B-2
SAML Servicer Provider
User/Browser
Target Resource
User Authentication
1. The user clicks a link at xyz.com.
This generates a SAML assertion intended for the Identity Server at abc.com, which is the
identity provider in an Access Manager configuration. After the SAML server generates the
artifact, it sends the browser a redirect containing the artifact. The browser is redirected to the
identity provider, which receives the artifact. The URL sent to the Identity Server would look
similar to the following:
http://nidp.com/auth/afct?TARGET=http://abc.com/index.html&SAMLArtifact
=<<artifact>>
2. The Identity Server at abc.com receives the assertion.
The assertion is sent to the Identity Server packaged in a SOAP envelope. In this example, the
assertion contains the attributes lastname=Jones, and phonenumber=555-1212.
3. The Identity Server determines which attributes to use when locating the user.
The Identity Server must determine how to locate the user in the directory. When you created
the SAML service provider reference for xyz.com, you specified which Liberty attributes
should be used for this purpose. In this case, the you specified that PP: sn and PP: ph# should
be used.
a. The Identity Server processes the Liberty attribute map (see
LDAP and Liberty Attributes," on page
attributes (see Section 7.6.1, "Configuring the Attributes Obtained at Authentication," on
page 200).
Because this SAML implementation must interoperate with other SAML implementations
that probably do not use consistent attribute names, you can map the attributes used by
each third-party SAML implementation to Liberty attributes on the Identity Server.
xyz.com
1
5
2
5
3
4
Identity Server
abc.com
304) to the SAML implementation-specific
Liberty/LDAP Local Attributes for Assertion
a
PP: sn
PP: ph#
Mapped Attributes to SAML Service Provider
PP: sn = lastname
b
PP: ph# = phonenumber
Web Service Personal Profile (PP)
c
PP: sn = Jones
PP: ph# = 555-1212
Section 13.6, "Mapping
Understanding How Access Manager Uses SAML 367