2016-06-02 16:07:45 +00:00
2024-07-22 08:16:24 +00:00
== IDP Element
2016-06-02 16:07:45 +00:00
2016-06-02 20:50:43 +00:00
Everything in the IDP element describes the settings for the identity provider (authentication server) the SP is communicating with.
2016-06-02 16:07:45 +00:00
[source,xml]
----
<IDP entityID="idp"
signaturesRequired="true"
signatureAlgorithm="RSA_SHA1"
signatureCanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#">
...
</IDP>
----
2016-06-02 20:50:43 +00:00
Here are the attribute config options you can specify within the `IDP` element declaration.
2016-06-02 16:07:45 +00:00
entityID::
2016-06-10 10:53:23 +00:00
This is the issuer ID of the IDP. This setting is _REQUIRED_.
2016-06-02 16:07:45 +00:00
signaturesRequired::
2016-06-02 20:50:43 +00:00
If set to `true`, the client adapter will sign every document it sends to the IDP.
Also, the client will expect that the IDP will be signing any documents sent to it.
This switch sets the default for all request and response types, but you will see later that you have some fine grain control over this.
This setting is _OPTIONAL_ and will default to `false`.
2016-06-02 16:07:45 +00:00
signatureAlgorithm::
2016-06-02 20:50:43 +00:00
This is the signature algorithm that the IDP expects signed documents to use.
Allowed values are: `RSA_SHA1`, `RSA_SHA256`, `RSA_SHA512`, and `DSA_SHA1`.
This setting is _OPTIONAL_
2023-01-05 19:50:09 +00:00
and defaults to `RSA_SHA256`. Note that `SHA1` based algorithms are deprecated and can be removed in the future.
We recommend the use of some more secure algorithm instead of `*_SHA1`. Also, with `*_SHA1` algorithms, verifying signatures
do not work if the SAML server (usually {project_name}) runs on Java 17 or higher.
2016-06-02 16:07:45 +00:00
signatureCanonicalizationMethod::
2016-06-10 10:53:23 +00:00
This is the signature canonicalization method that the IDP expects signed documents to use. This setting is _OPTIONAL_.
2017-09-05 07:49:24 +00:00
The default value is `\http://www.w3.org/2001/10/xml-exc-c14n#` and should be good for most IDPs.
2019-03-26 12:29:45 +00:00
metadataUrl::
The URL used to retrieve the IDP metadata, currently this is only used to pick up signing and encryption keys periodically which allow cycling of these keys on the IDP without manual changes on the SP side.
