libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

Merge pull request #68 from hmlnarik/KEYCLOAK-4062-Provide-GUI-for-KeyName-format-in-identity-broker-and-client

Browse source 
KEYCLOAK-4062 Documentation for KeyName format switch
This commit is contained in:
Stian Thorgersen 2016-12-14 06:10:10 +01:00 committed by GitHub
commit c67875fffc
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
topics/clients/client-saml.adoc
View file

@ -77,6 +77,14 @@ Sign Assertions::
Signature Algorithm:: Signature Algorithm::
Choose between a variety of algorithms for signing SAML documents. Choose between a variety of algorithms for signing SAML documents.
SAML Signature Key Name::
Signed SAML documents sent via POST binding contain identification of signing key in `KeyName`
element. This by default contains {{book.project.name}} key ID. However various vendors might
expect a different key name or no key name at all. This switch controls whether `KeyName`
contains key ID (option `KEY_ID`), subject from certificate corresponding to the realm key
(option `CERT_SUBJECT` - expected for instance by Microsoft Active Directory Federation
Services), or that the key name hint is completely omitted from the SAML message (option `NONE`).
Canonicalization Method:: Canonicalization Method::
Canonicalization method for XML signatures. Canonicalization method for XML signatures.

8
topics/identity-broker/saml.adoc
View file

@ -42,6 +42,14 @@ You must define the SAML configuration options as well. They basically describe
|Signature Algorithm |Signature Algorithm
|If `Want AuthnRequests Signed` is on, then you can also pick the signature algorithm to use. |If `Want AuthnRequests Signed` is on, then you can also pick the signature algorithm to use.
|SAML Signature Key Name
|Signed SAML documents sent via POST binding contain identification of signing key in `KeyName`
element. This by default contains {{book.project.name}} key ID. However various external SAML IDPs might
expect a different key name or no key name at all. This switch controls whether `KeyName`
contains key ID (option `KEY_ID`), subject from certificate corresponding to the realm key
(option `CERT_SUBJECT` - expected for instance by Microsoft Active Directory Federation
Services), or that the key name hint is completely omitted from the SAML message (option `NONE`).
|Force Authentication |Force Authentication
|Indicates that the user will be forced to enter in their credentials at the external IDP even if they are already logged in. |Indicates that the user will be forced to enter in their credentials at the external IDP even if they are already logged in.