Importing configuration from an identity provider and configuring SAML

Option to import the SAML metadata. Perform one of the following actions:

• Select Import from URL, and type the URL where the IdP SAML configuration is stored.
• Select Import from file, and upload the SAML configuration file from a local folder on your computer.

After you import SAML metadata, most of the fields on the Authentication page get populated with imported values. 

URL of the IdP federation metadata.

Use this URL to enable automatic rollover — Automatic certificate update on the Remedy SSO server after this certificate is updated on the SAML IdP side. Such rollovers are more frequent if you use Azure Active Directory as an identity provider. 

If the IdP federation metadata URL is not specified, an administrator must renew the signing certificate manually.

Signing certificate that Remedy SSO uses to sign requests that are sent to the IdP.

Name identifier formats supported by a SP. SPs use name identifiers to pass information about users.

In this field, enter the NameID Format values. The first value in the list has the highest priority in determining the Name ID format to use.

If a user does not specify a Name ID when initiating single sign-on, the first value specified in the NameID Format list is chosen and supported by the remote IdP.

Note: For linking user accounts from the SP and the remote IdP together, after an end user logs in to the integrated BMC application through the SAML IdP, the persistent NameID format must be at the top of the list.

For more information about Name Format Identifiers, see paragraph 8.2 in Authentication Context for the OASIS Security Assertion Markup Language (SAML) V2.0 .

Options (exact, minimum, maximum, better) available for the Auth Context Compare.

For more information about Auth Context Compare options, see Authentication Context for the OASIS Security Assertion Markup Language (SAML) V2.0 .

Authentication context that maps the SAML 2.0-defined authentication context classes to the authentication level that is set for the user session for the SP.

Issuer details that are used by the SAML authentication request XML to inform the IdP about the entity ID of the SP for this request.

If the value is not specified, by default, the entity ID of the current realm is used as an Issuer in SAML authentication request.

Time offset between Remedy SSO and the IdP. The value must be specified in minutes.

Time format used by assertions and depends on the defined patterns. For more information, see Patterns for Formatting and Parsing .

Example:

yyyy-MM-dd'T'HH:mm:ss.SSSXXX

Option to indicate whether the identity provider requires SAML metadata to be signed.

You might need to sign the SAML metadata to ensure that the security policies of your organization are followed. When you configure a realm for SAML signing metadata, the Remedy SSO server gets the certificate and private key from the keystore's alias, and signs the metadata with it.

Select one of the following signing algorithms containing a hash type function and key type:

• SHA1withRSA 
• SHA256withRSA

Select an algorithm supported by your IdP.

Remedy SSO metadata that is configured in the SP Metadata Template field. If any required parameter is missing, the system shows an error message for that parameter.

Template used for a SAML authentication request.

You can select Default or Custom and edit the template, if required. After Remedy SSO upgrade, the authentication request template is not updated. To be able to use the new functionality after upgrade, you must manually edit and update the template in the realm settings.

SP metadata template. 

You can select Default or Custom and edit the template, if required. After Remedy SSO upgrade, the SP metadata template is not updated. To be able to use the new functionality after upgrade, you must manually update the metadata template. For more information about updating the metadata template after upgrading, see Upgrading.

Option to define where the maximum time of an end user authentication session is configured.

By default, the maximum session time is specified by the value set in the Max Session Time field, configured in the General > Basic tab in the Remedy SSO Admin Console.

If the SessionNotOnOrAfter value configured on the IdP side is less than the value specified in the Max Session Time field on the Remedy SSO server, the maximum session time will be defined by the value configured on the IdP.

A field for entering an XPath query for extracting user groups from the SAML assertion.

Example:
//*[local-name()='AttributeStatement']/*[local-name()='Attribute'][@Name='()='AttributeValue']

The information about the user groups is stored in the authentication session attributes, and is retrieved from the response of the /token/groups REST API endpoint.

Notes:

• Make sure the XPath you specified is valid.
  If you enter an incorrect XPath, end users will be able to log in to applications protected by SAML but Remedy SSO will not be able to retrieve user groups from the SAML response. If you do not specify anything in this filed, no groups will be retrieved.
• This option can be used only for IdP providers that allow retrieving user groups.