sample SAML JSON idp provider for Access Management

Question

We are Upgrading CM 9.6. successfully installed the Access Management on Server Using Powershell Script. We are followed the SDL Documentation link. to setup SAML Settings. we are having some queries while set up

1. As mentioned in SDL Certificates link we are having 5 certificates. we can add all the certificates or any specific.
2. for User Name Claim & Full Name Claim, can we Use any values or do we have any specific values?
3. for the Separator field we can give Column(:) only or azure:
4. By default which Access settings do we need to select?

can you please share any Sample JSON for the same?

Answer 1

Answer to your question:

A1: If you open up the Set up Single Sign-On with SAML page in the azure, In step 3 SAML Signing certificate section you will see the Certificate (Base64) Download button, click the download button, and copy this certificate text to Access Management Certificate field of your azure SAML Idp provider settings.

A2: - No, you can't just use any values, you have to define your Attributes & Claim values what you want to expose to access management if you want to see those claim types and values. In the Access Management after the successful setup, if you click the validation button it will show you all the claim types and values. These claim types and values will differ based on each Idp provider.

A3: For the Separator field value, you can give any value. Are users the same across these IDPs? if yes then you need a separator if users are different then you don’t need it.

A4: Access settings depends on your requirements and use cases.

Sample Azure SAML Idp provider JSON:

{
    "key": "AZURESAML",
    "name": "AZURESAML",
    "isEnabled": true,
    "description": "AZURESAML",
    "type": "SAML2P",
    "iconUrl": "/access-management/ui/idpIcons/Auth0.png",
    "accessControlList": [
        {
            "applications": [
                {
                    "id": 4,
                    "name": "Access Management"
                },
                {
                    "id": 1,
                    "name": "Add-ons"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Classic (UI only)"
                },
                {
                    "id": 2,
                    "name": "Tridion Sites Experience Space"
                }
            ],
            "apiResources": [
                {
                    "id": 1,
                    "name": "Access Management API"
                },
                {
                    "id": 2,
                    "name": "Add-ons API"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Content Manager API"
                }
            ],
            "apiResourceRoles": [
                {
                    "id": 1,
                    "name": "Administrator"
                },
                {
                    "id": 2,
                    "name": "Administrator"
                },
                {
                    "id": 5,
                    "name": "Administrator"
                }
            ]
        }
    ],
    "forwardedClaims": [],
    "parameters": {
        "$type": "SamlParameters",
        "issuerName": "https://sts.windows.net/xxxxxxxxxxxxxxxx/",
        "serviceProviderName": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "singleSignOnServiceUrl": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "singleLogoutServiceUrl": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "certificates": ["xxxInHM4BFDujREyvxxx51/3/xneT49gAc00AbIxxxxxxxGLXQwdecHjskwVFTe73aq+H1vsrCQFsFfCNY+xxx"],
        "separator": "|",
        "usernameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
        "fullNameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname"
    }
}