2

We are Upgrading CM 9.6. successfully installed the Access Management on Server Using Powershell Script. We are followed the SDL Documentation link. to setup SAML Settings. we are having some queries while set up

  1. As mentioned in SDL Certificates link we are having 5 certificates. we can add all the certificates or any specific.
  2. for User Name Claim & Full Name Claim, can we Use any values or do we have any specific values?
  3. for the Separator field we can give Column(:) only or azure:
  4. By default which Access settings do we need to select?

can you please share any Sample JSON for the same?

3

1 Answer 1

2

Answer to your question:

A1: If you open up the Set up Single Sign-On with SAML page in the azure, In step 3 SAML Signing certificate section you will see the Certificate (Base64) Download button, click the download button, and copy this certificate text to Access Management Certificate field of your azure SAML Idp provider settings.

enter image description here

A2: - No, you can't just use any values, you have to define your Attributes & Claim values what you want to expose to access management if you want to see those claim types and values. In the Access Management after the successful setup, if you click the validation button it will show you all the claim types and values. These claim types and values will differ based on each Idp provider.

enter image description here enter image description here

enter image description here

A3: For the Separator field value, you can give any value. Are users the same across these IDPs? if yes then you need a separator if users are different then you don’t need it.

A4: Access settings depends on your requirements and use cases.

Sample Azure SAML Idp provider JSON:

{
    "key": "AZURESAML",
    "name": "AZURESAML",
    "isEnabled": true,
    "description": "AZURESAML",
    "type": "SAML2P",
    "iconUrl": "/access-management/ui/idpIcons/Auth0.png",
    "accessControlList": [
        {
            "applications": [
                {
                    "id": 4,
                    "name": "Access Management"
                },
                {
                    "id": 1,
                    "name": "Add-ons"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Classic (UI only)"
                },
                {
                    "id": 2,
                    "name": "Tridion Sites Experience Space"
                }
            ],
            "apiResources": [
                {
                    "id": 1,
                    "name": "Access Management API"
                },
                {
                    "id": 2,
                    "name": "Add-ons API"
                },
                {
                    "id": 3,
                    "name": "Tridion Sites Content Manager API"
                }
            ],
            "apiResourceRoles": [
                {
                    "id": 1,
                    "name": "Administrator"
                },
                {
                    "id": 2,
                    "name": "Administrator"
                },
                {
                    "id": 5,
                    "name": "Administrator"
                }
            ]
        }
    ],
    "forwardedClaims": [],
    "parameters": {
        "$type": "SamlParameters",
        "issuerName": "https://sts.windows.net/xxxxxxxxxxxxxxxx/",
        "serviceProviderName": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "singleSignOnServiceUrl": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "singleLogoutServiceUrl": "https://login.microsoftonline.com/xxxxxxxxxxxxxxx/saml2",
        "certificates": ["xxxInHM4BFDujREyvxxx51/3/xneT49gAc00AbIxxxxxxxGLXQwdecHjskwVFTe73aq+H1vsrCQFsFfCNY+xxx"],
        "separator": "|",
        "usernameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
        "fullNameClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname"
    }
}
3
  • Hi @Velu,Now Im able to create SAML provider but in validated screen, bottom of the page we have properties section is there, its showing some expiredate, its related to?
    – Ajay
    Jan 19 at 9:39
  • @Ajay - Good to know your SAML provider creation worked, answer to your question it can be a token expiration date from the IDP provider. nothing to worry about that. If that article helped to fix your issues. please upvote and accept to close this ticket.
    – Velmurugan
    Jan 19 at 14:00
  • I have tried with your sample JSON, it's not worked for me. i have changed Service proviername & separator. then it's worked. please verify & confirm. Key: azure Name: azure Description: azure AD Provider Type: SAML2P Issuer name: sts.windows.net/<TENANT_ID> Service provider name: spn:<application_ID> SingleSignOnServiceUrl=login.microsoftonline.com/<TENANT_ID>/saml2 SingleLogoutServiceUrl=login.microsoftonline.com/<TENANT_ID>/saml2 Certificate : <SignatureValue _X509Certificate> Separator: : (given column symbol)
    – Ajay
    Jan 20 at 4:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.