Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ The Mendix SAML SSO supports the usage of SAML metadata in the following way:

For easy configuration, the SAML module offers the following:

* From version 4.0.0 of the SAML module, if you want to connect your Mendix application with a single IdP, you can do the necessary configurations at design time (using a microflow) and/or deploy time using Application Constants. This is described in the section [Non-default Configuration](/appstore/modules/saml/installation-configuration/#non-default).
* From version 4.0.0 of the SAML module, if you want to connect your Mendix application with a single IdP, you can do the necessary configurations at design time (using a microflow) and/or deploy time using Application Constants. This is described in the section [Custom Configuration](/appstore/modules/saml/installation-configuration/#non-default).
* You can create a custom SAML configuration microflow and share it across all SAML applications in your portfolio, such as using a custom module in your private marketplace. This approach makes SAML configurations both automatable and repeatable.
* Runtime configuration by a local Admin is still available in the following cases:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ description: "Describes the list of IdP Attributes for the SAML module"

## Introduction

This document provides you with a detailed description of each IdP attribute and its default value for deploy-time configuration. You need to use these attributes when configuring the SAML module to create the IdP configuration. For more details, see [Non-default Configuration](/appstore/modules/saml/installation-configuration/#non-default).
This document provides you with a detailed description of each IdP attribute and its default value for deploy-time configuration. You need to use these attributes when configuring the SAML module to create the IdP configuration. For more details, see [Custom Configuration](/appstore/modules/saml/installation-configuration/#non-default).

## Identity Configuration

Expand All @@ -30,15 +30,15 @@ Using artifact binding for SAML responses at the SAML IdP is only available in t

* v3.3.0/v3.3.1 and above for Mendix 9 and 10

`POST_BINDING` is the default value when using an [Easy Default Flow](/appstore/modules/saml/installation-configuration/#easy-flow).
`POST_BINDING` is the default value when using an [Easy Configuration](/appstore/modules/saml/installation-configuration/#easy-flow).

### Use AssertionConsumerService Concept

In most cases (for example, with Entra ID), you do not want to use the AssertionConsumerService concept in requests. Some IdPs, however, require requests to include an AssertionConsumerServiceIndex. This refers to the definition of the Assertion Consumer Service in the SP metadata.

* If the **Use AssertionConsumerService Concept** is set to `No…` then Auth-Request contains the `AssertionConsumerServiceURL` and `ProtocolBinding` attributes.
* If the **Use AssertionConsumerService Concept** is set to `Yes…` then Auth-Request contains only the ‘`AssertionConsumerServiceIndex`’ attribute.
By default, it is `No` when using an [Easy Default Flow](/appstore/modules/saml/installation-configuration/#easy-flow).
By default, it is `No` when using an [Easy Configuration](/appstore/modules/saml/installation-configuration/#easy-flow).

### Assertion Consumer Service Index

Expand All @@ -52,7 +52,7 @@ In the **Attribute Consuming Service** tab, you can configure your app using the
You can set up two sets of attributes by adding new attributes, editing existing attributes, or removing selected attributes. These will be provided at different times. Those listed under **I want to request attribute(s) at my IDP during initial login** will be returned when the end-user initially signs in. Those listed under **I want to request attribute(s) at my IDP during in-session login** will be returned during [In-session Authentication](#in-session).
Although the typical use case for requesting attributes is to obtain information about the user, you can request an attribute with a specific value. In this case, you can configure the optional Attribute value that must be returned.

When using an [Easy Default Flow](/appstore/modules/saml/installation-configuration/#easy-flow), disable both initial and in-session login options.
When using an [Easy Configuration](/appstore/modules/saml/installation-configuration/#easy-flow), disable both initial and in-session login options.

Requesting user attributes at the SAML IdP is only available in the following versions of the module (depending on which Mendix version you are using)

Expand All @@ -67,7 +67,7 @@ Requesting user attributes at the SAML IdP is only available in the following ve
* **What algorithm do you want to use to sign messages** (or *Encryption method*) – `SHA1 - RSA`, or `SHA256 - RSA`
* **Encryption key length** – 1024 or 2048 bits

When using an [Easy Default Flow](/appstore/modules/saml/installation-configuration/#easy-flow), default values are `SHA256 - RSA` and 2048 bits
When using an [Easy Configuration](/appstore/modules/saml/installation-configuration/#easy-flow), default values are `SHA256 - RSA` and 2048 bits

Enabling encryption has the following effects on messages being exchanged:

Expand Down
Loading
Loading