SSO Settings
The following settings are configured on the SAML 2.0 federation partner in RapidIdentity.
| Setting | Description |
|---|---|
| Entity ID | Unique identifier for the service provider. Provided by the service provider in its SAML metadata. |
| Assertion Consumer Service URL | Endpoint at the service provider that receives the SAML response. Provided by the service provider in its SAML metadata. |
| Single Logout Service URL | Endpoint at the service provider that receives single logout requests. This setting is optional, but is required when single logout is configured. |
| NameID Format | Format of the NameID returned to the service provider in the
SAML response. The most commonly used values are
persistent, transient,
emailAddress, and
unspecified. |
| Sign Assertions | When enabled, the SAML assertion is signed by RapidIdentity using the IdP signing certificate. |
| Encrypt Assertions | When enabled, the SAML assertion is encrypted using the service provider's encryption certificate. |
| Assertion Lifetime | Period during which the SAML assertion is valid, set in the
NotOnOrAfter attribute on the assertion. |
Attribute Mapping
RapidIdentity sends user attributes to the service provider in the SAML response. Each attribute is mapped from a RapidIdentity LDAP attribute to a SAML attribute name expected by the service provider.
| RapidIdentity Attribute | SAML Attribute Name | Description |
|---|---|---|
mail | Email or
urn:oid:0.9.2342.19200300.100.1.3 | User's email address. |
givenName | FirstName or
urn:oid:2.5.4.42 | User's first (given) name. |
sn | LastName or
urn:oid:2.5.4.4 | User's last (surname) name. |
idautoPersonHRID | UserID or vendor-specified value | RapidIdentity human-readable identifier for the user. |
Note:
Required attribute names and namespaces vary by service provider. Consult the identity provider's documentation for the expected attribute names and formats.