Need a Domino Consultant? Call NotesMail +1 212-599-2048 - HCLSoftware Business Partner
SECURING
Using Domino as a SAML-based security provider with SSL
It is recommended, for security reasons, that if you are configuring federated-identity authentication on an Domino® Web server, you secure the server with SSL (https protocol). In addition, SSL configuration is required if your IdP uses ADFS. SSL is not required, however, if the Domino server is not configured as a Web server -- for example, it is a Domino server used to host the ID vault that supports federated login for the Notes® client.
About this task
You can customize the protocol used for the TFIM assertion post URL so that it is https by ensuring that the Assertion Consumer Service URL contains https.
The Domino IdP Configuration document in the IdP Catalog specifies the Service Provider ID argument (SP_PROVIDER_ID) used in building the redirect URL to the IdP. For example, if SSL is not being configured for Domino, the redirect URL to the IdP looks the example in step 2. The Provider ID can be set at the IdP and at Domino (in the IdP Configuration document) to specify https, although the primary purpose of the SP_Provider_ID is to have the IdP setting match the setting at Domino in the IdP Configuration document.
Note: If you specify https in the Assertion Consumer Service URL, you will see a connection error if SSL is not configured at the Domino Web server.
Procedure
1. Make note of the value in the Provider ID field in the TFIM Partners SAML Message Settings configuration.
2. If SSL is not being configured for Domino, use this value for the SP_PROVIDER_ID argument (in the following example, your_provider_id):
https://your_WebSphere_server_name:9443/sps/saml11idp/saml11/login?SP_PROVIDER_ID=your_Domino_server_name&TARGET=http://your_Domino_server_name/names.nsf
At the SAML IdP, the provider id is used to find the matching IdP partner.
What to do next
When configuring SSL at the Domino Web server, if you are monitoring the redirect URL to the IdP, you should see the TARGET containing https:
https://your_WebSphere_server_name:9443/sps/saml11idp/saml11/login?SP_PROVIDER_ID=https://your_Domino_server_name&TARGET=https://your_Domino_server_name/names.nsf
Note: The Domino Web server name must be the fully qualified host name.
For more information on the SP_PROVIDER_ID argument, see the related topic on the Internet transfer URL.
Parent topic: Configuring SAML in Domino
Previous topic: Configuring SAML from the Internet Site (Web Site) document
Next topic: Encrypting SAML assertions
Related information
SAML 1.x initial URL
Configuring a port for SSL
|