This document describes settings that apply to all SAML based user directories:
Active Directory Federation Service (ADFS)
Security Assertion Markup Language (SAML)
Suomi.fi
Core settings
Core settings consists of following settings.
...
IdP settings consist of only single field where you can import the metadata XML file provided to you by the SAML IdP administrator. The XML file is structurally validated but testing is required to make sure everything works as expected.
...
User information
All user information described in Common user directory settings apply to SAML based user directories.
Additional SAML-specific user information is described in the table below.
Field | Description | Default value |
|---|---|---|
Legacy user mapping by username | Link users from user directory based on their username. This is a legacy option for backwards compatibility and should not be used on new user directories. This option is mutually exclusive with Link user with directory and Link ID fields. | False (not checked) |
Link user with directory | If true, link is made between existing Trivore ID user account and external user. This option is required if users are expected to this directory for sign-in instead of strong identification only. Strong identification use-case assumes that user is already logged in and therefore link is not required. | Depends on directory. ADFS and generic SAML directories have this enabled whereas Suomi.fi directory has this disabled as it is most commonly used for strong identification only. |
Use NameID based linking | Use SAML special attribute NameID as identifying attribute (Link ID). Enabling this option disables the Link ID field as these fields are mutually exclusive. Please note that it is possible to refer to this attribute in Link ID field with its name NameID too (which nowadays makes this field kind of redundant) | True (checked) |
Use NameID as username | Use SAML special attribute NameID as username. Enabling this option disables the username field as these fields are mutually exclusive. Username field is available only if manual username policy is selected. Please note that it is possible to refer to this attribute in Link ID field with its name NameID too (which nowadays makes this field kind of redundant) | False (not checked) |
Hash username with SHA-1 | Hashes username values using SHA-1 algorithm. Useful if username values contain sensitive information. | False (not checked) |