- Purpose
- Support enterprises standardised on SAML rather than OIDC.
- Prerequisites
- IdP metadata
- SP metadata (ACS URL, entity id)
- Signing certificate rollover plan
- Architecture
- Assertion is signed by the IdP, posted to the ACS URL, validated, and mapped to a candidate profile.
Configuration
| NameID format | emailAddress or persistent |
| Attributes | email, givenName, sn, externalId |
| Clock skew | ±120s |
Implementation steps
- 01Exchange metadata between IdP and SP.
- 02Configure attribute statements and NameID.
- 03Enable assertion signature validation and audience restriction.
- 04Test SP-initiated and IdP-initiated flows separately.
- 05Document certificate expiry and rotation ownership.
Examples
Attribute statement (illustrative)
xml
<saml:AttributeStatement>
<saml:Attribute Name="email"><saml:AttributeValue>jane.smith@example.com</saml:AttributeValue></saml:Attribute>
<saml:Attribute Name="externalId"><saml:AttributeValue>WC-8291</saml:AttributeValue></saml:Attribute>
</saml:AttributeStatement>Testing procedure
- Replay an assertion and confirm rejection
- Expire the certificate in a staging IdP and confirm the error is actionable
Troubleshooting
Audience restriction failure
Entity id mismatch between SP metadata and IdP configuration.
Works IdP-initiated only
SP-initiated requires the correct SSO binding and RelayState handling.