class EnsLib.REST.SAMLGenericService
extends EnsLib.REST.GenericService
REST Generic Service that can validate the signature and timestamps on a SAML token
• parameter SETTINGS = "Validation:Connection,TrustedX509File:Connection";
List of properties can be set as settings in the configuration file
format is a comma separated list of property names
• property SAMLAttributes
as %String;
Comma separated list of attributes to record for statistics.
The attribute names are case sensitive.
• property TrustedX509File
as %String(MAXLEN=900);
Location of a file containing certificates that can be used to verify the signatures on received SAML tokens.
The file should contain one or more trusted X.509 certificates in PEM-encoded format.
These certificates should complete a 'chain of trust' from the signatures contained in the SAML tokens to a trusted root Certificate Authority.
If empty and the 'mgr' directory contains a 'iris.cer' file then that file will be used.
• property Validation
as %String [ InitialExpression = "1" ];
Specifies types of Assertion validation to perform on element:
- t - must contain an Authorization header SAML token with key 'access_token='
- a - token must contain an Assertion
- u - token must contain an unsigned Assertion. If not found the error text is "No Unsigned Assertion".
- If both a and u are specified then either a signed or unsigned assertion needs to be present.
- s - combine with u - if unsigned assertions exist the s requires them be a children of signed elements.
Note: The Assertion might be wrapped in a structure that does not follow from schema.
- r - require Assertions to contain NotBefore/NotOnOrAfter time conditions
- v - verify Assertion signatures using a Trusted X.509 certificate and, if present, NotBefore/NotOnOrAfter conditions
If option 'u' is specified and 'v' NotBefore/NotOnOrAfter conditions will also be checked.
- o - validate other signed nodes within the assertion such as TimeStamp. Signed reference elements
with attribute name of ID or Id will be searched for.
If 1 is specified it is equivalent to 'tarvo'.
When checking the NotBefore/NotOnOrAfter time conditions the default clock skew allowance is 90 seconds.
To change the skew allowance Set ^Ens.Config("SAML","ClockSkew",<ConfigName>) for a specific item
or ^Ens.Config("SAML","ClockSkew") for all items using this validation to the desired number of seconds.
Set to -1 to prevent NotBefore/NotOnOrAfter condition checking for the relevant item or items.
This does not validate the XML schema used for the SAML token.
