SAML 1.1 module properties

SAML 1.1 module properties

We can define SAML 1.1 token module self or partner properties.

Appliance property Self or Partner Mode Description

com.tivoli.am.fim.sts.saml.1.1.
assertion.replay.validation SELF Validate Whether to enable one-time assertion use enforcement.
Set to true to enable one-time use enforcement.
Set to false if we do not want to enforce one-time assertion use.

com.tivoli.am.fim.sts.saml.1.1.
assertion.verify.signatures PARTNER Validate Whether to enable signature validation.
Set to true to enable validation.
Set to false if we do not want validation enabled.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.use.keyinfo PARTNER Validate Whether to use the KeyInfo of the XML signature to find the X.509 certificate for signature validation.
Set to true to use this method. Then, define the com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.keyinfo property.
Set to false, otherwise.

com.tivoli.am.fim.sts.saml.1.1.
ValidateKeyIdentifier.keyinfo PARTNER Validate Regular expression to validate the subject distinguished name returned in the KeyInfo, if com.tivoli.am.fim.sts.saml.1.1. assertion.signature.use.keyinfois set to true.
We can either specify this property or specify both of the following properties:

com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.db
com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.cert
If we specify all of these properties, the keystore alias format overwrites the com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.keyinfo property.

com.tivoli.am.fim.sts.saml.1.1.
ValidateKeyIdentifier.db PARTNER Validate Name of the certificate database to use for validation, if com.tivoli.am.fim.sts.saml.1.1. assertion.keystore.alias is set to true.

com.tivoli.am.fim.sts.saml.1.1.
ValidateKeyIdentifier.cert PARTNER Validate Name of the certificate label for validation, if com.tivoli.am.fim.sts.saml.1.1. assertion.keystore.alias is set to true.

com.tivoli.am.fim.sts.saml.1.1.
WantMultipleAttributeStatements PARTNER Validate Whether to create multiple attribute statements in the Universal User.
If we specify false, multiple attribute statements are arranged into a single group (AttributeList) in the STSUniversalUserdocument. This setting is appropriate for most configurations.

com.tivoli.am.fim.sts.saml.1.1.
assertion.issuer SELF Issue, Exchange Name of the organization that issues assertions. This is required.

com.tivoli.am.fim.sts.saml.1.1.
assertion.pretime.valid SELF Issue, Exchange Number of seconds that assertions are valid before its issue date. There is no minimum or maximum value enforced, but a value is required.
Default: 60

com.tivoli.am.fim.sts.saml.1.1.

assertion.posttime.valid SELF Issue, Exchange Number of seconds that assertions are valid after its issue date. There is no minimum or maximum value enforced, but a value is required.
Default: 60

com.tivoli.am.fim.sts.saml.1.1. assertion.signature.use. inclusive.namespaces PARTNER Issue, Exchange Whether to use the InclusiveNamespaces construct. This means using exclusive XML canonicalization for greater standardization. We must set this parameter without a prefix.
Set to true or false.
If unset, the system behaves as if it was set to true.

com.tivoli.am.fim.sts.saml.1.1.

assertion.attribute.types PARTNER Issue, Exchange Types of attributes to include in the assertion.
The default, an asterisk (*), includes all the attribute types specified in the identity mapping file.
To specify one or more attribute types individually, enter each attribute type.
Separate multiple type values using &&.

com.tivoli.am.fim.sts.saml.1.1.
assertion.sign PARTNER Issue, Exchange Whether SAML assertions must be signed.
Set to true to sign assertions.
Set to false if signing is not required.

com.tivoli.am.fim.sts.saml.1.1.
SigningKeyIdentifier.db PARTNER Issue, Exchange Name of the keystore where the signing key is stored. For example, use DefaultKeyStore.

com.tivoli.am.fim.sts.saml.1.1.
signingKeyIdentifier.cert PARTNER Issue, Exchange Name of the signing key identifier. For example, use testkey.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.include.
subject.keyid PARTNER Issue, Exchange Whether to include the subject key identifier with your signature.
Set to true to include the subject key identifier.
Set to false to exclude the subject key identifier.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.include.
public.key PARTNER Issue, Exchange Whether to include the public key with your signature.
Set to Yes to include the public key.
Set to No to exclude the public key.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.include.
issuer.details PARTNER Issue, Exchange Whether to include the issuer details with your signature.
Set to Yes to include the issuer details.
Set to No to exclude the issuer details.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.include.
subject.name PARTNER Issue, Exchange Whether to include the subject name with your signature.
Set to Yes to include the subject name.
Set to No to exclude the subject name.

com.tivoli.am.fim.sts.saml.1.1.
assertion.signature.include.
cert.data PARTNER Issue, Exchange Whether to include the certificate data with your signature.
Set to Yes to include the certificate data.
Set to No to exclude the certificate data.
If none of the assertion.signature.include.* properties are set, the system behaves as if com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include.cert.data is set to true.

com.tivoli.am.fim.sts.saml.1.1.
SignatureAlgorithm PARTNER Issue, Exchange Signature algorithm to use for signing assertions. Valid values:

RSA-SHA1, set to http://w ww.w3.org/2000/09/xmldsig#rsa-sha1
RSA-SHA256, set to http:// www.w3.org/2001/04/xmldsig-more#rsa-sha256
RSA-SHA512, set to http:// www.w3.org/2001/04/xmldsig-more#rsa-sha512

com.tivoli.am.fim.sts.saml.1.1.
assertion.SubjectConfirmationMethod PARTNER Issue, Exchange Subject confirmation method. Valid values:

No Subject Confirmation Method
urn:oasis:names:tc:SAML:1.1:cm:bearer
urn:oasis:names:tc:SAML:1.1:cm:holder-of-key
urn:oasis:names:tc:SAML:1.1:cm:sender-vouches

Parent topic: Token module properties

Appliance property	Self or Partner	Mode	Description
com.tivoli.am.fim.sts.saml.1.1. assertion.replay.validation	SELF	Validate	Whether to enable one-time assertion use enforcement. Set to true to enable one-time use enforcement. Set to false if we do not want to enforce one-time assertion use.
com.tivoli.am.fim.sts.saml.1.1. assertion.verify.signatures	PARTNER	Validate	Whether to enable signature validation. Set to true to enable validation. Set to false if we do not want validation enabled.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.use.keyinfo	PARTNER	Validate	Whether to use the KeyInfo of the XML signature to find the X.509 certificate for signature validation. Set to true to use this method. Then, define the com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.keyinfo property. Set to false, otherwise.
com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.keyinfo	PARTNER	Validate	Regular expression to validate the subject distinguished name returned in the KeyInfo, if com.tivoli.am.fim.sts.saml.1.1. assertion.signature.use.keyinfois set to true. We can either specify this property or specify both of the following properties: com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.db com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.cert If we specify all of these properties, the keystore alias format overwrites the com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.keyinfo property.
com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.db	PARTNER	Validate	Name of the certificate database to use for validation, if com.tivoli.am.fim.sts.saml.1.1. assertion.keystore.alias is set to true.
com.tivoli.am.fim.sts.saml.1.1. ValidateKeyIdentifier.cert	PARTNER	Validate	Name of the certificate label for validation, if com.tivoli.am.fim.sts.saml.1.1. assertion.keystore.alias is set to true.
com.tivoli.am.fim.sts.saml.1.1. WantMultipleAttributeStatements	PARTNER	Validate	Whether to create multiple attribute statements in the Universal User. If we specify false, multiple attribute statements are arranged into a single group (AttributeList) in the STSUniversalUserdocument. This setting is appropriate for most configurations.
com.tivoli.am.fim.sts.saml.1.1. assertion.issuer	SELF	Issue, Exchange	Name of the organization that issues assertions. This is required.
com.tivoli.am.fim.sts.saml.1.1. assertion.pretime.valid	SELF	Issue, Exchange	Number of seconds that assertions are valid before its issue date. There is no minimum or maximum value enforced, but a value is required. Default: 60
com.tivoli.am.fim.sts.saml.1.1. assertion.posttime.valid	SELF	Issue, Exchange	Number of seconds that assertions are valid after its issue date. There is no minimum or maximum value enforced, but a value is required. Default: 60
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.use. inclusive.namespaces	PARTNER	Issue, Exchange	Whether to use the InclusiveNamespaces construct. This means using exclusive XML canonicalization for greater standardization. We must set this parameter without a prefix. Set to true or false. If unset, the system behaves as if it was set to true.
com.tivoli.am.fim.sts.saml.1.1. assertion.attribute.types	PARTNER	Issue, Exchange	Types of attributes to include in the assertion. The default, an asterisk (*), includes all the attribute types specified in the identity mapping file. To specify one or more attribute types individually, enter each attribute type. Separate multiple type values using &&.
com.tivoli.am.fim.sts.saml.1.1. assertion.sign	PARTNER	Issue, Exchange	Whether SAML assertions must be signed. Set to true to sign assertions. Set to false if signing is not required.
com.tivoli.am.fim.sts.saml.1.1. SigningKeyIdentifier.db	PARTNER	Issue, Exchange	Name of the keystore where the signing key is stored. For example, use DefaultKeyStore.
com.tivoli.am.fim.sts.saml.1.1. signingKeyIdentifier.cert	PARTNER	Issue, Exchange	Name of the signing key identifier. For example, use testkey.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include. subject.keyid	PARTNER	Issue, Exchange	Whether to include the subject key identifier with your signature. Set to true to include the subject key identifier. Set to false to exclude the subject key identifier.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include. public.key	PARTNER	Issue, Exchange	Whether to include the public key with your signature. Set to Yes to include the public key. Set to No to exclude the public key.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include. issuer.details	PARTNER	Issue, Exchange	Whether to include the issuer details with your signature. Set to Yes to include the issuer details. Set to No to exclude the issuer details.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include. subject.name	PARTNER	Issue, Exchange	Whether to include the subject name with your signature. Set to Yes to include the subject name. Set to No to exclude the subject name.
com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include. cert.data	PARTNER	Issue, Exchange	Whether to include the certificate data with your signature. Set to Yes to include the certificate data. Set to No to exclude the certificate data. If none of the assertion.signature.include.* properties are set, the system behaves as if com.tivoli.am.fim.sts.saml.1.1. assertion.signature.include.cert.data is set to true.
com.tivoli.am.fim.sts.saml.1.1. SignatureAlgorithm	PARTNER	Issue, Exchange	Signature algorithm to use for signing assertions. Valid values: RSA-SHA1, set to http://w ww.w3.org/2000/09/xmldsig#rsa-sha1 RSA-SHA256, set to http:// www.w3.org/2001/04/xmldsig-more#rsa-sha256 RSA-SHA512, set to http:// www.w3.org/2001/04/xmldsig-more#rsa-sha512
com.tivoli.am.fim.sts.saml.1.1. assertion.SubjectConfirmationMethod	PARTNER	Issue, Exchange	Subject confirmation method. Valid values: No Subject Confirmation Method urn:oasis:names:tc:SAML:1.1:cm:bearer urn:oasis:names:tc:SAML:1.1:cm:holder-of-key urn:oasis:names:tc:SAML:1.1:cm:sender-vouches