Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a SAML assertion?
Short answer
A SAML assertion is the XML statement that the IdP sends inside the SAML response and that states who the user is (NameID), when and how the user was authenticated and which attributes (such as e-mail, name, group) the user has. The assertion is produced for a specific SP (audience) and with a short validity period; the IdP digitally signs it, the response document or both (OASIS SAML 2.0). In TR7 AGS, the SAML 2.0-type Authentication Provider reads the user information from the assertion: while Require Signed Assertions is on (default), assertions that are not individually signed are rejected; if the IdP signs the response instead of the assertion, Require Signed Response is turned on, and at least one of the two stays on. The IdP sends the assertion to the Assertion Consumer Service URL address.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (SAML 2.0) | Require Signed Assertions (on by default), Require Signed Response (off by default) | Rejection of an unsigned assertion or response |
| AGS → Authentication → Authentication Providers (SAML 2.0) | Assertion Consumer Service URL | The TR7 address to which the IdP sends the response containing the assertion |
| AGS → Authentication → Authentication Providers (SAML 2.0) | SP Entity ID, IdP Entity ID (issuer), Clock Skew Tolerance | Validation of the assertion's expected audience, expected issuer and validity time |
| AGS → Authentication → Authentication Providers (SAML 2.0) | Custom User Attribute Mapping; JSONata context Assertion Attributes (SAML) | Mapping of the assertion attributes to AGS user fields |
| AGS-enabled vService → Sessions | User columns such as Username, E-mail, Groups | Viewing the information written to the session from the assertion |
Common Misconceptions
- "An assertion carries only the username." Besides the user identity, an assertion also carries the authentication time, the validity conditions and the attributes.
- "If the response is signed, the assertion has a signature too." The signature can be in the response document, in the assertion or in both; which one is signed depends on the IdP setting. This is why TR7 has two separate options.
- "The attribute names in the assertion are the same in every IdP." The names vary by IdP (e.g., names in URI format); different names are mapped to AGS user fields with Custom User Attribute Mapping (What is a claim; how does it differ from a SAML attribute?).
How it is done in the documentation
