Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is SAML metadata?
Short answer
SAML metadata defines the information that an IdP or an SP needs for SAML in a single XML document: the entity ID, the SSO and logout addresses and their bindings, the signing certificate and the supported NameID formats (OASIS SAML 2.0 Metadata). By importing each other's metadata, the parties are paired without entering this information manually. In TR7 AGS, the Import Metadata button in the SAML 2.0 form fills in the IdP Single Sign-on URL, IdP Entity ID (issuer), IdP Signing Certificate and, if it is one of the formats in the list, NameID Format fields from the IdP metadata pasted into the Metadata XML field of the window that opens. The XML is parsed in the browser; TR7 does not download the metadata from the IdP by itself. TR7's SP information (SP Entity ID and Assertion Consumer Service URL) is written manually in the application record in the IdP.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers (SAML 2.0) | Import Metadata → Import Identity Provider Metadata window → Metadata XML | Filling in the IdP information from the metadata |
| Same form | IdP Single Sign-on URL, IdP Entity ID (issuer), IdP Signing Certificate, NameID Format | Fields filled in from the metadata; they can also be entered manually |
| Same form | SP Entity ID, Assertion Consumer Service URL | The TR7 information written in the application record in the IdP |
What Information Is Taken from the Metadata?
| Metadata element | TR7 field filled in |
|---|---|
| SingleSignOnService in IDPSSODescriptor (first the HTTP-Redirect binding, if it is absent HTTP-POST, and if that is absent as well the first entry) | IdP Single Sign-on URL |
entityID in EntityDescriptor | IdP Entity ID (issuer) |
| X.509 certificates in the KeyDescriptors for signing (or with no usage type specified), in PEM format | IdP Signing Certificate |
| The first NameIDFormat, if it is one of Unspecified, E-mail Address, Persistent or Transient | NameID format |
If the SSO address or the signing certificate cannot be found, the import fails and the window stays open. The Authentication Request Binding field is not changed by the metadata.
Common Misconceptions
- "Metadata is a secret document." Metadata contains only the information that has to be shared (addresses, public certificate); it does not carry a private key.
- "Once metadata is imported, it stays up to date." TR7 reads the metadata only at the moment it is imported; when the IdP changes its certificate or addresses, the current metadata is imported again or the fields are updated manually.
- "Importing metadata configures the SP side too." Import Metadata fills in only the IdP fields; the application record for TR7 in the IdP is created separately.
How it is done in the documentation
