--- title: "SSO Parameters" slug: "sso-parameters" updated: 2025-02-10T10:34:57Z published: 2025-02-10T10:34:57Z canonical: "help.iobeya.com/sso-parameters" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.iobeya.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO Parameters Here is the description of each parameter and their possible values: ## Metadata ### Metadata for the identity provider To authenticate users with SAML, iObeya needs to know the Identity Provider it should use and the features it supports. This information is provided in the IdP metadata. **Values:** Upload the IdP metadata file or set an URI limited to: - http:// - file:/// ### Metadata for iObeya (SP) iObeya metadata. **Values:** Upload the iObeya metadata file, or generate it. ### Entity ID of iObeya The entity ID of iObeya to be used for iObeya metadata generation, or to retrieve data from uploaded metadata. **Values** - For metadata generation, default value is the URL where iObeya metadata will be available, that is /saml/metadata. - For uploaded metadata, this can be empty or undefined, if there is only one entity ID in the metadata file. ## Keystore ### Keystore file Keystore file containing the necessary keys. **Values**: The keystore should be generated with Keytool which is part of the Java standard distribution. > [!NOTE] > Note: > > - Use a Keytool version compatible with the JDK version used to deploy iObeya. > - See [Technical requirements](/product/docs/technical-requirements) to know which JDK version you are using. Here are examples of key generation and certificate extraction. Example usages of keytool: - Generate key mycompany.com in keystore keystore.jks ```java keytool -genkey -keystore keystore.jks -alias mycompany.com -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -validity 1095 ``` > [!NOTE] > Note: > > validity = period before expiration in days - Extract X509 certificate from key [mycompany.com](http://mycompany.com) in keystore keystore.jks ```java keytool -export -keystore  keystore.jks -alias mycompany.com -file mycompany.com.cert –rfc ``` - Possibly reimport certificate signed by certification authority (should use the same alias as private key° ```java keytool -import -keystore keystore.jks -alias mycompany.com -file mycompany.com.signed.cert ``` ### Password of the keystore Password of the keystore itself. **Values:** Any string ### Passwords for the keys in the keystore Passwords for the keys in the keystore. **Values**: JSon formatted object, where keys are the key names and values are passwords as strings. Example: ```json {"mycompany.com":"iobeya123", "signing.mycompany.com":"iobeya456"} ``` ### Name of the default key Name of the default key to use when a specific key has not been defined for a particular task (signing, encryption, tls/ssl). Private and public keys must be present in the keystore at keystorePath. **Values**: The name of a key present in the keystore. ## Authentication Attributes ### idpAuthAttributeName The name of the attribute that is returned by the Identity Provider to be used as an identifier to authenticate the user in iObeya. It will be mapped to the iobeyaAuthAttributeName property. **Values**: Any string. ### Name of iObeya user authentication attribute Name of iObeya user attributes that should match the value of the attributes whose name is idpAuthAttributeName. **Values**: - email - Username ### Allow account creation If necessary, create an iObeya account when a user connects via SAML. **Values**: Boolean ## Additional Settings ### Logout method Allows the choice of the logout action in iObeya. **Values**: - Local - When a user logs out from iObeya, she stays connected to the IdP, but is disconnected from iObeya. - Global - When a user logs out from iObeya, the IdP will be asked to perform a single logout (IdP tries to contact all connected SPs to disconnect them). - Custom - When a user logs out from iObeya, she is redirected to a custom URL, for example, the logout URL of the IdP. ### Security profile Security profile for verification of message signatures. **Values**: - metaiop - SAMLv2 Metadata Interoperability Profile. - Uses cryptographic data from the metadata document of the entity in question. No checks for validity or revocation of certificates is done in this mode. All keys must be known in advance. - pkix - Signatures are deemed as trusted when credentials can be verified using PKIX with trusted keys of the peer configured as trusted anchors. ### SSL security profile Security profile for verification of SSL/TLS endpoint trust. **Values**: - Same as sslSecurity: - metaiop - pkix ### SSL Hostname Verification Hostname verifier to use for verification of SSL connections **Values**: - default - org.apache.commons.ssl.HostnameVerifier.DEFAULT - defaultAndLocalhost - org.apache.commons.ssl.HostnameVerifier.DEFAULT_AND_LOCALHOST - strict - org.apache.commons.ssl.HostnameVerifier.STRICT - allowAll - org.apache.commons.ssl.HostnameVerifier.ALLOW_ALL, does not perform any validation. ## Signing Algorithm ### Signing Algorithm URI identifying the algorithm variant to use for signing. This will only be taken into account to select the hash function (sha256, sha512, …), given that the algorithm is already specified by the signing key (attributes defaultKey/signingKey ). **Values**: - The valid URIs are the OpenSAML supported subset of those in: - [XML Signature](https://www.w3.org/TR/xmldsig-core1/#sec-Algorithms) - [RFC 6931#section-2.3](https://tools.ietf.org/html/rfc6931.html#section-2.3) - Typical values: - [sha256](http://www.w3.org/2001/04/xmldsig-more%23rsa-sha256) - [sha512](http://www.w3.org/2001/04/xmldsig-more%23rsa-sha512) - [sha384](http://www.w3.org/2001/04/xmldsig-more%23ecdsa-sha384) ### Digest Method for signature reference URI identifying the digest algorithm to be applied to the signed object. **Values**: - The valid URIs are the OpenSAML supported subset of those in: - [XML Signature 1.1](https://www.w3.org/TR/xmldsig-core1/#sec-Algorithms) - [RFC 6931#section-2.3](https://tools.ietf.org/html/rfc6931.html#section-2.3) - Typical values: - [sha256](http://www.w3.org/2001/04/xmldsig-more%23rsa-sha256) - [sha512](http://www.w3.org/2001/04/xmldsig-more%23rsa-sha512) - [sha384](http://www.w3.org/2001/04/xmldsig-more%23ecdsa-sha384) ### Signing Key Name of the key to use for signing. Private and public keys must be present in the keystore at keystorePath. **Values**: The name of a key present in the keystore. ### Encryption key Name of the key to use for encrypting. Private and public keys must be present in the keystore at keystorePath. **Values**: The name of a key present in the keystore. ### TLS Key Alias of private key used for SSL/TLS client authentication. No client authentication is used when value is not specified. Private and public keys must be present in the keystore at keystorePath. **Values:** The name of a key present in the keystore. ### Trusted keys Keys included as trusted anchors during PKIX evaluation. Keys are only used with PKIX security profile. **Values**: Comma separated list of key names from the keystore (@keystorePath). ### Max authentication age Maximum time of the authentication token. User needs to authenticate if this time is spent since the last connection. **Values**: Time in seconds the IdP configuration can override this configuration. ### Scoping inclusion When true, include scoping (should be false when using Microsoft ADFS or Azure AD as IdP). **Values**: boolean ### Enable SAML 2.0 ECP profile Enables support for the SAML 2.0 ECP profile. **Values**: boolean ### Support for unsolicited response Enables support for unsolicited responses (IdP-Initialized SSO). **Values**: boolean ### Metadata signature When true, sign metadata (using XML Signature using certificate corresponding to signingKey). **Values**: boolean ### Requirement of signature for logout requests When true, only accept signed logout requests from IdP. **Values**: boolean ### Sign logout requests sent to IdP When true, sign logout requests sent to IdP. **Values**: boolean ### Requirement of signature for logout responses When true, require from IdP to sign logout responses. **Values**: boolean ### Signature of logout responser When true, sign logout responses sent to IdP. **Values**: boolean > [!WARNING] > Warning: > > When updating from version 3.4.4 or below, to version 3.5 or above, default values for signing algorithm and signature reference digest methods have been updated from SHA-1 to SHA-256 due to security concerns. > > In case of incompatibility, we suggest updating IdP hash methods, but it is still possible to set values explicitly to SHA-1 ([http://www.w3.org/2000/09/xmldsig#rsa-sha1](http://www.w3.org/2000/09/xmldsig#rsa-sha1)) in attributes signingAlgorithm and signatureReferenceDigestMethod. ## Troubleshooting In the case of configuration problems, it can be helpful to enable the debug logs related to SAML in the log4j configuration file. ```accesslog ... ```