This pageapplies toApigee andApigee hybrid.

View Apigee Edge documentation.

The SAMLAssertion policy enables API proxies to validate SAML assertions that are attached to inbound SOAP requests, or to attach SAML assertions to outbound XML requests. The SAML policy validates incoming messages that contain a digitally-signed SAML assertion, rejects them if they are invalid, and sets variables that allow additional policies, or the backend services itself, to further validate the information in the assertion.

• Inbound authentication and authorization: Validate SAML Assertion policy
  The SAML policy type enables API proxies to validate SAML assertions that are attached to inbound SOAP requests. The SAML policy validates incoming messages that contain a digitally-signed SAML assertion, rejects them if they are invalid, and sets variables that allow additional policies, or the backend services itself, to further validate the information in the assertion.
• Outbound token generation: Generate SAML Assertion policy
  The SAML policy type enables API proxies to attach SAML assertions to outbound XML requests. Those assertions are then available to enable backend services to apply further security processing for authentication and authorization.

This policy is anExtensible policy and use of this policy might have cost or utilization implications, depending on your Apigee license. For information on policy types and usage implications, seePolicy types.

Samples

<GenerateSAMLAssertionname="SAML"ignoreContentType="false"><CanonicalizationAlgorithm/><Issuerref="reference">Issuername</Issuer><KeyStore><Nameref="reference">keystorename</Name><Aliasref="reference">alias</Alias></KeyStore><OutputVariable><FlowVariable>assertion.content</FlowVariable><Messagename="request"><Namespaces><Namespaceprefix="soap">http://schemas.xmlsoap.org/soap/envelope/</Namespace><Namespaceprefix='wsse'>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</Namespace></Namespaces><XPath>/soap:Envelope/soap:Header/wsse:Security</XPath></Message></OutputVariable><SignatureAlgorithm/><Subjectref="reference">Subjectname</Subject><TemplateignoreUnresolvedVariables="false"><!--AlotofXMLgoeshere,withinCDATA,with{}aroundeachvariable--></Template></GenerateSAMLAssertion>

<ValidateSAMLAssertionname="SAML"ignoreContentType="false"><Sourcename="request"><Namespaces><Namespaceprefix='soap'>http://schemas.xmlsoap.org/soap/envelope/</Namespace><Namespaceprefix='wsse'>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</Namespace><Namespaceprefix='saml'>urn:oasis:names:tc:SAML:2.0:assertion</Namespace></Namespaces><AssertionXPath>/soap:Envelope/soap:Header/wsse:Security/saml:Assertion</AssertionXPath><SignedElementXPath>/soap:Envelope/soap:Header/wsse:Security/saml:Assertion</SignedElementXPath></Source><TrustStore>TrustStoreName</TrustStore><RemoveAssertion>false</RemoveAssertion></ValidateSAMLAssertion>

Element reference

Generate SAML Assertion

Validate SAML Assertion

Usage notes

The Security Assertion Markup Language (SAML) specification defines formats and protocols that enable applications to exchange XML-formatted information for authentication and authorization.

A "security assertion" is a trusted token that describes an attribute of an app, an app user, or some other participant in a transaction. Security assertions are managed and consumed by two types of entities:

• Identity providers: Generate security assertions on behalf of participants
• Service providers: Validate security assertions through trusted relationships with identity providers

The API platform can act as an identity provider and as a service provider. It acts as an identity provider by generating assertions and attaching them to request messages, making those assertions available for processing by backend services. It acts as a service provider by validating assertions on inbound request messages.

The SAML policy type supports SAML assertions that match version 2.0 of the SAML Core Specification and Version 1.0 of the WS-Security SAML Token Profile specification.

Generate SAML Assertion

Policy processing:

1. If the message is not XML, and IgnoreContentType is not set totrue, then raise a fault.
2. If "Template" is set, then process the template as described for the AssignMessage policy. If any variables are missing and IgnoreUnresolvedVariables is not set, then raise a fault.
3. If "Template" is not set, then construct an assertion that includes the values of the Subject and Issuer parameters or their references.
4. Sign the assertion using the specified key.
5. Add the assertion to the message at the specified XPath.

Validate SAML Assertion

Policy processing:

1. The policy checks the inbound message to verify that the request's media type is XML, by checking if the content type matches the formatstext/(.*+)?xml orapplication/(.*+)?xml. If the media type is not XML and<IgnoreContentType> is not set, then the policy will raise a fault.
2. The policy will parse the XML. If parsing fails then it will raise a fault.
3. The policy will extract the signed element and the assertion, using the respective XPaths specified (<SignedElementXPath> and<AssertionXPath>). If either of these paths do not return an element, then the policy will raise a fault.
4. The policy will verify that the Assertion is the same as the signed element, or is a child of the signed element. If this is not true, then the policy will raise a fault.
5. If either of the<NotBefore> or<NotOnOrAfter> elements are present in the assertion, the policy will check the current timestamp against these values, as described in SAML Core section 2.5.1.
6. The policy will apply any additional rules for processing the "Conditions" as described in SAML Core section 2.5.1.1.
7. The policy will validate the XML digital signature, using the values of<TrustStore> and<ValidateSigner> as described above. If validation fails, then the policy will raise a fault.

Once the policy has completed without raising a fault, the developer of the proxy can be sure of the following:

• The digital signature on the assertion is valid and was signed by a trusted CA
• The assertion is valid for the current time period
• The subject and issuer of the assertion will be extracted and set in flow variables. It is the responsibility of other policies to use these values for additional authentication, such as checking that the subject name is valid, or passing it to a target system for validation.

Other policies, such as ExtractVariables, may be used to parse the raw XML of the assertion for more complex validation.

Flow variables

There are many pieces of information that may be specified in a SAML assertion. The SAML assertion itself is XML that can be parsed using theExtractVariables policy and other mechanisms in order to implement more complex validations.

Error reference

This section describes the fault codes and error messages that are returned and fault variables that are set by Apigee when this policy triggers an error. This information is important to know if you are developing fault rules to handle faults. To learn more, seeWhat you need to know about policy errors andHandling faults.

Deployment errors

These errors can occur when you deploy a proxy containing this policy.

These variables are set when a runtime error occurs. For more information, seeWhat you need to know about policy errors.

Example error response

{"fault":{"faultstring":"GenerateSAMLAssertion[GenSAMLAssert]: Invalid media type","detail":{"errorcode":"steps.saml.generate.InvalidMediaTpe"}}}

<FaultRules>    <FaultRule name="invalid_saml_rule">        <Step>            <Name>invalid-saml</Name>        </Step>        <Condition>(GenerateSAMLAssertion.failed = "true")</Condition>    </FaultRule></FaultRules>

Extracting variables:Extract Variables policy