Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# DRM Sign-in: SAML 1.1 POST Profile example

The SAML 1.1 POST Profile only supports the HTTP GET operation for DRM Sign-in.

# HTTP GET Operations

This is the content for the HTTP GET DRM SSO Sign-in operation.

    https://authenticate.gateway.gov.uk/Protocols/Saml/DelegatedSignin.ashx?
    TARGET=[Target Resource]&
    lang=-[Language]&
    token=[One-time Token]&
    signouturl=[Sign-Out Address]

This is the response produced by the CAP for a DRM Sign-in (HTTP GET or POST)

    <form id="gatewayRes" method="post" action="[Reply Address]"
      <input Name="SAMLResponse" type="hidden" id="SAMLResponse" Value="[Base64 encoded Response]" />
      <input Name="TARGET" type="hidden" id="TARGET" Value="[Target Resource]" />
    </form>

Response includes the SAML Assertion (this is not for the target Portal):

    <samlp:Response
      IssueInstant="2007-02-17T07:52:42Z" MajorVersion="1" MinorVersion="1"
      Recipient="[Target Resource]"
      ResponseID="_fc044b49-d3da-4be9-9f18-33e6bbdc9b4c"
      xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <samlp:Status>
        <samlp:StatusCode Value="samlp:Success" />
      </samlp:Status>
      [SAML Assertion]
      <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
          <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
          <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
          <Reference URI="#_fc044b49-d3da-4be9-9f18-33e6bbdc9b4c">
            <Transforms>
              <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
              <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                <InclusiveNamespaces PrefixList="#default saml samlp ds xsd xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
              </Transform>
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>GzXmcbBXkJYwSOk+Gnf5/yz18Yc=</DigestValue>
          </Reference>
        </SignedInfo>
        <SignatureValue>[signatureValue]</SignatureValue>
        <KeyInfo>
          <X509Data>
            <X509Certificate>[X509Certificate]</X509Certificate>
          </X509Data>
        </KeyInfo>
      </Signature>
    </samlp:Response>

Response returns an error:

    <samlp:Response
      IssueInstant="2007-02-17T07:52:42Z" MajorVersion="1" MinorVersion="1"
      Recipient="[Recipient]"
      ResponseID="_fc044b49-d3da-4be9-9f18-33e6bbdc9b4c"
      xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
      xmlns:xsd="http://www.w3.org/2001/XMLSchema"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <samlp:Status>
        <samlp:StatusCode Value="samlp:Responder">
          <samlp:StatusCode Value="samlp:RequestDenied" />
        </samlp:StatusCode>
        <samlp:StatusMessage>The security token could not be authenticated or authorized</samlp:StatusMessage>
      </samlp:Status>
     </samlp:Response>

Note:

- TARGET: Contains the Target Resource which reference a Portal Resource File (configured for the organisation) – this includes the Reply Address URL (i.e. within the corporate application) to which the browser will redirect the response. Note this is not the Target Resource for the target Portal.
- lang: Identifies the language for displayed pages. For example en-GB for English and cy-GB for Welsh. It is used in in conjunction with the Target Resource value to qualify the Portal Resource File to be used.
- One-time Token is the value returned from GsoDelegateRights. This authenticated the corporate user.
- Sign-out URL specifies the URL to return to when the corporate user signs out.
- Recipient is the Target Resource supplied in the request operation.
- The SAML Assertion will be returned using the Novell protocol implementation. However the primary significance of receiving the assertion is that it indicates the corporate user has been successfully authenticated – it cannot be use to directly get a GatewayToken..

© Crown Copyright 2008. All rights reserved