Overview of Service Portal SAML SSO

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

This section provides an overview of the Service Manager Service Portal Identity Manager (IdM) based SAML Single Sign-O (SSO) process.

The following diagram illustrates the process.

In this approach, the IdM (which plays the role of Service Provider) and the Identity Provider (for example, ADFS) use an HTTP POST Binding.

The user attempts to access a protected resource on the service provider (SP). Since the user is unauthenticated with the SP, the SP begins a dialog with the browser to verify the user's identity with the identity provider (IdP). The server must retain the URL of the requested resource so the resource can be provided if the SP receives a valid SAML assertion of the user's identity from a trusted IdP.

The SP sends an HTTP redirect to the browser (HTTP status code 302 or 303). The Location header specifies the URI of the SSO service running on the IdP and the SAMLRequest query parameter contains a DEFLATE-encoded <AuthnRequest> message. The browser handles this response by sending a GET request with the SAMLRequest query parameter to the IdP's SSO service.

The IdP's SSO service determines whether the user is already authenticated; if so, it skips to step 5; otherwise, it interacts with the browser to request the user's credentials.

The user provides valid credentials (for example, username and password, certificate, or smart card PIN).

The IdP SSO service builds a SAML assertion confirming the user's identity and returns a signed <Response> message containing the assertion to the browser.

The browser forwards the SAML <Response> message from the IdP to the SP through HTTP POST.

The SP validates the <Response> message, confirms the user's authorization to view the requested resource or perform the requested action, and if all checks pass, returns the resource to the browser.

Related topics

Connect

Micro Focus Marketplace

ITSM Blog for IT Service Management

ITSM Community

Documentation Forum

Learn

Software Support Online

Software Support Downloads

Software Education Services

Contact

Send Help Center feedback

Submit Service Request

View Service Requests