Google Search Appliance Security - Manual (Page 29)

29
binding from scratch, it could be
more complex as it requires an
extra service (Artifact Resolver
URL). There are some open source
frameworks like OpenSAML and
also many code samples for this on
the Internet. requires managing Digital Signatures in
your code.
In general it’s more desirable to use SAML HTTP post binding because it provides a stronger and simpler
solution, mainly in terms of high availability.
Group resolution for early binding (ACL authorization)
The SAML authentication response can be augmented to provide user groups for the authenticated user
back to the GSA. All groups resolved through the SAML authentication mechanism will belong to the
global namespace of the credential group selected for the mechanism.
Sample SAML Response:
In this sample, you can see that the SAML response contains both the username (“Subject”) and a
“member-of” AttributeStatement containing resolved groups for the user.
ID="blahblah2"
IssueInstant="2011-01-01T14:38:05Z"
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
ac.corp.company.com
luis.sanchez
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
marketing
us-employees
SFO-office