How To: Configure AssertionConsumerServiceIndex for Multiple Service Providers on One Realm

Version Affected: All -- requires the minimum hotfix version noted below.

 

Overview

SecureAuth Identity Provider (IdP) supports SAML AuthnRequests that use AssertionConsumerServiceIndex instead of AssertionConsumerServiceURL. This is used when multiple Service Providers (SPs) send AuthnRequests to the same IdP realm: the IdP uses each SP's metadata together with the index value to map to the correct AssertionConsumerServiceURL for the SAML response, so many SPs can share a single realm instead of each needing its own.

This is supported from the following hotfix versions onward:

• 9.1.0-53
• 9.2.0-30
• 9.3.0-13
• 19.07-2
• 19.07.01-1

On earlier versions, configure a separate realm per Service Provider instead of pointing every Service Provider at a single realm.

Configure AssertionConsumerServiceIndex

1. Decrypt the realm's web.config.
2. Under <appSettings>, add one key per Service Provider, using a unique index number for each:

<add key="AssertionConsumerServiceIndex0" value="https://samlconsumer.company0.com" />
<add key="AssertionConsumerServiceIndex1" value="https://samlconsumer.company1.com" />
<add key="AssertionConsumerServiceIndex2" value="https://samlconsumer.company2.com" />

3. Save the web.config and re-encrypt it.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.