--- title: Hosted SP configuration description: To edit hosted SP settings, go to Native Consoles > Access Management > Realms > Realm Name > Applications > Federation > Entity Providers > Provider Name. component: pingoneaic page_id: pingoneaic:am-saml2:saml2-hosted-sp-configuration canonical_url: https://docs.pingidentity.com/pingoneaic/am-saml2/saml2-hosted-sp-configuration.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: sp-assertion-content: Assertion Content signing_and_encryption: Signing and Encryption nameid_format: NameID Format authentication_context: Authentication Context assertion_time: Assertion Time basic_authentication: Basic Authentication sp-hosted-client-auth: Client Authentication sp-assertion-processing: Assertion Processing attribute_mapper: Attribute Mapper auto_federation: Auto Federation account_mapper: Account Mapper artifact_message_encoding: Artifact Message Encoding url: URL config-redirect-tree: Redirect Tree adapter: Adapter sp-services: Services sp_service_attributes: SP Service Attributes sp-advanced: Advanced sae_configuration: SAE Configuration ecp_configuration: ECP Configuration idp_proxy: IDP Proxy session_synchronization: Session Synchronization relay_state_url_list: Relay State URL List --- # Hosted SP configuration To edit hosted SP settings, go to Native Consoles > Access Management > Realms > *Realm Name* > Applications > Federation > Entity Providers > *Provider Name*. ## Assertion Content ### Signing and Encryption * Request/Response Signing The parts of messages the SP requires the IdP to sign digitally. * Encryption When selected, the IdP must encrypt the selected elements. * Secret ID and Algorithms * Secret ID Identifier By default, Advanced Identity Cloud uses the entity provider's role-specific, default global secret IDs. Alternatively, set an identifier for the secret ID Advanced Identity Cloud uses for this entity provider when resolving secrets. For example, when you set this to `demo`, the entity provider uses the following secret IDs: * `am.applications.federation.entity.providers.saml2.demo.signing` * `am.applications.federation.entity.providers.saml2.demo.encryption` * Signing Algorithm The algorithms the provider uses to sign the request and response attributes selected in the Request/Response Signing group. The provider's metadata extension lists these algorithms. This property has no default. * Digest Algorithm The digest algorithms the provider uses to sign the requests and responses selected in the Request/Response Signing group. The provider's metadata extension lists these algorithms. This property has no default. * Encryption Algorithm The two types of encryption algorithms for the provider: * Symmetric algorithms; the provider uses these to encrypt the objects selected in the Encryption group. Select one or more AES algorithms from the drop-down list. Default: `http://www.w3.org/2001/04/xmlenc#aes128-cbc` * Asymmetric algorithms; the provider advertises this as the transport key algorithm. When SAML 2.0 token encryption is enabled, hosted providers should use the algorithm the remote provider advertises to encrypt symmetric encryption keys. Select one or more algorithms from the drop-down list: * `http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p` (default) * `http://www.w3.org/2009/xmlenc11#rsa-oaep` For this algorithm, Advanced Identity Cloud uses `http://www.w3.org/2009/xmlenc11#mgf1sha256` to create the transport key. * `http://www.w3.org/2001/04/xmlenc#rsa-1_5` For security reasons, don't use this option. ### NameID Format * NameID Format List Supported NameIDs for users shared between providers for SSO. The following diagram shows how the hosted SP determines which NameID format to use: ![How the hosted SP decides which NameID formats to use](_images/nameid-format-flow-hosted-sp.svg) * Disable NameID Persistence By default, Advanced Identity Cloud stores NameIDs the IdP issues when the NameID format is persistent (`urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`) and the account manager matched a local user to the assertion. When you set this, Advanced Identity Cloud no longer stores persistent NameIDs. When you enable this setting, end users must authenticate locally for each SAML login. ### Authentication Context * Mapper A class that implements the `SPAuthnContextMapper` interface and maps the incoming request parameters to an authentication context. Don't edit this field. Default: `com.sun.identity.saml2.plugins.DefaultSPAuthnContextMapper` * Authentication Context The authentication context maps the URI references to the IdP's supported authentication context classes to authentication levels set on the SP side. * Context Reference Select from the following options to define a context reference: * Predefined Reference to choose from a list of supported context references. * Custom Reference to type your own reference to an authentication context. * Level The order of precedence of the context reference classes as a numeric value. Classes with higher numbers are considered stronger than lower numbered classes. The values determine which authentication classes can be used when the SP makes an authentication request that uses a comparison attribute; for example, `minimum` or `better`. Learn about authentication context classes in [Authentication Context for the OASIS Security Assertion Markup Language (SAML) V2.0](http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf) in the *SAML V2.0 Standard*. Default value: `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport` * Comparison Type Used in conjunction with the default authentication context to specify the possible range of authentication mechanisms the IdP can choose from. For example, if the Comparison Type field is set to `better`, and the `PasswordProtectedTransport` authentication context class is selected in the Default Authentication Context field, the IdP must select an authentication mechanism with a higher level assigned. Default: `exact` * Include Request Authentication Context When enabled, include the authentication context class as the requested authentication context in the SAML 2.0 authentication request. Default: Enabled ### Assertion Time * Assertion Time Skew Grace period in seconds for the `NotBefore` time in assertions. ### Basic Authentication * Enabled, User Name, Password When enabled, authenticate with the specified credentials at SOAP endpoints. ### Client Authentication * Exclude Client Certificate from Metadata When enabled, don't export the client certificate in the SP metadata. ## Assertion Processing ### Attribute Mapper Extension point to map the SP attributes included in the SAML assertion. * Attribute Mapper The Java class for the default implementation, which sets attributes in the user profile or properties in the session. Don't edit this field. Default: `com.sun.identity.saml2.plugins.DefaultSPAttributeMapper` * Attribute Map Maps SAML attributes to user profile attributes or session properties. The Key is a SAML attribute from the assertion. The Value is the profile attribute or session property. By default, the SP maps SAML attributes to session properties with the same names. When the SP creates a profile during auto-federation, the SP maps SAML attributes to the new user profile. The special mapping `Key: *, Value: *` maps each attribute in the assertion to a session property or profile attribute with the same name. For example, if the SP receives `mail` and `givenName` in the assertion, it maps them to `mail` and `givenName`. Remove the special mapping and add key pairs to the map if: * (Auto-federation) The attributes in the IdP's and the SP's identity stores do not match. * You need control over the names of the session properties. * You need control over the attributes to map because the IdP adds too many to the assertion. ### Auto Federation * Enabled When enabled, automatically federate the user's accounts at different providers based on the specified SAML attribute. * Attribute The SAML attribute to match accounts at different providers. ### Account Mapper * Account Mapper The Java class for the default implementation to map remote users to local user profiles. * Account Mapper Script A script to map remote users to local user profiles. * Use Name ID as User ID When selected, fall back to the NameID from the assertion to find the user. * Transient User When set, map all transient users from the IdP to this profile. ### Artifact Message Encoding * Artifact Message Encoding The message encoding format for artifacts. ### URL * Local Authentication URL If set, overrides the default redirect URL to use after validating the SAML 2.0 assertion from the IdP. Use this setting, for example, if you have created a custom UI for federation. In integrated mode, Advanced Identity Cloud appends query string parameters to this URL. The parameters contain details to let Advanced Identity Cloud continue the authentication journey. In standalone mode, Advanced Identity Cloud redirects users to the specified URL and appends a `goto` parameter, identifying the next redirect URL for the user. To make sure a valid tree is configured, use [Redirect Tree](#config-redirect-tree) instead. However, if configured, the value for `Local Authentication URL` overrides `Redirect Tree Name`. * Intermediate URL A URL to redirect the user to after authentication but before the original URL requested. * External Application Logout URL The URL to send an HTTP POST with all cookies when receiving a logout request. Add a user session property by including it as a query string parameter named `appsessionproperty`. ### Redirect Tree * Redirect Tree Name If specified, Advanced Identity Cloud redirects to this journey after validating the SAML2 assertion from the IdP. For IdP-initiated SSO, you must set either `Redirect Tree Name` or `Local Authentication URL`, otherwise the SP fails to process the assertion and returns an invalid request error. If you provide a value for both settings, Advanced Identity Cloud prioritizes `Local Authentication URL`. You can't delete a journey if it's set as the value for `Redirect Tree Name`. Find information about setting a redirect journey in [Redirect to a journey on the hosted SP](configure-providers.html#config-redirect-tree). * Default Relay State URL The URL to redirect users to after completing the request. Advanced Identity Cloud uses this if the response does not specify the `RelayState`. ### Adapter * Adapter A Java class to perform application-specific processing during the federation process. * Adapter Environment Environment variables Advanced Identity Cloud passes to the adapter class. ## Services * MetaAlias Read-only alias to locate the provider's entity identifier, specified as `/realm-name/provider-name`; for example: `/alpha/mySP`. ### SP Service Attributes * Single Logout Service The endpoints to manage SLO depending on the SAML binding. * Manage NameID Service The endpoints to manage NameIDs depending on the SAML binding. - Assertion Consumer Service The endpoints to consume assertions, where the order corresponds to the index of the URL in the standard metadata. The scheme, FQDN, and port configured must exactly match the SPs settings in its metadata. If the base URL service is configured, Advanced Identity Cloud uses it to determine the SP's endpoint URL. If the URL doesn't match, the SAML 2.0 flow fails and Advanced Identity Cloud logs an `Invalid Assertion Consumer Location specified` message. Set the HTTP-Artifact and HTTP-POST service locations to `AuthConsumer` for [integrated mode](saml2-integrated-mode.html). ## Advanced ### SAE Configuration * SP URL The endpoint to manage SAE requests. * SP Logout URL The SP endpoint to process global logout requests. * Application Security Configuration Encryption settings for SAE. ### ECP Configuration * Request IDP List Finder Implementation A Java class to return a list of preferred IdPs trusted for the SAML ECP profile. Default: `com.sun.identity.saml2.plugins.ECPIDPFinder` * Request IDP List Get Complete A URI reference to retrieve the complete list of IdPs if the `IDPList` element is not complete. * Request IDP List A list of IdPs for the ECP client or proxy to contact. The default finder implementation uses this. ### IDP Proxy * IDP Proxy When enabled, Advanced Identity Cloud adds a `Scoping` element to the authentication request for proxying. * Introduction When enabled, use introductions to find the proxy IDP. * Proxy Count The maximum number of proxy identity providers. * IDP Proxy List A list of URIs for preferred proxy IDPs. ### Session Synchronization * Enabled When enabled, the SP sends backchannel SOAP logout requests to all IDPs when an authenticated session times out. An authenticated session can time out after the maximum idle time or maximum session time, for example. ### Relay State URL List * Relay State URL List List of accepted `RelayState` URLs. Advanced Identity Cloud validates the `RelayState` redirection URLs against this list during SLO. Advanced Identity Cloud only allows redirection to `RelayState` URLs in this list or matching the tenant domain; otherwise, a browser error occurs. Use the pattern matching rules in [Success and failure redirection URLs](../am-authentication/redirection-url-precedence.html) to specify URLs.