SAML with ICAM as IdP in ServiceDesk Plus

SAML with ICAM as IdP in ServiceDesk Plus

Usual requirements from ICAM:

  1. The SAML NameID policy must either be unspecified (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified) or emailAddress (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress).
  2. WantAssertionsSigned="true" AND AuthnRequestsSigned="true" must be set in the metadata.
  3. The entityID must be set to the URL of your application endpoint (ex. entitiyID=https://www.servicedesk.mywebsite.com/authenticate)
  4. Document your metadata using the ContactPerson element. Minimal coverage should include the Line Office name and current point of contact with email address and phone number. Append the ContactPerson information between the </SPSSODescriptor> and </EntityDescriptor> tags in your metadata file. An example is below.
  </SPSSODescriptor>
  <ContactPerson contactType="technical OR administrative OR support">
    <Company>Line Office</Company>
    <GivenName>First Name of POC</GivenName>
    <SurName>Last Name of POC</SurName>
    <EmailAddress>Email Address of POC</EmailAddress>
    <TelephoneNumber>Phone Number of POC</TelephoneNumber>
  </ContactPerson>
</EntityDescriptor>

Steps to achieve this:

  1. The Name ID format can be changed in the SAML settings page.
  2. WantAssertionsSigned="true" is already set. Connect to SDP database and run the below query to set AuthnRequestsSigned="true" 
Quote
update samlsp set auth_request_signed=True;
  1. To send sigAlg and other signing parameters as request parameters, run this query:
Quote
update samlidp set binding='REDIRECT';
  1. Entity ID can be modified with the below query:
Quote
update samlsp set entity_id='https://your-app-url/SamlResponseServlet';
  1. Restart SDP service after these changes and download the metadata file. You can manually make the required changes related to Contact Person by editing this metadata file.

To set signed certificate:

The IDP may require signed SAML response. We have prepared an fjar file that will read the certificate and privatekey from SDP's keystore file (your SSL cert) and sets it for SAML signing purposes. To apply this,
- Place load_saml_cert_from_keystore.fjar in the '<sdp_home>/fixes' folder. (create the folder if it doesn't exist)
- Restart SDP service.
- Access the url: <sdp_url>/servlet/DebugServlet
- You will see "OK" printed on the page if the certificate and private key are set successfully from SDP keystore
- Now remove the fjar and restart the service for changes to take effect.