SAML Component

Properties   Methods   Events   Config Settings   Errors  

The SAML component provides an easy way to add SAML-based SSO to your application.

Syntax

TciSAML

Remarks

The Security Assertion Markup Language (SAML) protocol provides a standardized way to add Single Sign-on (SSO) to applications. Service Providers (i.e., your application) using SAML-based SSO can eliminate the need to store and manage user passwords. When using SAML, the responsibility of identifying a user can be shifted to the Identity Provider.

In a Web environment, this is typically done by redirecting a user with a SAML request from your application to the Identity Provider's login page where a user already has an account. The user will login, and the Identity Provider will return an assertion in a SAML response, which is a set of information about the user and the authentication steps taken to identify the user.

When a Service Provider (i.e., your web application) receives this SAML response, it will verify both the SAML response and its accompanying assertion to ensure that both were requested by the Service Provider and issued by the Identity Provider. Once the SAML response and assertion have been verified, the assertion will typically contain attributes about the user and its profile with the Identity Provider.

SAML also supports Single Logout (SLO) that can be used to log a user out of the Identity Provider and, depending on the configuration of the Identity Provider, all other accounts that used the Identity Provider to authenticate the user.

Setup

To get started with the component, information about the Identity Provider is needed. Typically, this information is provided by a SAML Metadata Document that is either provided during the setup or requested from a URI. The RequestIdentityMetadata and LoadIdentityMetadata methods are both ways to populate the IdentityProviderMetadata, IdentityProviderSigningCert, and IdentityProviderURIs properties.

Usage: Requesting and Reloading the Identity Provider Metadata Document

saml.RequestIdentityMetadata("https://example.com/federationmetadata/federationmetadata.xml"); string raw_document = saml.IdentityProviderMetadata.MetadataContent; //... saml.LoadIdentityMetadata(raw_document, true);

Additionally, the component needs to be configured with the information about the Service Provider (i.e., your application). The ServiceProviderMetadata, ServiceProviderSigningCert, and ServiceProviderURIs properties can be used to provide information about the Service Provider. These are used by the component to build a valid SAML request and to verify the SAML response and its assertions. Additionally, to easily supply this information to an Identity Provider, the BuildServiceMetadata method can be used to create a SAML Metadata Document that describes your application (the Service Provider) to the Identity Provider.

Usage: Configuring Service Provider Metadata

saml.ServiceProviderMetadata.EntityId = "ServiceProviderId"; saml.ServiceProviderMetadata.AuthnRequestSigned = true; saml.ServiceProviderMetadata.WantAssertionsSigned = true; saml.ServiceProviderSigningCert = new Certificate(CertStoreTypes.cstPFXFile, "cert.pfx", "password", "*"); URI acs = new URI(); acs.URIType = SAMLURITypes.sutACS; acs.Location = "https://service_provider.com/acs/"; acs.BindingType = subPost; saml.ServiceProviderURIs.Add(acs); URI logout = new URI(); logout.URIType = SAMLURITypes.sutLogout; logout.Location = "https://service_provider.com/logout/"; logout.Binding = subRedirect; saml.ServiceProviderURIs.Add(acs); saml.BuildServiceMetadata();

Authentication Request

Once configured, the BuildAuthnRequest method can be used to build a SAML request that has been configured by the SAMLRequestSettings. Additionally, to provide state information between the request and the response, the RelayState property can be set. Typically the RelayState property can be used to return a user back to the location within the application once they have been authenticated. After the request has been created, the SAMLRequestId and SAMLRequestIssuer properties need to be saved for verification purposes. The SAMLRequestIssuer property will be used to check that the SAML response is meant for this Service Provider. The SAMLRequestId property is used to verify that the response corresponds to a request that was made by the Service Provider.

Usage: Building an Authn Request

saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.RequestBinding = SAMLRequestBindings.srbHTTPRedirect; saml.SAMLRequestSettings.SignRequest = true; saml.RelayState = "https://service_provider.com/landing"; saml.BuildAuthnRequest(); string requestId = saml.SAMLRequestSettings.Id; //save for later

Depending on how the SAMLRequestRequestBinding property is configured, the results will be provided through the SAMLRequestBody and SAMLRequestURL properties. Using the information from the properties, the user that needs identifying should be directed to the SAMLRequestURL. If using the srbHTTPRedirect binding, this is typically done by redirecting the user to the URL. This URL will contain the SAMLRequest and RelayState as query parameters that are parsed by the Identity Provider. If using the srbHTTPPost binding, this is done by using an HTML form post as seen below:

string htmlContent = $@" <!DOCTYPE html> <html> <head> <title>SAML POST</title> </head> <body onload='document.forms[0].submit()'> <form method='post' action='{saml.SAMLRequestURL}'> <input type='hidden' name='SAMLRequest' value='{saml.SAMLRequestBody}'/> <input type='hidden' name='RelayState' value='{saml.RelayState}'/> </form> </body> </html>";

Authentication Response

Once the user has completed authentication, the Identity Provider will return the user to the Assertion Consumer Service (ASC) URI that was configured in the ServiceProviderURIs properties. If authentication was successful, this response should also contain an assertion as well as information about the authentication context.

To handle an incoming HTTP request that contains the SAML response, the ProcessSAMLResponse or ParseSAMLResponse methods can be used. To provide the HTTP headers and body that contain the SAML response directly to the component, the SAMLResponseHeaders and SAMLResponseBody properties can be set before calling ParseSAMLResponse or ProcessSAMLResponse. For example:

saml.SAMLResponseBody = "HTTP Body"; saml.SAMLResponseHeaders = "HTTP Headers";

If working in a framework that does not provide the raw HTTP request that contains the SAML response to the application, the SAMLResponseResponseContent can be set directly with the SAML response before calling the ProcessSAMLResponse or ParseSAMLResponse methods.

Once the HTTP request that contains the SAML response has been provided, the application can then call the ProcessSAMLResponse method. While the ProcessSAMLResponse method processes the SAML response, the component fires the SAMLResponse and Assertion events. These events can be used to provide the component the information needed to correctly verify the SAML response such as the SAMLRequestId and SAMLRequestIssuer properties that were saved after creating the SAML request. If the SAML response and assertion are valid, the method will return without any errors. Additionally, the SAMLResponseInfo, AssertionInfo, AssertionAttributeInfo, and AssertionAuthnInfo properties will be populated. saml.RequestIdentityMetadata("https://example.com/federationmetadata/federationmetadata.xml"); //Setup Service Provider URI acs = new URI(); acs.URIType = SAMLURITypes.sutACS; acs.Location = "https://service_provider.com/acs/"; acs.BindingType = URIBindings.subPost saml.ServiceProviderURIs.Add(acs); //Provide information about the SAML request. saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.Id = requestId; saml.ProcessSAMLResponse();

The ProcessSAMLResponse method performs multiple steps automatically, making it a simple method to handle the SAML response. The method is the equivalent to calling the ParseSAMLResponse, ValidateSAMLResponse, ParseAssertion, and ValidateAssertion methods. These methods can be used in place of calling ProcessSAMLResponse if there are additional considerations or extra control is needed by your application. saml.ParseSAMLResponse(); saml.ValidateSAMLResponse(); saml.ParseAssertion(); saml.ValidateAssertion();

Assertions

The SAML 2.0 specification gives Identity Providers many different options for what can be included in an assertion. In the Web SSO profile, typically the assertion will contain the Issuer, Signature, Subject, Conditions, AttributeStatement, and AuthnStatement. Information found from the Issuer, Signature, Subject, and Conditions sections of the assertion can be found in the AssertionInfo property. Along with providing information about the assertion, these fields are also used to verify the assertion. An important field to note is the AssertionSubjectNameId property. This property provides the unique identifier for the user which can be used for authorization purposes. See below for information about the AttributeStatement and AuthnStatement sections.

Assertion Authentication Context

The AuthnStatement section is used by the Identity Provider to provide the Service Provider with information about its authentication session with the user. The statement is parsed to the AssertionAuthnInfo property. Some commonly used information is how the user authenticated with the Identity Provider (see AssertionAuthnInfoContextClassReference) and the session identifier created by the Identity Provider for the Service Provider (see AssertionAuthnInfoSessionIndex).

Assertion Attributes

Along with the AssertionSubjectNameId, the Identity Provider may give additional information about the user in the AttributeStatement section. What exactly is provided depends on how the connection between the Identity Provider and Service Provider was configured. Since there is no defined list of attributes, the AssertionAttributeInfo properties will be populated with each attribute found. Each attribute has a name and one or more values. For example, take the following attribute that describes a list of emails attached to the user.

<Attribute Name="verified_emails"> <AttributeValue>email@test.com</AttributeValue> <AttributeValue>other@example.com</AttributeValue> </Attribute>

In this assertion attribute statement, the user has two emails that have been verified. There are two ways to get this information using the SAML component. First, using the collection, the application can iterate through the collection for the attribute and then iterate through the associated values. Using this method is useful if there are multiple acceptable names for the attributes that could be accepted. For example: List<string> verified_emails = new List<string>(); for (int i = 0; i < saml.AssertionAttributeInfo.Count; i++) { if (saml.AssertionAttributeInfo[i].Name == "verified_emails" || saml.AssertionAttributeInfo[i].Name == "verified_email") { for (int j = 0; j < saml.AssertionAttributeInfo[i].AttributeValueCount; j++) { saml.AssertionAttributeInfo[i].AttributeValueIndex = j; verified_emails.Add(saml.AssertionAttributeInfo[i].AttributeValueData); } } }

The other option is to use the GetAssertionAttribute method. This method will search the assertion's attribute statement for the first attribute with a matching name. Like in the example above, if the attribute has multiple values, the method will return them in a semicolon-separated list. This method simplifies the process of searching the collection for a specific attribute if the name of the attribute is known ahead of time. For example: string[] verified_emails = saml.GetAssertionAttribute("verified_emails").Split(';');

Property List

---

The following is the full list of the properties of the component with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the component with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the component with short descriptions. Click on the links for further details.

AssertionAttributeInfoCount Property (SAML Component)

The number of records in the AssertionAttributeInfo arrays.

Syntax

__property int AssertionAttributeInfoCount = { read=FAssertionAttributeInfoCount, write=FSetAssertionAttributeInfoCount };

Default Value

0

Remarks

This property controls the size of the following arrays:

• AssertionAttributeInfoAttributeContent
• AssertionAttributeInfoAttributeValueCount
• AssertionAttributeInfoAttributeValueData
• AssertionAttributeInfoAttributeValueIndex
• AssertionAttributeInfoFriendlyName
• AssertionAttributeInfoName
• AssertionAttributeInfoNameFormat

The array indices start at 0 and end at AssertionAttributeInfoCount - 1.

This property is not available at design time.

Data Type

Integer

AssertionAttributeInfoAttributeContent Property (SAML Component)

The raw XML of the attribute.

Syntax

__property String AssertionAttributeInfoAttributeContent[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoAttributeContent };

Default Value

""

Remarks

The raw XML of the attribute. In cases where the content of the attribute is complex, this property can be used to do additional XML parsing.

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoAttributeValueCount Property (SAML Component)

In cases where there are multiple values for a single attribute, this count will be updated to reflect the size of the list.

Syntax

__property int AssertionAttributeInfoAttributeValueCount[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoAttributeValueCount };

Default Value

0

Remarks

In cases where there are multiple values for a single attribute, this count will be updated to reflect the size of the list. If the value of the attribute is not a list, the count will be set to 1. See AssertionAttributeValueIndex for more information.

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

Integer

AssertionAttributeInfoAttributeValueData Property (SAML Component)

The content of the attribute value selected by AttributeValueIndex .

Syntax

__property String AssertionAttributeInfoAttributeValueData[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoAttributeValueData };

Default Value

""

Remarks

The content of the attribute value selected by AssertionAttributeValueIndex.

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoAttributeValueIndex Property (SAML Component)

The index of the attribute value that should be populated in the AttributeValueData property.

Syntax

__property int AssertionAttributeInfoAttributeValueIndex[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoAttributeValueIndex, write=FSetAssertionAttributeInfoAttributeValueIndex };

Default Value

0

Remarks

The index of the attribute value that should be populated in the AssertionAttributeValueData property. Valid ranges for this property are from 0 to AssertionAttributeValueCount - 1. By default, this property is set to 0. In cases where there is only a singular value, that value will be at index 0. For example:

Multi-value attribute

<Attribute Name="ValueName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <AttributeValue>Value1</AttributeValue> <AttributeValue>Value2</AttributeValue> </Attribute>

Iterating through each value in an attribute

for (int i = 0; i < saml.AssertionAttributeInfo[0].AttributeValueCount; i++) { saml.AssertionAttributeInfo[0].AttributeValueIndex = i; string attribute_value = saml.AssertionAttributeInfo[0].AttributeValueData; //... the rest of the processing }

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is not available at design time.

Data Type

Integer

AssertionAttributeInfoFriendlyName Property (SAML Component)

A human-readable version of the attribute name, if provided.

Syntax

__property String AssertionAttributeInfoFriendlyName[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoFriendlyName };

Default Value

""

Remarks

A human-readable version of the attribute name, if provided. This value is intended to be used for informational and logging purposes only.

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoName Property (SAML Component)

The name of the attribute.

Syntax

__property String AssertionAttributeInfoName[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoName };

Default Value

""

Remarks

The name of the attribute. The format of the name (if provided) can be found in the AssertionNameFormat property.

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoNameFormat Property (SAML Component)

A URI reference to how the Name of the attribute is formatted.

Syntax

__property String AssertionAttributeInfoNameFormat[int AssertionAttributeInfoIndex] = { read=FAssertionAttributeInfoNameFormat };

Default Value

""

Remarks

A URI reference to how the AssertionName of the attribute is formatted. If not set, Unspecified is used.

Some common values are:

The AssertionAttributeInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoCount Property (SAML Component)

The number of records in the AssertionAuthnInfo arrays.

Syntax

__property int AssertionAuthnInfoCount = { read=FAssertionAuthnInfoCount, write=FSetAssertionAuthnInfoCount };

Default Value

0

Remarks

This property controls the size of the following arrays:

• AssertionAuthnInfoAuthenticatingAuthorites
• AssertionAuthnInfoAuthnInstant
• AssertionAuthnInfoContextClassReference
• AssertionAuthnInfoContextDeclaration
• AssertionAuthnInfoSessionExpiration
• AssertionAuthnInfoSessionIndex
• AssertionAuthnInfoStatementContent

The array indices start at 0 and end at AssertionAuthnInfoCount - 1.

This property is not available at design time.

Data Type

Integer

AssertionAuthnInfoAuthenticatingAuthorites Property (SAML Component)

A semicolon-separated list of authorities involved with the current authentication context.

Syntax

__property String AssertionAuthnInfoAuthenticatingAuthorites[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoAuthenticatingAuthorites };

Default Value

""

Remarks

A semicolon-separated list of authorities involved with the current authentication context. Typically, this list includes other parties involved with the authentication of the subject besides the issuer that issued the assertion.

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoAuthnInstant Property (SAML Component)

The time at which the authentication took place.

Syntax

__property String AssertionAuthnInfoAuthnInstant[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoAuthnInstant };

Default Value

""

Remarks

The time at which the authentication took place.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoContextClassReference Property (SAML Component)

A per-defined URI reference identifying an authentication context class that describes how authentication was provided.

Syntax

__property String AssertionAuthnInfoContextClassReference[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoContextClassReference };

Default Value

""

Remarks

A per-defined URI reference identifying an authentication context class that describes how authentication was provided. For example, if the user used a password to perform authentication, this will be set to urn:oasis:names:tc:SAML:2.0:ac:classes:Password.

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoContextDeclaration Property (SAML Component)

A description or URI that describes additional information about the authentication context past the ContextClassReference .

Syntax

__property String AssertionAuthnInfoContextDeclaration[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoContextDeclaration };

Default Value

""

Remarks

A description or URI that describes additional information about the authentication context past the AssertionContextClassReference. This provides more detail about the authentication process when provided by the Identity Provider.

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoSessionExpiration Property (SAML Component)

The time at which the session between the principal and Identity Provider must be considered ended.

Syntax

__property String AssertionAuthnInfoSessionExpiration[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoSessionExpiration };

Default Value

""

Remarks

The time at which the session between the principal and Identity Provider must be considered ended.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoSessionIndex Property (SAML Component)

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP).

Syntax

__property String AssertionAuthnInfoSessionIndex[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoSessionIndex };

Default Value

""

Remarks

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP). It is common (but not required) to use this value as the session identifier between the user and the Service Provider (your application).

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoStatementContent Property (SAML Component)

The raw XML of the Authn statement.

Syntax

__property String AssertionAuthnInfoStatementContent[int AssertionAuthnInfoIndex] = { read=FAssertionAuthnInfoStatementContent };

Default Value

""

Remarks

The raw XML of the Authn statement. Typically, this is used in cases to get additional information from the Authn statement that is not provided by the component.

The AssertionAuthnInfoIndex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAssertionContent Property (SAML Component)

The raw XML of the assertion.

Syntax

__property String AssertionAssertionContent = { read=FAssertionAssertionContent, write=FSetAssertionAssertionContent };
__property DynamicArray<Byte> AssertionAssertionContentB = { read=FAssertionAssertionContentB, write=FSetAssertionAssertionContentB };

Default Value

""

Remarks

The raw XML of the assertion. This property can be set to provide the assertion to the component for the ParseAssertion method to parse the assertion without the SAML response.

Data Type

Byte Array

AssertionExpirationDate Property (SAML Component)

When the assertion expires.

Syntax

__property String AssertionExpirationDate = { read=FAssertionExpirationDate };

Default Value

""

Remarks

When the assertion expires. This represents the NotOnOrAfter attribute of the Conditions element if the attribute is present in the assertion.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionId Property (SAML Component)

The unique Id of the assertion generated by the identity provider.

Syntax

__property String AssertionId = { read=FAssertionId };

Default Value

""

Remarks

The unique Id of the assertion generated by the identity provider. This is not an Id that is tied to a user but rather to the assertion itself.

This property is read-only.

Data Type

String

AssertionIsSigned Property (SAML Component)

Whether the assertion has been signed by the identity provider.

Syntax

__property bool AssertionIsSigned = { read=FAssertionIsSigned };

Default Value

false

Remarks

Whether the assertion has been signed by the identity provider. This is set to true when the Signature element is present in the assertion.

This property is read-only.

Data Type

Boolean

AssertionIssuedTime Property (SAML Component)

The time at which the assertion was issued by the Issuer (typically the identity provider).

Syntax

__property String AssertionIssuedTime = { read=FAssertionIssuedTime };

Default Value

""

Remarks

The time at which the assertion was issued by the AssertionIssuer (typically the identity provider). This property represents the IssueInstant attribute of the Assertion element.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionIssuer Property (SAML Component)

The issuer of the assertion.

Syntax

__property String AssertionIssuer = { read=FAssertionIssuer };

Default Value

""

Remarks

The issuer of the assertion. Typically, this is the same as the identity provider that provided the SAML response. This property represents the Issuer element in the Assertion element.

This property is read-only.

Data Type

String

AssertionNotBeforeDate Property (SAML Component)

The time at which the assertion becomes valid.

Syntax

__property String AssertionNotBeforeDate = { read=FAssertionNotBeforeDate };

Default Value

""

Remarks

The time at which the assertion becomes valid. If the current time is before this property, then the assertion is not considered valid yet. This represents the NotBefore attribute of the Conditions element if the attribute is present in the assertion.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionOneTimeUse Property (SAML Component)

Whether the issuer only considers this information valid for this single instance.

Syntax

__property bool AssertionOneTimeUse = { read=FAssertionOneTimeUse };

Default Value

false

Remarks

Whether the issuer only considers this information valid for this single instance. The information saved here typically should not be cached or saved for future use. This represents the OneTimeUse element of the Conditions element if the element is present in the assertion.

This property is read-only.

Data Type

Boolean

AssertionSubjectNameId Property (SAML Component)

The name identifier for the subject of the current assertion.

Syntax

__property String AssertionSubjectNameId = { read=FAssertionSubjectNameId };

Default Value

""

Remarks

The name identifier for the subject of the current assertion. Typically, the subject is the user that is being authenticated. The format of this name Id can be found in the AssertionSubjectNameIdFormat property. This represents the NameId element of the Subject element if the element is present in the assertion.

This property is read-only.

Data Type

String

AssertionSubjectNameIdFormat Property (SAML Component)

A URI reference to how the SubjectNameId of the element is formatted.

Syntax

__property String AssertionSubjectNameIdFormat = { read=FAssertionSubjectNameIdFormat };

Default Value

""

Remarks

A URI reference to how the AssertionSubjectNameId of the element is formatted. If not set, Unspecified is used. This represents the Format attribute of the NameID element if the attribute is present in the assertion.

Some common values are:

This property is read-only.

Data Type

String

FirewallAutoDetect Property (SAML Component)

Whether to automatically detect and use firewall system settings, if available.

Syntax

__property bool FirewallAutoDetect = { read=FFirewallAutoDetect, write=FSetFirewallAutoDetect };

Default Value

False

Remarks

Whether to automatically detect and use firewall system settings, if available.

Data Type

Boolean

FirewallType Property (SAML Component)

The type of firewall to connect through.

Syntax

__property TciSAMLFirewallTypes FirewallType = { read=FFirewallType, write=FSetFirewallType };

enum TciSAMLFirewallTypes {
  fwNone=0,
  fwTunnel=1,
  fwSOCKS4=2,
  fwSOCKS5=3,
  fwSOCKS4A=10
};

Default Value

fwNone

Remarks

The type of firewall to connect through. The applicable values are as follows:

Data Type

Integer

FirewallHost Property (SAML Component)

The name or IP address of the firewall (optional).

Syntax

__property String FirewallHost = { read=FFirewallHost, write=FSetFirewallHost };

Default Value

""

Remarks

The name or IP address of the firewall (optional). If a FirewallHost is given, the requested connections will be authenticated through the specified firewall when connecting.

If this property is set to a Domain Name, a DNS request is initiated. Upon successful termination of the request, this property is set to the corresponding address. If the search is not successful, the component raises an exception.

Data Type

String

FirewallPassword Property (SAML Component)

A password if authentication is to be used when connecting through the firewall.

Syntax

__property String FirewallPassword = { read=FFirewallPassword, write=FSetFirewallPassword };

Default Value

""

Remarks

A password if authentication is to be used when connecting through the firewall. If FirewallHost is specified, the FirewallUser and FirewallPassword properties are used to connect and authenticate to the given firewall. If the authentication fails, the component raises an exception.

Data Type

String

FirewallPort Property (SAML Component)

The Transmission Control Protocol (TCP) port for the firewall Host .

Syntax

__property int FirewallPort = { read=FFirewallPort, write=FSetFirewallPort };

Default Value

0

Remarks

The Transmission Control Protocol (TCP) port for the firewall FirewallHost. See the description of the FirewallHost property for details.

Note: This property is set automatically when FirewallType is set to a valid value. See the description of the FirewallType property for details.

Data Type

Integer

FirewallUser Property (SAML Component)

A username if authentication is to be used when connecting through a firewall.

Syntax

__property String FirewallUser = { read=FFirewallUser, write=FSetFirewallUser };

Default Value

""

Remarks

A username if authentication is to be used when connecting through a firewall. If FirewallHost is specified, this property and the FirewallPassword property are used to connect and authenticate to the given Firewall. If the authentication fails, the component raises an exception.

Data Type

String

FollowRedirects Property (SAML Component)

Determines what happens when the server issues a redirect.

Syntax

__property TciSAMLFollowRedirects FollowRedirects = { read=FFollowRedirects, write=FSetFollowRedirects };

enum TciSAMLFollowRedirects {
  frNever=0,
  frAlways=1,
  frSameScheme=2
};

Default Value

frNever

Remarks

This property determines what happens when the server issues a redirect. Normally, the component returns an error if the server responds with an "Object Moved" message. If this property is set to frAlways (1), the new URL for the object is retrieved automatically every time.

If this property is set to frSameScheme (2), the new URL is retrieved automatically only if the URLScheme is the same; otherwise, the component raises an exception.

Note: Following the HTTP specification, unless this property is set to frAlways (1), automatic redirects will be performed only for GET or HEAD requests. Other methods potentially could change the conditions of the initial request and create security vulnerabilities.

Furthermore, if either the new URL server or port are different from the existing one, User and Password are also reset to empty. If, however, this property is set to frAlways (1), the same credentials are used to connect to the new server.

A Redirect event is fired for every URL the product is redirected to. In the case of automatic redirections, the Redirect event is a good place to set properties related to the new connection (e.g., new authentication parameters).

The default value is frNever (0). In this case, redirects are never followed, and the component raises an exception instead.

Data Type

Integer

IdentityProviderEncryptingCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String IdentityProviderEncryptingCertStore = { read=FIdentityProviderEncryptingCertStore, write=FSetIdentityProviderEncryptingCertStore };
__property DynamicArray<Byte> IdentityProviderEncryptingCertStoreB = { read=FIdentityProviderEncryptingCertStoreB, write=FSetIdentityProviderEncryptingCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The IdentityProviderEncryptingCertStoreType property denotes the type of the certificate store specified by IdentityProviderEncryptingCertStore. If the store is password-protected, specify the password in IdentityProviderEncryptingCertStorePassword.

IdentityProviderEncryptingCertStore is used in conjunction with the IdentityProviderEncryptingCertSubject property to specify client certificates. If IdentityProviderEncryptingCertStore has a value, and IdentityProviderEncryptingCertSubject or IdentityProviderEncryptingCertEncoded is set, a search for a certificate is initiated. Please see the IdentityProviderEncryptingCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Byte Array

IdentityProviderEncryptingCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String IdentityProviderEncryptingCertStorePassword = { read=FIdentityProviderEncryptingCertStorePassword, write=FSetIdentityProviderEncryptingCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

IdentityProviderEncryptingCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLIdentityProviderEncryptingCertStoreTypes IdentityProviderEncryptingCertStoreType = { read=FIdentityProviderEncryptingCertStoreType, write=FSetIdentityProviderEncryptingCertStoreType };

enum TciSAMLIdentityProviderEncryptingCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

IdentityProviderEncryptingCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String IdentityProviderEncryptingCertSubject = { read=FIdentityProviderEncryptingCertSubject, write=FSetIdentityProviderEncryptingCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

IdentityProviderEncryptingCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String IdentityProviderEncryptingCertEncoded = { read=FIdentityProviderEncryptingCertEncoded, write=FSetIdentityProviderEncryptingCertEncoded };
__property DynamicArray<Byte> IdentityProviderEncryptingCertEncodedB = { read=FIdentityProviderEncryptingCertEncodedB, write=FSetIdentityProviderEncryptingCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The IdentityProviderEncryptingCertStore and IdentityProviderEncryptingCertSubject properties also may be used to specify a certificate.

When IdentityProviderEncryptingCertEncoded is set, a search is initiated in the current IdentityProviderEncryptingCertStore for the private key of the certificate. If the key is found, IdentityProviderEncryptingCertSubject is updated to reflect the full subject of the selected certificate; otherwise, IdentityProviderEncryptingCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Byte Array

IdentityProviderMetadataEntityId Property (SAML Component)

The unique Id for the identity provider that is being described.

Syntax

__property String IdentityProviderMetadataEntityId = { read=FIdentityProviderMetadataEntityId, write=FSetIdentityProviderMetadataEntityId };

Default Value

""

Remarks

The unique Id for the identity provider that is being described. This is used for verification purposes when verifying the issuer of an SAML response or assertion.

Data Type

String

IdentityProviderMetadataExpirationDate Property (SAML Component)

The expiration date of the Identity Provider description provided by the metadata document.

Syntax

__property String IdentityProviderMetadataExpirationDate = { read=FIdentityProviderMetadataExpirationDate };

Default Value

""

Remarks

The expiration date of the Identity Provider description provided by the metadata document. This represents the valid attribute of the IDPSSODescriptor element if the attribute is present in the document.

This property is read-only.

Data Type

String

IdentityProviderMetadataMetadataContent Property (SAML Component)

The raw metadata for the identity provider.

Syntax

__property String IdentityProviderMetadataMetadataContent = { read=FIdentityProviderMetadataMetadataContent, write=FSetIdentityProviderMetadataMetadataContent };
__property DynamicArray<Byte> IdentityProviderMetadataMetadataContentB = { read=FIdentityProviderMetadataMetadataContentB, write=FSetIdentityProviderMetadataMetadataContentB };

Default Value

""

Remarks

The raw metadata for the identity provider. To avoid repeated requests to the Identity Provider, this value can be saved for later to be used with the LoadIdentityMetadata method.

Data Type

Byte Array

IdentityProviderMetadataRequestsSignedAuthnRequests Property (SAML Component)

Whether the identity provider requests that authentication (Authn) requests are signed.

Syntax

__property bool IdentityProviderMetadataRequestsSignedAuthnRequests = { read=FIdentityProviderMetadataRequestsSignedAuthnRequests, write=FSetIdentityProviderMetadataRequestsSignedAuthnRequests };

Default Value

false

Remarks

Whether the identity provider requests that authentication (Authn) requests are signed.

Data Type

Boolean

IdentityProviderMetadataSignedMetadata Property (SAML Component)

Whether the identity provider's parsed metadata is signed.

Syntax

__property bool IdentityProviderMetadataSignedMetadata = { read=FIdentityProviderMetadataSignedMetadata };

Default Value

false

Remarks

Whether the identity provider's parsed metadata is signed.

This property is read-only.

Data Type

Boolean

IdentityProviderMetadataSupportedAttributeProfiles Property (SAML Component)

A semicolon-separated list of attribute profiles supported by the identity provider.

Syntax

__property String IdentityProviderMetadataSupportedAttributeProfiles = { read=FIdentityProviderMetadataSupportedAttributeProfiles };

Default Value

""

Remarks

A semicolon-separated list of attribute profiles supported by the identity provider.

Some common attribute profiles are:

• urn:oasis:names:tc:SAML:2.0:profiles:attribute:basic
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:UUID
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML

This property is read-only.

Data Type

String

IdentityProviderMetadataSupportedAttributes Property (SAML Component)

A semicolon-separated list of attributes supported by the identity provider as presented by the Identity Provider's metadata document.

Syntax

__property String IdentityProviderMetadataSupportedAttributes = { read=FIdentityProviderMetadataSupportedAttributes };

Default Value

""

Remarks

A semicolon-separated list of attributes supported by the identity provider as presented by the Identity Provider's metadata document. This is a list of attributes that are explicitly supported by the Identity Provider but is not a full list of all the supported attributes. The list will contain the Name of each attribute found in the IDPSSODescriptor element.

This property is read-only.

Data Type

String

IdentityProviderMetadataSupportedNameIdFormats Property (SAML Component)

The name identifier formats supported by the identity provider if provided by the metadata document.

Syntax

__property String IdentityProviderMetadataSupportedNameIdFormats = { read=FIdentityProviderMetadataSupportedNameIdFormats };

Default Value

""

Remarks

The name identifier formats supported by the identity provider if provided by the metadata document. Some common values are:

• Unspecified - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
• Email Address - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• Windows Domain Qualified Name - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName

This property is read-only.

Data Type

String

IdentityProviderSigningCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String IdentityProviderSigningCertStore = { read=FIdentityProviderSigningCertStore, write=FSetIdentityProviderSigningCertStore };
__property DynamicArray<Byte> IdentityProviderSigningCertStoreB = { read=FIdentityProviderSigningCertStoreB, write=FSetIdentityProviderSigningCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The IdentityProviderSigningCertStoreType property denotes the type of the certificate store specified by IdentityProviderSigningCertStore. If the store is password-protected, specify the password in IdentityProviderSigningCertStorePassword.

IdentityProviderSigningCertStore is used in conjunction with the IdentityProviderSigningCertSubject property to specify client certificates. If IdentityProviderSigningCertStore has a value, and IdentityProviderSigningCertSubject or IdentityProviderSigningCertEncoded is set, a search for a certificate is initiated. Please see the IdentityProviderSigningCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Byte Array

IdentityProviderSigningCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String IdentityProviderSigningCertStorePassword = { read=FIdentityProviderSigningCertStorePassword, write=FSetIdentityProviderSigningCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

IdentityProviderSigningCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLIdentityProviderSigningCertStoreTypes IdentityProviderSigningCertStoreType = { read=FIdentityProviderSigningCertStoreType, write=FSetIdentityProviderSigningCertStoreType };

enum TciSAMLIdentityProviderSigningCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

IdentityProviderSigningCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String IdentityProviderSigningCertSubject = { read=FIdentityProviderSigningCertSubject, write=FSetIdentityProviderSigningCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

IdentityProviderSigningCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String IdentityProviderSigningCertEncoded = { read=FIdentityProviderSigningCertEncoded, write=FSetIdentityProviderSigningCertEncoded };
__property DynamicArray<Byte> IdentityProviderSigningCertEncodedB = { read=FIdentityProviderSigningCertEncodedB, write=FSetIdentityProviderSigningCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The IdentityProviderSigningCertStore and IdentityProviderSigningCertSubject properties also may be used to specify a certificate.

When IdentityProviderSigningCertEncoded is set, a search is initiated in the current IdentityProviderSigningCertStore for the private key of the certificate. If the key is found, IdentityProviderSigningCertSubject is updated to reflect the full subject of the selected certificate; otherwise, IdentityProviderSigningCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Byte Array

IdentityProviderURICount Property (SAML Component)

The number of records in the IdentityProviderURI arrays.

Syntax

__property int IdentityProviderURICount = { read=FIdentityProviderURICount, write=FSetIdentityProviderURICount };

Default Value

0

Remarks

This property controls the size of the following arrays:

• IdentityProviderURIBindingRef
• IdentityProviderURIBindingType
• IdentityProviderURIIndex
• IdentityProviderURIIsDefault
• IdentityProviderURILocation
• IdentityProviderURIType

The array indices start at 0 and end at IdentityProviderURICount - 1.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIBindingRef Property (SAML Component)

The URI reference for the set BindingType .

Syntax

__property String IdentityProviderURIBindingRef[int IdentityProviderURIIdx] = { read=FIdentityProviderURIBindingRef, write=FSetIdentityProviderURIBindingRef };

Default Value

""

Remarks

The URI reference for the set IdentityProviderURIBindingType. When the IdentityProviderURIBindingType is set, this property will be updated to match. The exception is the subCustom value, which allows for any value to be placed in this property.

If this property is set instead, the component will attempt to set the IdentityProviderURIBindingType property to match. If it can't, subCustom will also be used.

When parsing a metadata document, the component will also use the subCustom value for any binding types that are not recognized by the component.

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

String

IdentityProviderURIBindingType Property (SAML Component)

The type of binding that is supported for this URI.

Syntax

__property TciSAMLIdentityProviderURIBindingTypes IdentityProviderURIBindingType[int IdentityProviderURIIdx] = { read=FIdentityProviderURIBindingType, write=FSetIdentityProviderURIBindingType };

enum TciSAMLIdentityProviderURIBindingTypes {
  subRedirect=0,
  subPost=1,
  subArtifact=2,
  subCustom=3
};

Default Value

subRedirect

Remarks

The type of binding that is supported for this URI. The component only supports using the HTTP Redirect and HTTP POST bindings. The HTTP Artifact and other bindings are informational, and support for them must be implemented directly.

When setting this property, the IdentityProviderURIBindingRef property will also be updated with the matching URI. The exception is the subCustom value, which allows for any value to be placed in the IdentityProviderURIBindingRef property.

If the IdentityProviderURIBindingRef property is set, during the processing of a metadata document the component will attempt to set this property as well with the matching value. If it can't, subCustom will be used instead.

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIIsDefault Property (SAML Component)

Whether this URI is the default URI that should be used for the specific URIType and BindingType combination.

Syntax

__property bool IdentityProviderURIIsDefault[int IdentityProviderURIIdx] = { read=FIdentityProviderURIIsDefault, write=FSetIdentityProviderURIIsDefault };

Default Value

false

Remarks

Whether this URI is the default URI that should be used for the specific IdentityProviderURIURIType and IdentityProviderURIBindingType combination.

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Boolean

IdentityProviderURILocation Property (SAML Component)

The address of the URI.

Syntax

__property String IdentityProviderURILocation[int IdentityProviderURIIdx] = { read=FIdentityProviderURILocation, write=FSetIdentityProviderURILocation };

Default Value

""

Remarks

The address of the URI.

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

String

IdentityProviderURIIndex Property (SAML Component)

The index for the URI that can be optionally used if multiple URIs of the same URIType and BindingType are provided.

Syntax

__property int IdentityProviderURIIndex[int IdentityProviderURIIdx] = { read=FIdentityProviderURIIndex, write=FSetIdentityProviderURIIndex };

Default Value

0

Remarks

The index for the URI that can be optionally used if multiple URIs of the same IdentityProviderURIURIType and IdentityProviderURIBindingType are provided.

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIType Property (SAML Component)

The purpose of the URI.

Syntax

__property TciSAMLIdentityProviderURITypes IdentityProviderURIType[int IdentityProviderURIIdx] = { read=FIdentityProviderURIType, write=FSetIdentityProviderURIType };

enum TciSAMLIdentityProviderURITypes {
  sutSignon=0,
  sutLogout=1,
  sutACS=2
};

Default Value

sutSignon

Remarks

The purpose of the URI.

Possible values are:

The IdentityProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

LogoutRequestBody Property (SAML Component)

The HTTP body for a SAML logout request.

Syntax

__property String LogoutRequestBody = { read=FLogoutRequestBody, write=FSetLogoutRequestBody };
__property DynamicArray<Byte> LogoutRequestBodyB = { read=FLogoutRequestBodyB, write=FSetLogoutRequestBodyB };

Default Value

""

Remarks

This property can be set before calling the ParseLogoutRequest or ProcessLogoutRequest methods to directly provide the HTTP body of a logout request that should be parsed or processed. If using the HTTP context, this property is populated with the HTTP body containing the logout request that was parsed from the HTTP context after calling ParseLogoutRequest or ProcessLogoutRequest.

Data Type

Byte Array

LogoutRequestHeaders Property (SAML Component)

The HTTP headers for a SAML logout request.

Syntax

__property String LogoutRequestHeaders = { read=FLogoutRequestHeaders, write=FSetLogoutRequestHeaders };

Default Value

""

Remarks

This property can be set before calling the ParseLogoutRequest or ProcessLogoutRequest methods to directly provide the HTTP headers that contain a logout request from the Identity Provider. If using the HTTP context, this property is populated with the HTTP headers that were parsed from the HTTP context after calling ParseLogoutRequest or ProcessLogoutRequest.

Data Type

String

LogoutRequestConsent Property (SAML Component)

Whether consent from a principal was provided when this logout request was sent.

Syntax

__property String LogoutRequestConsent = { read=FLogoutRequestConsent };

Default Value

""

Remarks

Whether consent from a principal was provided when this logout request was sent. This typically is set to some URI reference that matches the method used by the Identity Provider to obtain consent from the principal (user).

Some common URI values are:

• Unspecified - urn:oasis:names:tc:SAML:2.0:consent:unspecified
• Obtained - urn:oasis:names:tc:SAML:2.0:consent:obtained
• Prior - urn:oasis:names:tc:SAML:2.0:consent:prior
• Implicit - urn:oasis:names:tc:SAML:2.0:consent:current-implicit
• Explicit - urn:oasis:names:tc:SAML:2.0:consent:current-explicit
• Unavailable - urn:oasis:names:tc:SAML:2.0:consent:unavailable
• Inapplicable - urn:oasis:names:tc:SAML:2.0:consent:inapplicable

This property is read-only.

Data Type

String

LogoutRequestDestination Property (SAML Component)

A URI reference for the intended destination for this logout request.

Syntax

__property String LogoutRequestDestination = { read=FLogoutRequestDestination };

Default Value

""

Remarks

A URI reference for the intended destination for this logout request. This is useful to prevent malicious forwarding of requests to unintended recipients.

This property is read-only.

Data Type

String

LogoutRequestExpirationDate Property (SAML Component)

When this logout request expires.

Syntax

__property String LogoutRequestExpirationDate = { read=FLogoutRequestExpirationDate };

Default Value

""

Remarks

When this logout request expires. This represents the NotOnOrAfter element in the LogoutRequest element if present in the request.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

LogoutRequestId Property (SAML Component)

The unique Id for the logout request that was created by the Issuer .

Syntax

__property String LogoutRequestId = { read=FLogoutRequestId };

Default Value

""

Remarks

The unique Id for the logout request that was created by the LogoutRequestIssuer.

This property is read-only.

Data Type

String

LogoutRequestIssuedTime Property (SAML Component)

The time at which the SAML response was issued by the Issuer .

Syntax

__property String LogoutRequestIssuedTime = { read=FLogoutRequestIssuedTime };

Default Value

""

Remarks

The time at which the SAML response was issued by the LogoutRequestIssuer.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

LogoutRequestIssuer Property (SAML Component)

The Entity Id of the issuer of the logout request.

Syntax

__property String LogoutRequestIssuer = { read=FLogoutRequestIssuer };

Default Value

""

Remarks

The Entity Id of the issuer of the logout request. Typically, this will be the LogoutRequestEntityId of the Identity Provider.

This property is read-only.

Data Type

String

LogoutRequestNameId Property (SAML Component)

The name identifier for the subject of the logout request.

Syntax

__property String LogoutRequestNameId = { read=FLogoutRequestNameId };

Default Value

""

Remarks

The name identifier for the subject of the logout request. This identifies the user that should be logged out of this application. The format of this identifier can be found in the LogoutRequestNameIdFormat property. This represents the NameId element of the LogoutRequest element.

This property is read-only.

Data Type

String

LogoutRequestNameIdFormat Property (SAML Component)

A URI reference to how the NameId of the element is formatted.

Syntax

__property String LogoutRequestNameIdFormat = { read=FLogoutRequestNameIdFormat };

Default Value

""

Remarks

A URI reference to how the LogoutRequestNameId of the element is formatted. If not set, Unspecified is used. This represents the Format attribute of the NameID element if the attribute is present in the logout request.

Some common values are:

This property is read-only.

Data Type

String

LogoutRequestReason Property (SAML Component)

The reason the Identity Provider sent the the logout request.

Syntax

__property String LogoutRequestReason = { read=FLogoutRequestReason };

Default Value

""

Remarks

The reason the Identity Provider sent the the logout request. This represents the optional Reason element of the LogoutRequest element.

Some common values are:

This property is read-only.

Data Type

String

LogoutRequestRequestContent Property (SAML Component)

The full XML of the SAML logout request after being parsed or processed by the component after calling ParseLogoutRequest or ProcessLogoutRequest .

Syntax

__property String LogoutRequestRequestContent = { read=FLogoutRequestRequestContent, write=FSetLogoutRequestRequestContent };
__property DynamicArray<Byte> LogoutRequestRequestContentB = { read=FLogoutRequestRequestContentB, write=FSetLogoutRequestRequestContentB };

Default Value

""

Remarks

The full XML of the SAML logout request after being parsed or processed by the component after calling ParseLogoutRequest or ProcessLogoutRequest. Optionally, this setting can be set to provide a logout request directly to the component to be used with the ParseLogoutRequest or ProcessLogoutRequest methods.

Data Type

Byte Array

LogoutRequestSessionIndex Property (SAML Component)

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP).

Syntax

__property String LogoutRequestSessionIndex = { read=FLogoutRequestSessionIndex };

Default Value

""

Remarks

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP). This index specifies the session that is being ended between the Identity Provider and your application.

This property is read-only.

Data Type

String

LogoutRequestSigned Property (SAML Component)

Whether the SAML logout request is signed.

Syntax

__property bool LogoutRequestSigned = { read=FLogoutRequestSigned };

Default Value

false

Remarks

Whether the SAML logout request is signed. If the logout request contains no signatures, this property will be set to false.

This property is read-only.

Data Type

Boolean

LogoutResponseBody Property (SAML Component)

The HTTP body for a built logout response.

Syntax

__property String LogoutResponseBody = { read=FLogoutResponseBody };
__property DynamicArray<Byte> LogoutResponseBodyB = { read=FLogoutResponseBodyB };

Default Value

""

Remarks

This property contains the generated HTTP body for the response that should be provided to the LogoutResponseURL if required by the selected binding. It is generated alongside the LogoutResponseURL property when calling BuildLogoutResponse.

This property is read-only.

Data Type

Byte Array

LogoutResponseConsent Property (SAML Component)

Whether consent from a principal (the user) was provided before building this response.

Syntax

__property TciSAMLLogoutResponseConsents LogoutResponseConsent = { read=FLogoutResponseConsent, write=FSetLogoutResponseConsent };

enum TciSAMLLogoutResponseConsents {
  scidUnspecified=0,
  scidObtained=1,
  scidPrior=2,
  scidImplicit=3,
  scidExplicit=4,
  scidUnavailable=5,
  scidInapplicable=6,
  scidCustom=7
};

Default Value

scidUnspecified

Remarks

Whether consent from a principal (the user) was provided before building this response. This typically is set to some URI reference of the method that was used by the application to obtain consent from the principal. This setting specifically sets the Consent attribute in the LogoutResponse element in the logout response.

By default, the scidUnspecified value is used. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomConsent configuration setting will be used instead.

Data Type

Integer

LogoutResponseDestination Property (SAML Component)

A URI reference for the intended destination for the logout response.

Syntax

__property String LogoutResponseDestination = { read=FLogoutResponseDestination, write=FSetLogoutResponseDestination };

Default Value

""

Remarks

A URI reference for the intended destination for the logout response. This is useful to prevent malicious forwarding of responses to unintended recipients. If left blank and there is a URI with the LogoutResponseURIType sutLogout for the Identity Provider, then the component will use that as the destination.

Data Type

String

LogoutResponseId Property (SAML Component)

A unique Id of the SAML logout response.

Syntax

__property String LogoutResponseId = { read=FLogoutResponseId, write=FSetLogoutResponseId };

Default Value

""

Remarks

A unique Id of the SAML logout response.

When building a logout response using the BuildLogoutResponse method, the component will use this value for the Id attribute in the response. If left empty before building the response, the component will generate a new one.

Data Type

String

LogoutResponseInResponseTo Property (SAML Component)

The Id of the SAML logout request that is being responded to.

Syntax

__property String LogoutResponseInResponseTo = { read=FLogoutResponseInResponseTo, write=FSetLogoutResponseInResponseTo };

Default Value

""

Remarks

The Id of the SAML logout request that is being responded to.

For an Identity Provider to validate the SAML response, the InResponseTo attribute needs to be set to the Id of the logout request that is being responded to. If left blank, the component will check the Id found in the LogoutResponseId property that is set after calling ParseLogoutRequest or ProcessLogoutRequest. If building a request that is not parsed by the component, this property will need to be set.

Data Type

String

LogoutResponseIssuedTime Property (SAML Component)

The time at which the logout response will be issued.

Syntax

__property String LogoutResponseIssuedTime = { read=FLogoutResponseIssuedTime, write=FSetLogoutResponseIssuedTime };

Default Value

""

Remarks

The time at which the logout response will be issued. If not set, the component will use the current time.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

Data Type

String

LogoutResponseIssuer Property (SAML Component)

The issuer for the logout request.

Syntax

__property String LogoutResponseIssuer = { read=FLogoutResponseIssuer, write=FSetLogoutResponseIssuer };

Default Value

""

Remarks

The issuer for the logout request. Typically, this should be set to the Service Provider's Entity Id that was configured with the Identity Provider for this application.

Data Type

String

LogoutResponseResponseBinding Property (SAML Component)

The binding that will be used to send the response.

Syntax

__property TciSAMLLogoutResponseResponseBindings LogoutResponseResponseBinding = { read=FLogoutResponseResponseBinding, write=FSetLogoutResponseResponseBinding };

enum TciSAMLLogoutResponseResponseBindings {
  srbHTTPRedirect=0,
  srbHTTPPost=1
};

Default Value

srbHTTPRedirect

Remarks

The binding that will be used to send the response.

By default, the component will use the srbHTTPRedirect binding which provides the SAMLResponse value through a query parameter. The srbHTTPRedirect binding will set just the LogoutResponseURL property.

If set to the srbHTTPPost binding, the SAMLResponse value is provided in an HTML body that should be used to make a form post request. This will set both the LogoutResponseURL and LogoutResponseBody properties.

Data Type

Integer

LogoutResponseSignResponse Property (SAML Component)

Whether the logout response should be signed when using the BuildLogoutResponse method.

Syntax

__property bool LogoutResponseSignResponse = { read=FLogoutResponseSignResponse, write=FSetLogoutResponseSignResponse };

Default Value

false

Remarks

Whether the logout response should be signed when using the BuildLogoutResponse method. The component will use the certificate set in the ServiceProviderSigningCert property to sign the response.

Data Type

Boolean

LogoutResponseStatusCodes Property (SAML Component)

A semicolon-separated list of status codes that should be added in the SAML response.

Syntax

__property String LogoutResponseStatusCodes = { read=FLogoutResponseStatusCodes, write=FSetLogoutResponseStatusCodes };

Default Value

""

Remarks

A semicolon-separated list of status codes that should be added in the SAML response. A compliant SAML response will always contain a top-level response with one of the following values.

After the top-level status code, second-level codes can also be included to provide additional information about the top-level status code. These second-level codes are also typically a URI reference like the top-level codes. For example, if the application was unable to find a currently authenticated user that matches the logout request's LogoutResponseNameId, this setting could be set to:

urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal

Sometimes, a message is also provided with the status. See LogoutResponseStatusMessage for more information.

Data Type

String

LogoutResponseStatusMessage Property (SAML Component)

The message that should be provided in the status of the logout response.

Syntax

__property String LogoutResponseStatusMessage = { read=FLogoutResponseStatusMessage, write=FSetLogoutResponseStatusMessage };

Default Value

""

Remarks

The message that should be provided in the status of the logout response. This property needs to be set alongside LogoutResponseStatusCodes and can be used to provide more information about the status.

Data Type

String

LogoutResponseURL Property (SAML Component)

The URL for SAML logout responses.

Syntax

__property String LogoutResponseURL = { read=FLogoutResponseURL };

Default Value

""

Remarks

This property contains the generated URL to an identity provider for a logoff service. Depending on the binding used, the URL may contain the SAMLResponse parameter, or the LogoutResponseBody property will be populated to be sent along with the response. It is generated using the BuildLogoutResponse method.

This property is read-only.

Data Type

String

ProxyAuthScheme Property (SAML Component)

The type of authorization to perform when connecting to the proxy.

Syntax

__property TciSAMLProxyAuthSchemes ProxyAuthScheme = { read=FProxyAuthScheme, write=FSetProxyAuthScheme };

enum TciSAMLProxyAuthSchemes {
  authBasic=0,
  authDigest=1,
  authProprietary=2,
  authNone=3,
  authNtlm=4,
  authNegotiate=5
};

Default Value

authBasic

Remarks

The type of authorization to perform when connecting to the proxy. This is used only when the ProxyUser and ProxyPassword properties are set.

ProxyAuthScheme should be set to authNone (3) when no authentication is expected.

By default, ProxyAuthScheme is authBasic (0), and if the ProxyUser and ProxyPassword properties are set, the component will attempt basic authentication.

If ProxyAuthScheme is set to authDigest (1), digest authentication will be attempted instead.

If ProxyAuthScheme is set to authProprietary (2), then the authorization token will not be generated by the component. Look at the configuration file for the component being used to find more information about manually setting this token.

If ProxyAuthScheme is set to authNtlm (4), NTLM authentication will be used.

For security reasons, setting this property will clear the values of ProxyUser and ProxyPassword.

Data Type

Integer

ProxyAutoDetect Property (SAML Component)

Whether to automatically detect and use proxy system settings, if available.

Syntax

__property bool ProxyAutoDetect = { read=FProxyAutoDetect, write=FSetProxyAutoDetect };

Default Value

False

Remarks

Whether to automatically detect and use proxy system settings, if available. The default value is false.

Data Type

Boolean

ProxyPassword Property (SAML Component)

A password if authentication is to be used for the proxy.

Syntax

__property String ProxyPassword = { read=FProxyPassword, write=FSetProxyPassword };

Default Value

""

Remarks

A password if authentication is to be used for the proxy.

If ProxyAuthScheme is set to Basic Authentication, the ProxyUser and ProxyPassword properties are Base64 encoded and the proxy authentication token will be generated in the form Basic [encoded-user-password].

If ProxyAuthScheme is set to Digest Authentication, the ProxyUser and ProxyPassword properties are used to respond to the Digest Authentication challenge from the server.

If ProxyAuthScheme is set to NTLM Authentication, the ProxyUser and ProxyPassword properties are used to authenticate through NTLM negotiation.

Data Type

String

ProxyPort Property (SAML Component)

The Transmission Control Protocol (TCP) port for the proxy Server (default 80).

Syntax

__property int ProxyPort = { read=FProxyPort, write=FSetProxyPort };

Default Value

80

Remarks

The Transmission Control Protocol (TCP) port for the proxy ProxyServer (default 80). See the description of the ProxyServer property for details.

Data Type

Integer

ProxyServer Property (SAML Component)

If a proxy Server is given, then the HTTP request is sent to the proxy instead of the server otherwise specified.

Syntax

__property String ProxyServer = { read=FProxyServer, write=FSetProxyServer };

Default Value

""

Remarks

If a proxy ProxyServer is given, then the HTTP request is sent to the proxy instead of the server otherwise specified.

If the ProxyServer property is set to a domain name, a DNS request is initiated. Upon successful termination of the request, the ProxyServer property is set to the corresponding address. If the search is not successful, an error is returned.

Data Type

String

ProxySSL Property (SAML Component)

When to use a Secure Sockets Layer (SSL) for the connection to the proxy.

Syntax

__property TciSAMLProxySSLs ProxySSL = { read=FProxySSL, write=FSetProxySSL };

enum TciSAMLProxySSLs {
  psAutomatic=0,
  psAlways=1,
  psNever=2,
  psTunnel=3
};

Default Value

psAutomatic

Remarks

When to use a Secure Sockets Layer (SSL) for the connection to the proxy. The applicable values are as follows:

Data Type

Integer

ProxyUser Property (SAML Component)

A username if authentication is to be used for the proxy.

Syntax

__property String ProxyUser = { read=FProxyUser, write=FSetProxyUser };

Default Value

""

Remarks

A username if authentication is to be used for the proxy.

If ProxyAuthScheme is set to Basic Authentication, the ProxyUser and ProxyPassword properties are Base64 encoded and the proxy authentication token will be generated in the form Basic [encoded-user-password].

If ProxyAuthScheme is set to Digest Authentication, the ProxyUser and ProxyPassword properties are used to respond to the Digest Authentication challenge from the server.

If ProxyAuthScheme is set to NTLM Authentication, the ProxyUser and ProxyPassword properties are used to authenticate through NTLM negotiation.

Data Type

String

RelayState Property (SAML Component)

The RelayState for a SAML request or response.

Syntax

__property String RelayState = { read=FRelayState, write=FSetRelayState };

Default Value

""

Remarks

When set before building a request using the BuildAuthnRequest and BuildLogoutRequest methods, this property will set the RelayState parameter that is provided with the SAML request. Any value may be specified here and it will be returned exactly as it was sent. This can be used to maintain state within the application, and also may be used for security purposes. The contents of this property are treated as an opaque value.

After calling ProcessSAMLResponse or ParseSAMLResponse on an HTTP request that contains a response from the Identity Provider, this setting will also be set to match the RelayState parameter if it was provided by the Identity Provider. This does not work if the SAML response was provided directly to the methods using the SAMLResponseInfo property.

Data Type

String

SAMLRequestBody Property (SAML Component)

The HTTP body for a SAML request.

Syntax

__property String SAMLRequestBody = { read=FSAMLRequestBody };
__property DynamicArray<Byte> SAMLRequestBodyB = { read=FSAMLRequestBodyB };

Default Value

""

Remarks

This property contains the generated HTTP body for the request that should be provided to the SAMLRequestURL if required by the selected binding. It is generated alongside the SAMLRequestURL property when calling BuildAuthnRequest or BuildLogoutRequest.

This property is read-only.

Data Type

Byte Array

SAMLRequestAllowCreate Property (SAML Component)

This setting is only used for authentication requests.

Syntax

__property bool SAMLRequestAllowCreate = { read=FSAMLRequestAllowCreate, write=FSetSAMLRequestAllowCreate };

Default Value

false

Remarks

This setting is only used for authentication requests. It controls whether the component will set the AllowCreate attribute in the NameIDPolicy element that is specific to the AuthnRequest element. When set to true, this will inform the Identity Provider that it is allowed to create a new identifier to represent the principal. When set to false (default), the Identity Provider should only issue an assertion if an acceptable identifier is already created.

Data Type

Boolean

SAMLRequestConsent Property (SAML Component)

This setting specifies whether consent from a principal was provided when this request was sent.

Syntax

__property TciSAMLSAMLRequestConsents SAMLRequestConsent = { read=FSAMLRequestConsent, write=FSetSAMLRequestConsent };

enum TciSAMLSAMLRequestConsents {
  scidUnspecified=0,
  scidObtained=1,
  scidPrior=2,
  scidImplicit=3,
  scidExplicit=4,
  scidUnavailable=5,
  scidInapplicable=6,
  scidCustom=7
};

Default Value

scidUnspecified

Remarks

This setting specifies whether consent from a principal was provided when this request was sent. This typically is set to some URI reference that was used by the application to obtain consent from the principal (user). This setting specifically sets the Consent attribute in the AuthnRequest or LogoutRequest elements in a SAML request.

By default, the scidUnspecified value is used. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomConsent configuration setting will be used instead.

Data Type

Integer

SAMLRequestDestination Property (SAML Component)

This setting specifies a URI reference for the intended destination for the SAML request.

Syntax

__property String SAMLRequestDestination = { read=FSAMLRequestDestination, write=FSetSAMLRequestDestination };

Default Value

""

Remarks

This setting specifies a URI reference for the intended destination for the SAML request. This is useful to prevent malicious forwarding of responses to unintended recipients. If left blank the component will set this to match the endpoint selected by the component. See SAMLRequestUseDefaultEndpoint and SAMLRequestSelectedEndpoint for more information.

Data Type

String

SAMLRequestId Property (SAML Component)

This setting specifies the unique Id of the SAML request.

Syntax

__property String SAMLRequestId = { read=FSAMLRequestId, write=FSetSAMLRequestId };

Default Value

""

Remarks

This setting specifies the unique Id of the SAML request.

When building a SAML request using the BuildAuthnRequest or BuildLogoutRequest methods, the component will use this value for the Id attribute in the request. If left empty before building the request, the component will generate a new one.

When validating a SAML response or assertion, this property is used to provide the Id of the request to the component. The SAML response and assertion both have an InResponseTo attribute that needs to match this property. See SAMLRequestInResponseTo for more information. This is important, to check to ensure that the SAML response or assertion was in response to a request that was made by this application.

Due to needing the value for validation purposes this setting, (along with the SAMLRequestIssuer property) should be cached in a secure location for later. This Id should match the Id of the InResponseTo attribute of the matching SAMLResponse . Due to this, after BuildAuthnRequest or BuildLogoutRequest is used to create a request, this setting

Data Type

String

SAMLRequestIssuedTime Property (SAML Component)

This setting sets the time at which the SAML request was issued.

Syntax

__property String SAMLRequestIssuedTime = { read=FSAMLRequestIssuedTime, write=FSetSAMLRequestIssuedTime };

Default Value

""

Remarks

This setting sets the time at which the SAML request was issued. If not set, the component will use the current time.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

Data Type

String

SAMLRequestIssuer Property (SAML Component)

The issuer for the SAML request.

Syntax

__property String SAMLRequestIssuer = { read=FSAMLRequestIssuer, write=FSetSAMLRequestIssuer };

Default Value

""

Remarks

The issuer for the SAML request. Typically, this should be set to the Entity Id configured for the Identity Provider.

Data Type

String

SAMLRequestNameIdFormat Property (SAML Component)

This setting is only used for authentication requests.

Syntax

__property TciSAMLSAMLRequestNameIdFormats SAMLRequestNameIdFormat = { read=FSAMLRequestNameIdFormat, write=FSetSAMLRequestNameIdFormat };

enum TciSAMLSAMLRequestNameIdFormats {
  snidUnspecified=0,
  snidEmail=1,
  snidX509=2,
  snidWindowsDQ=3,
  snidKerberos=4,
  snidEntity=5,
  snidPersistent=6,
  snidTransitent=7,
  snidCustom=8
};

Default Value

snidUnspecified

Remarks

This setting is only used for authentication requests. If supported by the Identity Provider, this setting can be used to tailor the name identifier for the subject in the response to an authentication request.

By default, the snidUnspecified format will be used, which informs the Identity Provider to use whatever name identifier format they prefer. This setting specifically sets the Format attribute in the NameIDPolicy element in an authentication request. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomNameIdFormat configuration setting will be used instead.

Data Type

Integer

SAMLRequestRequestBinding Property (SAML Component)

This setting controls the binding that will be used to make the request.

Syntax

__property TciSAMLSAMLRequestRequestBindings SAMLRequestRequestBinding = { read=FSAMLRequestRequestBinding, write=FSetSAMLRequestRequestBinding };

enum TciSAMLSAMLRequestRequestBindings {
  srbHTTPRedirect=0,
  srbHTTPPost=1
};

Default Value

srbHTTPRedirect

Remarks

This setting controls the binding that will be used to make the request.

By default, the component will use the srbHTTPRedirect binding which provides the SAMLRequest value through a query parameter. The srbHTTPRedirect binding will set just the SAMLRequestURL property.

If set to the srbHTTPPost binding, the SAMLRequest value is provided in an HTML body that should be used to make a form post request. This will set both the SAMLRequestURL and SAMLRequestBody properties.

Note: This setting does not control the binding of the response, just how the request will be made.

Data Type

Integer

SAMLRequestSelectedEndpoint Property (SAML Component)

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider.

Syntax

__property int SAMLRequestSelectedEndpoint = { read=FSAMLRequestSelectedEndpoint, write=FSetSAMLRequestSelectedEndpoint };

Default Value

-1

Remarks

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider. When building an Authn Request, the component will select the the ACS endpoint depending on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set to true, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, the component will use that index in the request. Otherwise, the component will select the first URI available in the ServiceProviderURIs properties.

Data Type

Integer

SAMLRequestSessionIndex Property (SAML Component)

This setting only applies when building SAML logout requests.

Syntax

__property String SAMLRequestSessionIndex = { read=FSAMLRequestSessionIndex, write=FSetSAMLRequestSessionIndex };

Default Value

""

Remarks

This setting only applies when building SAML logout requests. SAMLRequestSessionIndex identifies the current session of the user that is being ended when the BuildLogoutRequest method is called. When the ProcessSAMLResponse or ParseAssertion methods are called, the SAMLRequestSessionIndex property will be set to the session index from the Identity Provider. Providing the session index with the logout request will typically cause the Identity Provider to send logout requests to all participating services that are also part of the session.

Data Type

String

SAMLRequestSignRequest Property (SAML Component)

This setting controls whether the SAML request should be signed when using the BuildAuthnRequest or BuildLogoutRequest methods.

Syntax

__property bool SAMLRequestSignRequest = { read=FSAMLRequestSignRequest, write=FSetSAMLRequestSignRequest };

Default Value

false

Remarks

This setting controls whether the SAML request should be signed when using the BuildAuthnRequest or BuildLogoutRequest methods. The component will use the certificate set in the ServiceProviderSigningCert property to sign the request.

Data Type

Boolean

SAMLRequestUseDefaultEndpoint Property (SAML Component)

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider.

Syntax

__property bool SAMLRequestUseDefaultEndpoint = { read=FSAMLRequestUseDefaultEndpoint, write=FSetSAMLRequestUseDefaultEndpoint };

Default Value

false

Remarks

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider. When multiple ACS endpoints are available, a single endpoint can be selected as the default endpoint. When building an Authn Request, the component will select the the ACS endpoint depending on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set to true, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, then the component will use that index in the request. Otherwise, the component will select the first URI available in the ServiceProviderURIs properties.

Data Type

Boolean

SAMLRequestURL Property (SAML Component)

The URL for SAML requests.

Syntax

__property String SAMLRequestURL = { read=FSAMLRequestURL };

Default Value

""

Remarks

This property contains the generated URL to an identity provider for a sign-on or logoff service. Depending on the binding used, the URL may contain the SAMLRequest parameter, or the SAMLRequestBody property will be populated to be sent along with the request. It is generated using the BuildAuthnRequest or BuildLogoutRequest methods.

This property is read-only.

Data Type

String

SAMLResponseBody Property (SAML Component)

The HTTP body for a SAML response.

Syntax

__property String SAMLResponseBody = { read=FSAMLResponseBody, write=FSetSAMLResponseBody };
__property DynamicArray<Byte> SAMLResponseBodyB = { read=FSAMLResponseBodyB, write=FSetSAMLResponseBodyB };

Default Value

""

Remarks

This property can be set before calling the ParseSAMLResponse or ProcessSAMLResponse methods to directly provide the HTTP body of a SAML response that should be parsed or processed. If using the HTTP context, this property is populated with the HTTP body containing the SAML response that was parsed from the HTTP context after calling ParseSAMLResponse or ProcessSAMLResponse.

Data Type

Byte Array

SAMLResponseHeaders Property (SAML Component)

The HTTP headers for a SAML response.

Syntax

__property String SAMLResponseHeaders = { read=FSAMLResponseHeaders, write=FSetSAMLResponseHeaders };

Default Value

""

Remarks

This property can be set before calling the ParseSAMLResponse or ProcessSAMLResponse methods to directly provide the HTTP headers that contain a SAML response from the Identity Provider. If using the HTTP context, this property is populated with the HTTP headers that were parsed from the HTTP context after calling ParseSAMLResponse or ProcessSAMLResponse.

Data Type

String

SAMLResponseConsent Property (SAML Component)

Whether consent from a principal was provided when this response was sent.

Syntax

__property String SAMLResponseConsent = { read=FSAMLResponseConsent };

Default Value

""

Remarks

Whether consent from a principal was provided when this response was sent. This typically is set to some URI reference that matches the method that was used by the application to obtain consent from the principal (user).

Some common URI values are:

• Unspecified - urn:oasis:names:tc:SAML:2.0:consent:unspecified
• Obtained - urn:oasis:names:tc:SAML:2.0:consent:obtained
• Prior - urn:oasis:names:tc:SAML:2.0:consent:prior
• Implicit - urn:oasis:names:tc:SAML:2.0:consent:current-implicit
• Explicit - urn:oasis:names:tc:SAML:2.0:consent:current-explicit
• Unavailable - urn:oasis:names:tc:SAML:2.0:consent:unavailable
• Inapplicable - urn:oasis:names:tc:SAML:2.0:consent:inapplicable

This property is read-only.

Data Type

String

SAMLResponseDestination Property (SAML Component)

A URI reference for the intended destination for the SAML response.

Syntax

__property String SAMLResponseDestination = { read=FSAMLResponseDestination };

Default Value

""

Remarks

A URI reference for the intended destination for the SAML response. This is useful to prevent malicious forwarding of responses to unintended recipients.

This property is read-only.

Data Type

String

SAMLResponseInResponseTo Property (SAML Component)

The Id of the SAML request that requested the Identity Provider to issue this SAML response.

Syntax

__property String SAMLResponseInResponseTo = { read=FSAMLResponseInResponseTo };

Default Value

""

Remarks

The Id of the SAML request that requested the Identity Provider to issue this SAML response. The component validates this property against the original Id of the SAML request which SAMLResponseId should be set to.

This property is read-only.

Data Type

String

SAMLResponseIssuedTime Property (SAML Component)

The time at which the SAML response was issued by the Issuer .

Syntax

__property String SAMLResponseIssuedTime = { read=FSAMLResponseIssuedTime };

Default Value

""

Remarks

The time at which the SAML response was issued by the SAMLResponseIssuer.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

SAMLResponseIssuer Property (SAML Component)

The Entity Id of the issuer of the SAML response.

Syntax

__property String SAMLResponseIssuer = { read=FSAMLResponseIssuer };

Default Value

""

Remarks

The Entity Id of the issuer of the SAML response. Typically, this will be the SAMLResponseEntityId of the Identity Provider.

This property is read-only.

Data Type

String

SAMLResponseResponseContent Property (SAML Component)

The full XML of the SAML Response after being parsed or processed by the component after calling ParseSAMLResponse or ProcessSAMLResponse .

Syntax

__property String SAMLResponseResponseContent = { read=FSAMLResponseResponseContent, write=FSetSAMLResponseResponseContent };
__property DynamicArray<Byte> SAMLResponseResponseContentB = { read=FSAMLResponseResponseContentB, write=FSetSAMLResponseResponseContentB };

Default Value

""

Remarks

The full XML of the SAML Response after being parsed or processed by the component after calling ParseSAMLResponse or ProcessSAMLResponse. Optionally, this setting can be set to provide a SAML response directly to the component to be used with the ParseSAMLResponse or ProcessSAMLResponse methods.

Data Type

Byte Array

SAMLResponseResponseId Property (SAML Component)

The unique Id for the SAML response that was created by the Issuer .

Syntax

__property String SAMLResponseResponseId = { read=FSAMLResponseResponseId };

Default Value

""

Remarks

The unique Id for the SAML response that was created by the SAMLResponseIssuer.

This property is read-only.

Data Type

String

SAMLResponseResponseType Property (SAML Component)

The type of SAML response that was processed when calling ProcessSAMLResponse or manually parsed using the ParseSAMLResponse method.

Syntax

__property TciSAMLSAMLResponseResponseTypes SAMLResponseResponseType = { read=FSAMLResponseResponseType };

enum TciSAMLSAMLResponseResponseTypes {
  srtUnknown=0,
  srtAuthn=1,
  srtLogout=2
};

Default Value

srtUnknown

Remarks

The type of SAML response that was processed when calling ProcessSAMLResponse or manually parsed using the ParseSAMLResponse method.

This property is read-only.

Data Type

Integer

SAMLResponseSigned Property (SAML Component)

Whether the SAML response is signed.

Syntax

__property bool SAMLResponseSigned = { read=FSAMLResponseSigned };

Default Value

false

Remarks

Whether the SAML response is signed. If the SAML response contains no signatures, or only the assertion is signed, then this property will be set to false.

This property is read-only.

Data Type

Boolean

SAMLResponseStatusCodes Property (SAML Component)

A semicolon-separated list of status codes found in the SAML response.

Syntax

__property String SAMLResponseStatusCodes = { read=FSAMLResponseStatusCodes };

Default Value

""

Remarks

A semicolon-separated list of status codes found in the SAML response. A compliant SAML response will always contain a top-level response with one of the following values.

After the top-level status code, second-level codes can also be included to provide additional information about the top-level status code. These second-level codes are also typically a URI reference like the top-level codes. For example, if the Identity Provider was unable to authenticate the user, this setting could be set to:

urn:oasis:names:tc:SAML:2.0:status:Responder;urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

Sometimes, a message is also provided with the Status. See SAMLResponseStatusMessage for more information.

This property is read-only.

Data Type

String

SAMLResponseStatusMessage Property (SAML Component)

The message that was provided in the status of the SAML response.

Syntax

__property String SAMLResponseStatusMessage = { read=FSAMLResponseStatusMessage };

Default Value

""

Remarks

The message that was provided in the status of the SAML response. This property is set alongside the SAMLResponseStatusCodes and can be used to provide more information about the status.

This property is read-only.

Data Type

String

ServiceProviderMetadataAuthnRequestSigned Property (SAML Component)

Whether the generated metadata document will inform the identity provider that this service provider will be sending signed requests.

Syntax

__property bool ServiceProviderMetadataAuthnRequestSigned = { read=FServiceProviderMetadataAuthnRequestSigned, write=FSetServiceProviderMetadataAuthnRequestSigned };

Default Value

false

Remarks

Whether the generated metadata document will inform the identity provider that this service provider will be sending signed requests.

Data Type

Boolean

ServiceProviderMetadataEntityId Property (SAML Component)

The Entity Id for this service provider.

Syntax

__property String ServiceProviderMetadataEntityId = { read=FServiceProviderMetadataEntityId, write=FSetServiceProviderMetadataEntityId };

Default Value

""

Remarks

The Entity Id for this service provider. This is the unique Id that will be used by the Identity Provider and should be unique to this service provider.

Data Type

String

ServiceProviderMetadataMetadataContent Property (SAML Component)

The raw XML document that represents the metadata document for the configured service provider.

Syntax

__property String ServiceProviderMetadataMetadataContent = { read=FServiceProviderMetadataMetadataContent, write=FSetServiceProviderMetadataMetadataContent };
__property DynamicArray<Byte> ServiceProviderMetadataMetadataContentB = { read=FServiceProviderMetadataMetadataContentB, write=FSetServiceProviderMetadataMetadataContentB };

Default Value

""

Remarks

The raw XML document that represents the metadata document for the configured service provider. This property is populated when the BuildServiceMetadata method is used to generate a new document.

Data Type

Byte Array

ServiceProviderMetadataSignedMetadata Property (SAML Component)

Whether the component will sign the metadata document when it is being generated.

Syntax

__property bool ServiceProviderMetadataSignedMetadata = { read=FServiceProviderMetadataSignedMetadata, write=FSetServiceProviderMetadataSignedMetadata };

Default Value

false

Remarks

Whether the component will sign the metadata document when it is being generated. When the BuildServiceMetadata method is used to generate the metadata document, the component will use the ServiceProviderSigningCert property to sign the document.

Data Type

Boolean

ServiceProviderMetadataSupportedNameIdFormats Property (SAML Component)

A semicolon-separated list of NameId formats that are supported by this service provider.

Syntax

__property String ServiceProviderMetadataSupportedNameIdFormats = { read=FServiceProviderMetadataSupportedNameIdFormats, write=FSetServiceProviderMetadataSupportedNameIdFormats };

Default Value

""

Remarks

A semicolon-separated list of NameId formats that are supported by this service provider.

Some common values are:

To support both email addresses and Windows domain qualified name, this property would be set to:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress;urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName

Data Type

String

ServiceProviderMetadataWantAssertionsSigned Property (SAML Component)

Whether the metadata document will inform the identity provider that this service provider wants issued assertions to be signed.

Syntax

__property bool ServiceProviderMetadataWantAssertionsSigned = { read=FServiceProviderMetadataWantAssertionsSigned, write=FSetServiceProviderMetadataWantAssertionsSigned };

Default Value

false

Remarks

Whether the metadata document will inform the identity provider that this service provider wants issued assertions to be signed.

Data Type

Boolean

ServiceProviderSigningCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String ServiceProviderSigningCertStore = { read=FServiceProviderSigningCertStore, write=FSetServiceProviderSigningCertStore };
__property DynamicArray<Byte> ServiceProviderSigningCertStoreB = { read=FServiceProviderSigningCertStoreB, write=FSetServiceProviderSigningCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The ServiceProviderSigningCertStoreType property denotes the type of the certificate store specified by ServiceProviderSigningCertStore. If the store is password-protected, specify the password in ServiceProviderSigningCertStorePassword.

ServiceProviderSigningCertStore is used in conjunction with the ServiceProviderSigningCertSubject property to specify client certificates. If ServiceProviderSigningCertStore has a value, and ServiceProviderSigningCertSubject or ServiceProviderSigningCertEncoded is set, a search for a certificate is initiated. Please see the ServiceProviderSigningCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Byte Array

ServiceProviderSigningCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String ServiceProviderSigningCertStorePassword = { read=FServiceProviderSigningCertStorePassword, write=FSetServiceProviderSigningCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

ServiceProviderSigningCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLServiceProviderSigningCertStoreTypes ServiceProviderSigningCertStoreType = { read=FServiceProviderSigningCertStoreType, write=FSetServiceProviderSigningCertStoreType };

enum TciSAMLServiceProviderSigningCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

ServiceProviderSigningCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String ServiceProviderSigningCertSubject = { read=FServiceProviderSigningCertSubject, write=FSetServiceProviderSigningCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

ServiceProviderSigningCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String ServiceProviderSigningCertEncoded = { read=FServiceProviderSigningCertEncoded, write=FSetServiceProviderSigningCertEncoded };
__property DynamicArray<Byte> ServiceProviderSigningCertEncodedB = { read=FServiceProviderSigningCertEncodedB, write=FSetServiceProviderSigningCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The ServiceProviderSigningCertStore and ServiceProviderSigningCertSubject properties also may be used to specify a certificate.

When ServiceProviderSigningCertEncoded is set, a search is initiated in the current ServiceProviderSigningCertStore for the private key of the certificate. If the key is found, ServiceProviderSigningCertSubject is updated to reflect the full subject of the selected certificate; otherwise, ServiceProviderSigningCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Byte Array

ServiceProviderURICount Property (SAML Component)

The number of records in the ServiceProviderURI arrays.

Syntax

__property int ServiceProviderURICount = { read=FServiceProviderURICount, write=FSetServiceProviderURICount };

Default Value

0

Remarks

This property controls the size of the following arrays:

• ServiceProviderURIBindingRef
• ServiceProviderURIBindingType
• ServiceProviderURIIndex
• ServiceProviderURIIsDefault
• ServiceProviderURILocation
• ServiceProviderURIType

The array indices start at 0 and end at ServiceProviderURICount - 1.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIBindingRef Property (SAML Component)

The URI reference for the set BindingType .

Syntax

__property String ServiceProviderURIBindingRef[int ServiceProviderURIIdx] = { read=FServiceProviderURIBindingRef, write=FSetServiceProviderURIBindingRef };

Default Value

""

Remarks

The URI reference for the set ServiceProviderURIBindingType. When the ServiceProviderURIBindingType is set, this property will be updated to match. The exception is the subCustom value, which allows for any value to be placed in this property.

If this property is set instead, the component will attempt to set the ServiceProviderURIBindingType property to match. If it can't, subCustom will also be used.

When parsing a metadata document, the component will also use the subCustom value for any binding types that are not recognized by the component.

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

String

ServiceProviderURIBindingType Property (SAML Component)

The type of binding that is supported for this URI.

Syntax

__property TciSAMLServiceProviderURIBindingTypes ServiceProviderURIBindingType[int ServiceProviderURIIdx] = { read=FServiceProviderURIBindingType, write=FSetServiceProviderURIBindingType };

enum TciSAMLServiceProviderURIBindingTypes {
  subRedirect=0,
  subPost=1,
  subArtifact=2,
  subCustom=3
};

Default Value

subRedirect

Remarks

The type of binding that is supported for this URI. The component only supports using the HTTP Redirect and HTTP POST bindings. The HTTP Artifact and other bindings are informational, and support for them must be implemented directly.

When setting this property, the ServiceProviderURIBindingRef property will also be updated with the matching URI. The exception is the subCustom value, which allows for any value to be placed in the ServiceProviderURIBindingRef property.

If the ServiceProviderURIBindingRef property is set, during the processing of a metadata document the component will attempt to set this property as well with the matching value. If it can't, subCustom will be used instead.

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIIsDefault Property (SAML Component)

Whether this URI is the default URI that should be used for the specific URIType and BindingType combination.

Syntax

__property bool ServiceProviderURIIsDefault[int ServiceProviderURIIdx] = { read=FServiceProviderURIIsDefault, write=FSetServiceProviderURIIsDefault };

Default Value

false

Remarks

Whether this URI is the default URI that should be used for the specific ServiceProviderURIURIType and ServiceProviderURIBindingType combination.

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Boolean

ServiceProviderURILocation Property (SAML Component)

The address of the URI.

Syntax

__property String ServiceProviderURILocation[int ServiceProviderURIIdx] = { read=FServiceProviderURILocation, write=FSetServiceProviderURILocation };

Default Value

""

Remarks

The address of the URI.

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

String

ServiceProviderURIIndex Property (SAML Component)

The index for the URI that can be optionally used if multiple URIs of the same URIType and BindingType are provided.

Syntax

__property int ServiceProviderURIIndex[int ServiceProviderURIIdx] = { read=FServiceProviderURIIndex, write=FSetServiceProviderURIIndex };

Default Value

0

Remarks

The index for the URI that can be optionally used if multiple URIs of the same ServiceProviderURIURIType and ServiceProviderURIBindingType are provided.

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIType Property (SAML Component)

The purpose of the URI.

Syntax

__property TciSAMLServiceProviderURITypes ServiceProviderURIType[int ServiceProviderURIIdx] = { read=FServiceProviderURIType, write=FSetServiceProviderURIType };

enum TciSAMLServiceProviderURITypes {
  sutSignon=0,
  sutLogout=1,
  sutACS=2
};

Default Value

sutSignon

Remarks

The purpose of the URI.

Possible values are:

The ServiceProviderURIIdx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

SSLAcceptServerCertEffectiveDate Property (SAML Component)

The date on which this certificate becomes valid.

Syntax

__property String SSLAcceptServerCertEffectiveDate = { read=FSSLAcceptServerCertEffectiveDate };

Default Value

""

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLAcceptServerCertExpirationDate Property (SAML Component)

The date on which the certificate expires.

Syntax

__property String SSLAcceptServerCertExpirationDate = { read=FSSLAcceptServerCertExpirationDate };

Default Value

""

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLAcceptServerCertExtendedKeyUsage Property (SAML Component)

A comma-delimited list of extended key usage identifiers.

Syntax

__property String SSLAcceptServerCertExtendedKeyUsage = { read=FSSLAcceptServerCertExtendedKeyUsage };

Default Value

""

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprint Property (SAML Component)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Syntax

__property String SSLAcceptServerCertFingerprint = { read=FSSLAcceptServerCertFingerprint };

Default Value

""

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprintSHA1 Property (SAML Component)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Syntax

__property String SSLAcceptServerCertFingerprintSHA1 = { read=FSSLAcceptServerCertFingerprintSHA1 };

Default Value

""

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprintSHA256 Property (SAML Component)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Syntax

__property String SSLAcceptServerCertFingerprintSHA256 = { read=FSSLAcceptServerCertFingerprintSHA256 };

Default Value

""

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLAcceptServerCertIssuer Property (SAML Component)

The issuer of the certificate.

Syntax

__property String SSLAcceptServerCertIssuer = { read=FSSLAcceptServerCertIssuer };

Default Value

""

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLAcceptServerCertPrivateKey Property (SAML Component)

The private key of the certificate (if available).

Syntax

__property String SSLAcceptServerCertPrivateKey = { read=FSSLAcceptServerCertPrivateKey };

Default Value

""

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLAcceptServerCertPrivateKey may be available but not exportable. In this case, SSLAcceptServerCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLAcceptServerCertPrivateKeyAvailable Property (SAML Component)

Whether a PrivateKey is available for the selected certificate.

Syntax

__property bool SSLAcceptServerCertPrivateKeyAvailable = { read=FSSLAcceptServerCertPrivateKeyAvailable };

Default Value

false

Remarks

Whether a SSLAcceptServerCertPrivateKey is available for the selected certificate. If SSLAcceptServerCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLAcceptServerCertPrivateKeyContainer Property (SAML Component)

The name of the PrivateKey container for the certificate (if available).

Syntax

__property String SSLAcceptServerCertPrivateKeyContainer = { read=FSSLAcceptServerCertPrivateKeyContainer };

Default Value

""

Remarks

The name of the SSLAcceptServerCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKey Property (SAML Component)

The public key of the certificate.

Syntax

__property String SSLAcceptServerCertPublicKey = { read=FSSLAcceptServerCertPublicKey };

Default Value

""

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKeyAlgorithm Property (SAML Component)

The textual description of the certificate's public key algorithm.

Syntax

__property String SSLAcceptServerCertPublicKeyAlgorithm = { read=FSSLAcceptServerCertPublicKeyAlgorithm };

Default Value

""

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKeyLength Property (SAML Component)

The length of the certificate's public key (in bits).

Syntax

__property int SSLAcceptServerCertPublicKeyLength = { read=FSSLAcceptServerCertPublicKeyLength };

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLAcceptServerCertSerialNumber Property (SAML Component)

The serial number of the certificate encoded as a string.

Syntax

__property String SSLAcceptServerCertSerialNumber = { read=FSSLAcceptServerCertSerialNumber };

Default Value

""

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLAcceptServerCertSignatureAlgorithm Property (SAML Component)

The text description of the certificate's signature algorithm.

Syntax

__property String SSLAcceptServerCertSignatureAlgorithm = { read=FSSLAcceptServerCertSignatureAlgorithm };

Default Value

""

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLAcceptServerCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String SSLAcceptServerCertStore = { read=FSSLAcceptServerCertStore, write=FSetSSLAcceptServerCertStore };
__property DynamicArray<Byte> SSLAcceptServerCertStoreB = { read=FSSLAcceptServerCertStoreB, write=FSetSSLAcceptServerCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The SSLAcceptServerCertStoreType property denotes the type of the certificate store specified by SSLAcceptServerCertStore. If the store is password-protected, specify the password in SSLAcceptServerCertStorePassword.

SSLAcceptServerCertStore is used in conjunction with the SSLAcceptServerCertSubject property to specify client certificates. If SSLAcceptServerCertStore has a value, and SSLAcceptServerCertSubject or SSLAcceptServerCertEncoded is set, a search for a certificate is initiated. Please see the SSLAcceptServerCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

Data Type

Byte Array

SSLAcceptServerCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String SSLAcceptServerCertStorePassword = { read=FSSLAcceptServerCertStorePassword, write=FSetSSLAcceptServerCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Data Type

String

SSLAcceptServerCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLSSLAcceptServerCertStoreTypes SSLAcceptServerCertStoreType = { read=FSSLAcceptServerCertStoreType, write=FSetSSLAcceptServerCertStoreType };

enum TciSAMLSSLAcceptServerCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

Data Type

Integer

SSLAcceptServerCertSubjectAltNames Property (SAML Component)

Comma-separated lists of alternative subject names for the certificate.

Syntax

__property String SSLAcceptServerCertSubjectAltNames = { read=FSSLAcceptServerCertSubjectAltNames };

Default Value

""

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintMD5 Property (SAML Component)

The MD5 hash of the certificate.

Syntax

__property String SSLAcceptServerCertThumbprintMD5 = { read=FSSLAcceptServerCertThumbprintMD5 };

Default Value

""

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintSHA1 Property (SAML Component)

The SHA-1 hash of the certificate.

Syntax

__property String SSLAcceptServerCertThumbprintSHA1 = { read=FSSLAcceptServerCertThumbprintSHA1 };

Default Value

""

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintSHA256 Property (SAML Component)

The SHA-256 hash of the certificate.

Syntax

__property String SSLAcceptServerCertThumbprintSHA256 = { read=FSSLAcceptServerCertThumbprintSHA256 };

Default Value

""

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertUsage Property (SAML Component)

The text description of UsageFlags .

Syntax

__property String SSLAcceptServerCertUsage = { read=FSSLAcceptServerCertUsage };

Default Value

""

Remarks

The text description of SSLAcceptServerCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLAcceptServerCertUsageFlags Property (SAML Component)

The flags that show intended use for the certificate.

Syntax

__property int SSLAcceptServerCertUsageFlags = { read=FSSLAcceptServerCertUsageFlags };

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLAcceptServerCertUsageFlags is a combination of the following flags:

Please see the SSLAcceptServerCertUsage property for a text representation of SSLAcceptServerCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLAcceptServerCertVersion Property (SAML Component)

The certificate's version number.

Syntax

__property String SSLAcceptServerCertVersion = { read=FSSLAcceptServerCertVersion };

Default Value

""

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLAcceptServerCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String SSLAcceptServerCertSubject = { read=FSSLAcceptServerCertSubject, write=FSetSSLAcceptServerCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

Data Type

String

SSLAcceptServerCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String SSLAcceptServerCertEncoded = { read=FSSLAcceptServerCertEncoded, write=FSetSSLAcceptServerCertEncoded };
__property DynamicArray<Byte> SSLAcceptServerCertEncodedB = { read=FSSLAcceptServerCertEncodedB, write=FSetSSLAcceptServerCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLAcceptServerCertStore and SSLAcceptServerCertSubject properties also may be used to specify a certificate.

When SSLAcceptServerCertEncoded is set, a search is initiated in the current SSLAcceptServerCertStore for the private key of the certificate. If the key is found, SSLAcceptServerCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLAcceptServerCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Byte Array

SSLCertEffectiveDate Property (SAML Component)

The date on which this certificate becomes valid.

Syntax

__property String SSLCertEffectiveDate = { read=FSSLCertEffectiveDate };

Default Value

""

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLCertExpirationDate Property (SAML Component)

The date on which the certificate expires.

Syntax

__property String SSLCertExpirationDate = { read=FSSLCertExpirationDate };

Default Value

""

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLCertExtendedKeyUsage Property (SAML Component)

A comma-delimited list of extended key usage identifiers.

Syntax

__property String SSLCertExtendedKeyUsage = { read=FSSLCertExtendedKeyUsage };

Default Value

""

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLCertFingerprint Property (SAML Component)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Syntax

__property String SSLCertFingerprint = { read=FSSLCertFingerprint };

Default Value

""

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLCertFingerprintSHA1 Property (SAML Component)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Syntax

__property String SSLCertFingerprintSHA1 = { read=FSSLCertFingerprintSHA1 };

Default Value

""

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLCertFingerprintSHA256 Property (SAML Component)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Syntax

__property String SSLCertFingerprintSHA256 = { read=FSSLCertFingerprintSHA256 };

Default Value

""

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLCertIssuer Property (SAML Component)

The issuer of the certificate.

Syntax

__property String SSLCertIssuer = { read=FSSLCertIssuer };

Default Value

""

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLCertPrivateKey Property (SAML Component)

The private key of the certificate (if available).

Syntax

__property String SSLCertPrivateKey = { read=FSSLCertPrivateKey };

Default Value

""

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLCertPrivateKey may be available but not exportable. In this case, SSLCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLCertPrivateKeyAvailable Property (SAML Component)

Whether a PrivateKey is available for the selected certificate.

Syntax

__property bool SSLCertPrivateKeyAvailable = { read=FSSLCertPrivateKeyAvailable };

Default Value

false

Remarks

Whether a SSLCertPrivateKey is available for the selected certificate. If SSLCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLCertPrivateKeyContainer Property (SAML Component)

The name of the PrivateKey container for the certificate (if available).

Syntax

__property String SSLCertPrivateKeyContainer = { read=FSSLCertPrivateKeyContainer };

Default Value

""

Remarks

The name of the SSLCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLCertPublicKey Property (SAML Component)

The public key of the certificate.

Syntax

__property String SSLCertPublicKey = { read=FSSLCertPublicKey };

Default Value

""

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLCertPublicKeyAlgorithm Property (SAML Component)

The textual description of the certificate's public key algorithm.

Syntax

__property String SSLCertPublicKeyAlgorithm = { read=FSSLCertPublicKeyAlgorithm };

Default Value

""

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLCertPublicKeyLength Property (SAML Component)

The length of the certificate's public key (in bits).

Syntax

__property int SSLCertPublicKeyLength = { read=FSSLCertPublicKeyLength };

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLCertSerialNumber Property (SAML Component)

The serial number of the certificate encoded as a string.

Syntax

__property String SSLCertSerialNumber = { read=FSSLCertSerialNumber };

Default Value

""

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLCertSignatureAlgorithm Property (SAML Component)

The text description of the certificate's signature algorithm.

Syntax

__property String SSLCertSignatureAlgorithm = { read=FSSLCertSignatureAlgorithm };

Default Value

""

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String SSLCertStore = { read=FSSLCertStore, write=FSetSSLCertStore };
__property DynamicArray<Byte> SSLCertStoreB = { read=FSSLCertStoreB, write=FSetSSLCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The SSLCertStoreType property denotes the type of the certificate store specified by SSLCertStore. If the store is password-protected, specify the password in SSLCertStorePassword.

SSLCertStore is used in conjunction with the SSLCertSubject property to specify client certificates. If SSLCertStore has a value, and SSLCertSubject or SSLCertEncoded is set, a search for a certificate is initiated. Please see the SSLCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

Data Type

Byte Array

SSLCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String SSLCertStorePassword = { read=FSSLCertStorePassword, write=FSetSSLCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Data Type

String

SSLCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLSSLCertStoreTypes SSLCertStoreType = { read=FSSLCertStoreType, write=FSetSSLCertStoreType };

enum TciSAMLSSLCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

Data Type

Integer

SSLCertSubjectAltNames Property (SAML Component)

Comma-separated lists of alternative subject names for the certificate.

Syntax

__property String SSLCertSubjectAltNames = { read=FSSLCertSubjectAltNames };

Default Value

""

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLCertThumbprintMD5 Property (SAML Component)

The MD5 hash of the certificate.

Syntax

__property String SSLCertThumbprintMD5 = { read=FSSLCertThumbprintMD5 };

Default Value

""

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertThumbprintSHA1 Property (SAML Component)

The SHA-1 hash of the certificate.

Syntax

__property String SSLCertThumbprintSHA1 = { read=FSSLCertThumbprintSHA1 };

Default Value

""

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertThumbprintSHA256 Property (SAML Component)

The SHA-256 hash of the certificate.

Syntax

__property String SSLCertThumbprintSHA256 = { read=FSSLCertThumbprintSHA256 };

Default Value

""

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertUsage Property (SAML Component)

The text description of UsageFlags .

Syntax

__property String SSLCertUsage = { read=FSSLCertUsage };

Default Value

""

Remarks

The text description of SSLCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLCertUsageFlags Property (SAML Component)

The flags that show intended use for the certificate.

Syntax

__property int SSLCertUsageFlags = { read=FSSLCertUsageFlags };

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLCertUsageFlags is a combination of the following flags:

Please see the SSLCertUsage property for a text representation of SSLCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLCertVersion Property (SAML Component)

The certificate's version number.

Syntax

__property String SSLCertVersion = { read=FSSLCertVersion };

Default Value

""

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String SSLCertSubject = { read=FSSLCertSubject, write=FSetSSLCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

Data Type

String

SSLCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String SSLCertEncoded = { read=FSSLCertEncoded, write=FSetSSLCertEncoded };
__property DynamicArray<Byte> SSLCertEncodedB = { read=FSSLCertEncodedB, write=FSetSSLCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLCertStore and SSLCertSubject properties also may be used to specify a certificate.

When SSLCertEncoded is set, a search is initiated in the current SSLCertStore for the private key of the certificate. If the key is found, SSLCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Byte Array

SSLProvider Property (SAML Component)

The Secure Sockets Layer/Transport Layer Security (SSL/TLS) implementation to use.

Syntax

__property TciSAMLSSLProviders SSLProvider = { read=FSSLProvider, write=FSetSSLProvider };

enum TciSAMLSSLProviders {
  sslpAutomatic=0,
  sslpPlatform=1,
  sslpInternal=2
};

Default Value

sslpAutomatic

Remarks

This property specifies the SSL/TLS implementation to use. In most cases the default value of 0 (Automatic) is recommended and should not be changed. When set to 0 (Automatic), the component will select whether to use the platform implementation or the internal implementation depending on the operating system as well as the TLS version being used.

Possible values are as follows:

Additional Notes

In most cases using the default value (Automatic) is recommended. The component will select a provider depending on the current platform.

When Automatic is selected, the platform implementation is used by default. When TLS 1.3 is enabled via SSLEnabledProtocols, the internal implementation is used.

Data Type

Integer

SSLServerCertEffectiveDate Property (SAML Component)

The date on which this certificate becomes valid.

Syntax

__property String SSLServerCertEffectiveDate = { read=FSSLServerCertEffectiveDate };

Default Value

""

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLServerCertExpirationDate Property (SAML Component)

The date on which the certificate expires.

Syntax

__property String SSLServerCertExpirationDate = { read=FSSLServerCertExpirationDate };

Default Value

""

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLServerCertExtendedKeyUsage Property (SAML Component)

A comma-delimited list of extended key usage identifiers.

Syntax

__property String SSLServerCertExtendedKeyUsage = { read=FSSLServerCertExtendedKeyUsage };

Default Value

""

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLServerCertFingerprint Property (SAML Component)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Syntax

__property String SSLServerCertFingerprint = { read=FSSLServerCertFingerprint };

Default Value

""

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLServerCertFingerprintSHA1 Property (SAML Component)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Syntax

__property String SSLServerCertFingerprintSHA1 = { read=FSSLServerCertFingerprintSHA1 };

Default Value

""

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLServerCertFingerprintSHA256 Property (SAML Component)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Syntax

__property String SSLServerCertFingerprintSHA256 = { read=FSSLServerCertFingerprintSHA256 };

Default Value

""

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLServerCertIssuer Property (SAML Component)

The issuer of the certificate.

Syntax

__property String SSLServerCertIssuer = { read=FSSLServerCertIssuer };

Default Value

""

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLServerCertPrivateKey Property (SAML Component)

The private key of the certificate (if available).

Syntax

__property String SSLServerCertPrivateKey = { read=FSSLServerCertPrivateKey };

Default Value

""

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLServerCertPrivateKey may be available but not exportable. In this case, SSLServerCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLServerCertPrivateKeyAvailable Property (SAML Component)

Whether a PrivateKey is available for the selected certificate.

Syntax

__property bool SSLServerCertPrivateKeyAvailable = { read=FSSLServerCertPrivateKeyAvailable };

Default Value

false

Remarks

Whether a SSLServerCertPrivateKey is available for the selected certificate. If SSLServerCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLServerCertPrivateKeyContainer Property (SAML Component)

The name of the PrivateKey container for the certificate (if available).

Syntax

__property String SSLServerCertPrivateKeyContainer = { read=FSSLServerCertPrivateKeyContainer };

Default Value

""

Remarks

The name of the SSLServerCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLServerCertPublicKey Property (SAML Component)

The public key of the certificate.

Syntax

__property String SSLServerCertPublicKey = { read=FSSLServerCertPublicKey };

Default Value

""

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLServerCertPublicKeyAlgorithm Property (SAML Component)

The textual description of the certificate's public key algorithm.

Syntax

__property String SSLServerCertPublicKeyAlgorithm = { read=FSSLServerCertPublicKeyAlgorithm };

Default Value

""

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLServerCertPublicKeyLength Property (SAML Component)

The length of the certificate's public key (in bits).

Syntax

__property int SSLServerCertPublicKeyLength = { read=FSSLServerCertPublicKeyLength };

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLServerCertSerialNumber Property (SAML Component)

The serial number of the certificate encoded as a string.

Syntax

__property String SSLServerCertSerialNumber = { read=FSSLServerCertSerialNumber };

Default Value

""

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLServerCertSignatureAlgorithm Property (SAML Component)

The text description of the certificate's signature algorithm.

Syntax

__property String SSLServerCertSignatureAlgorithm = { read=FSSLServerCertSignatureAlgorithm };

Default Value

""

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLServerCertStore Property (SAML Component)

The name of the certificate store for the client certificate.

Syntax

__property String SSLServerCertStore = { read=FSSLServerCertStore };
__property DynamicArray<Byte> SSLServerCertStoreB = { read=FSSLServerCertStoreB };

Default Value

"MY"

Remarks

The name of the certificate store for the client certificate.

The SSLServerCertStoreType property denotes the type of the certificate store specified by SSLServerCertStore. If the store is password-protected, specify the password in SSLServerCertStorePassword.

SSLServerCertStore is used in conjunction with the SSLServerCertSubject property to specify client certificates. If SSLServerCertStore has a value, and SSLServerCertSubject or SSLServerCertEncoded is set, a search for a certificate is initiated. Please see the SSLServerCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is read-only.

Data Type

Byte Array

SSLServerCertStorePassword Property (SAML Component)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Syntax

__property String SSLServerCertStorePassword = { read=FSSLServerCertStorePassword };

Default Value

""

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is read-only.

Data Type

String

SSLServerCertStoreType Property (SAML Component)

The type of certificate store for this certificate.

Syntax

__property TciSAMLSSLServerCertStoreTypes SSLServerCertStoreType = { read=FSSLServerCertStoreType };

enum TciSAMLSSLServerCertStoreTypes {
  cstUser=0,
  cstMachine=1,
  cstPFXFile=2,
  cstPFXBlob=3,
  cstJKSFile=4,
  cstJKSBlob=5,
  cstPEMKeyFile=6,
  cstPEMKeyBlob=7,
  cstPublicKeyFile=8,
  cstPublicKeyBlob=9,
  cstSSHPublicKeyBlob=10,
  cstP7BFile=11,
  cstP7BBlob=12,
  cstSSHPublicKeyFile=13,
  cstPPKFile=14,
  cstPPKBlob=15,
  cstXMLFile=16,
  cstXMLBlob=17,
  cstJWKFile=18,
  cstJWKBlob=19,
  cstSecurityKey=20,
  cstBCFKSFile=21,
  cstBCFKSBlob=22,
  cstPKCS11=23,
  cstAuto=99
};

Default Value

cstUser

Remarks

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This property can take one of the following values:

This property is read-only.

Data Type

Integer

SSLServerCertSubjectAltNames Property (SAML Component)

Comma-separated lists of alternative subject names for the certificate.

Syntax

__property String SSLServerCertSubjectAltNames = { read=FSSLServerCertSubjectAltNames };

Default Value

""

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLServerCertThumbprintMD5 Property (SAML Component)

The MD5 hash of the certificate.

Syntax

__property String SSLServerCertThumbprintMD5 = { read=FSSLServerCertThumbprintMD5 };

Default Value

""

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertThumbprintSHA1 Property (SAML Component)

The SHA-1 hash of the certificate.

Syntax

__property String SSLServerCertThumbprintSHA1 = { read=FSSLServerCertThumbprintSHA1 };

Default Value

""

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertThumbprintSHA256 Property (SAML Component)

The SHA-256 hash of the certificate.

Syntax

__property String SSLServerCertThumbprintSHA256 = { read=FSSLServerCertThumbprintSHA256 };

Default Value

""

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertUsage Property (SAML Component)

The text description of UsageFlags .

Syntax

__property String SSLServerCertUsage = { read=FSSLServerCertUsage };

Default Value

""

Remarks

The text description of SSLServerCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLServerCertUsageFlags Property (SAML Component)

The flags that show intended use for the certificate.

Syntax

__property int SSLServerCertUsageFlags = { read=FSSLServerCertUsageFlags };

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLServerCertUsageFlags is a combination of the following flags:

Please see the SSLServerCertUsage property for a text representation of SSLServerCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLServerCertVersion Property (SAML Component)

The certificate's version number.

Syntax

__property String SSLServerCertVersion = { read=FSSLServerCertVersion };

Default Value

""

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLServerCertSubject Property (SAML Component)

The subject of the certificate used for client authentication.

Syntax

__property String SSLServerCertSubject = { read=FSSLServerCertSubject };

Default Value

""

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is read-only.

Data Type

String

SSLServerCertEncoded Property (SAML Component)

The certificate (PEM/Base64 encoded).

Syntax

__property String SSLServerCertEncoded = { read=FSSLServerCertEncoded };
__property DynamicArray<Byte> SSLServerCertEncodedB = { read=FSSLServerCertEncodedB };

Default Value

""

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLServerCertStore and SSLServerCertSubject properties also may be used to specify a certificate.

When SSLServerCertEncoded is set, a search is initiated in the current SSLServerCertStore for the private key of the certificate. If the key is found, SSLServerCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLServerCertSubject is set to an empty string.

This property is read-only and not available at design time.

Data Type

Byte Array

BuildAuthnRequest Method (SAML Component)

Builds an Authentication Request.

Syntax

void __fastcall BuildAuthnRequest();

Remarks

Using the SAMLRequestSettings, this method will build a SAML request meant for authenticating the current user. To help keep track of a user's state in your application, the RelayState property can be set to add a RelayState to the request. The value set in the RelayState property will then be present in the response from the Identity Provider.

The Assertion Consumer Service (ACS) that should handle the response specified in the request depends on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, the component will use that index in the request. Otherwise, the component will select the first URI set in the ServiceProviderURIs properties.

After the request is built, the following properties are set depending on how the SAMLRequestRequestBinding property is set.

• HTTP Redirect - SAMLRequestURL
• HTTP Post - SAMLRequestURL, SAMLRequestBody

Example: Redirect Binding

saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.RequestBinding = SAMLRequestBindings.srbHTTPRedirect; saml.SAMLRequestSettings.SignRequest = true; saml.RelayState = "https://service_provider.com/landing"; saml.BuildAuthnRequest(); string requestId = saml.SAMLRequestSettings.Id; //save for later

Example: HTML Post Binding

string htmlContent = $@" <!DOCTYPE html> <html> <head> <title>SAML POST</title> </head> <body onload='document.forms[0].submit()'> <form method='post' action='{saml.SAMLRequestURL}'> <input type='hidden' name='SAMLRequest' value='{saml.SAMLRequestBody}'/> <input type='hidden' name='RelayState' value='{saml.RelayState}'/> </form> </body> </html>";

BuildLogoutRequest Method (SAML Component)

Builds a Single Logout request.

Syntax

void __fastcall BuildLogoutRequest(String NameIdentifier);

Remarks

This method uses the SAMLRequestSettings property to build a SAML logout request that is meant for logging out the user identified by the NameIdentifier parameter. To help keep track of a user's state in your application, the RelayState property can be set to add a RelayState to the request. The value set in the RelayState property will then be present in the response from the Identity Provider. Typically, if supported, the Identity Provider will also issue logout requests for all other sessions that are active for the user. If a user is part of an active session, the SAMLRequestSessionIndex setting can be used to provide the user's current session index to be included in the logout request.

After the request is built, the following properties are set depending on how the SAMLRequestRequestBinding property is set.

• HTTP Redirect - SAMLRequestURL
• HTTP Post - SAMLRequestURL, SAMLRequestBody

BuildLogoutResponse Method (SAML Component)

Builds a Single Logout response.

Syntax

void __fastcall BuildLogoutResponse();

Remarks

This method uses the LogoutResponseSettings property to build a SAML logout response that is meant to respond to a logout request for a specific user.

After the request is built, the following properties are set depending on how the LogoutResponseResponseBinding property is set.

• HTTP Redirect - LogoutResponseURL
• HTTP Post - LogoutResponseURL, LogoutResponseBody

BuildServiceMetadata Method (SAML Component)

Builds a metadata document for a service provider.

Syntax

void __fastcall BuildServiceMetadata();

Remarks

This method uses the ServiceProviderMetadata property to create a new federation metadata document that describes the service provider. This is typically used to provide information about the service provider to the identity provider.

The following fields and properties are used:

• ServiceProviderMetadataAuthnRequestSigned
• ServiceProviderMetadataEntityId
• ServiceProviderMetadataSignedMetadata
• ServiceProviderMetadataSupportedNameIdFormats
• ServiceProviderMetadataWantAssertionsSigned
• ServiceProviderSigningCert
• ServiceProviderURIs

Config Method (SAML Component)

Sets or retrieves a configuration setting.

Syntax

String __fastcall Config(String ConfigurationString);

Remarks

Config is a generic method available in every component. It is used to set and retrieve configuration settings for the component.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoEvents Method (SAML Component)

This method processes events from the internal message queue.

Syntax

void __fastcall DoEvents();

Remarks

When DoEvents is called, the component processes any available events. If no events are available, it waits for a preset period of time, and then returns.

GetAssertionAttribute Method (SAML Component)

Searches for a specific assertion attribute.

Syntax

String __fastcall GetAssertionAttribute(String attrName);

Remarks

This method will search the current AssertionAttributeInfo properties for a specific attribute. The attrName parameter should be set to the attribute name. The method will then return the value of the attribute with the matching name. If there is more than one value, it will return the values in a semicolon-separated list.

Interrupt Method (SAML Component)

This method interrupts the current method.

Syntax

void __fastcall Interrupt();

Remarks

If there is no method in progress, Interrupt simply returns, doing nothing.

LoadIdentityMetadata Method (SAML Component)

Loads an identity provider's metadata document.

Syntax

void __fastcall LoadIdentityMetadata(String metadataDocument, bool validate);

Remarks

This method loads in the identity provider's metadata document that is provided through the metadataDocument parameter. After the document has been loaded, the IdentityProviderEncryptingCert, IdentityProviderMetadata, IdentityProviderSigningCert and IdentityProviderURIs properties will be set with the information that is available in the document. If the metadata document is signed and the validate parameter is true, the method will also validate the metadata document's signature.

ParseAssertion Method (SAML Component)

Parses an assertion.

Syntax

void __fastcall ParseAssertion();

Remarks

This method parses the assertion found in the AssertionInfo property. The assertion can either be manually set by setting the AssertionAssertionContent property or by first calling ParseSAMLResponse on a SAML response that contains an assertion. If the method is able to successfully parse the assertion, the AssertionInfo property is populated along with the AssertionAttributeInfo and AssertionAuthnInfo collections, once for each type of statement found in the assertion.

ParseLogoutRequest Method (SAML Component)

Parses a SAML logout request.

Syntax

void __fastcall ParseLogoutRequest();

Remarks

This method parses the logout request found in the LogoutRequestInfo property or from the current HTTP request. The HTTP request containing the LogoutRequest parameter can be provided to the component either by setting the LogoutRequestBody and LogoutRequestHeaders properties or by accessing it from the current HTTP Context, if available.

The raw logout request can instead be provided directly to the component by setting the LogoutRequestRequestContent property. If the method is able to successfully parse the logout request, the information fields in the LogoutRequestInfo property are populated.

To validate a logout request, see ValidateLogoutRequest.

ParseSAMLResponse Method (SAML Component)

Parses a SAML response.

Syntax

void __fastcall ParseSAMLResponse();

Remarks

This method parses the SAML response found in the SAMLResponseInfo property or from the current HTTP request. The HTTP request containing the SAMLResponse parameter can be provided to the component either by setting the SAMLResponseBody and SAMLResponseHeaders properties or by accessing it from the current HTTP Context, if available.

The raw SAML response can instead be provided directly to the component by setting the SAMLResponseResponseContent property. If the method is able to successfully parse the SAML response, the information fields in the SAMLResponseInfo property are populated.

To validate a SAML response, see ValidateSAMLResponse.

Additionally, if the SAMLResponseResponseType is srtAuthn, the AssertionAssertionContent property will be populated. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

ProcessLogoutRequest Method (SAML Component)

Processes a SAML logout request.

Syntax

void __fastcall ProcessLogoutRequest();

Remarks

This method processes the logout request found in the LogoutRequestInfo property or from the current HTTP request.

The HTTP request containing the LogoutRequest parameter can be provided to the component either by setting the LogoutRequestBody and LogoutRequestHeaders properties or by accessing it from the current HTTP Context, if available. The HTTP request is taken directly from the LogoutRequestHeaders and LogoutRequestBody properties if set; otherwise, it will try to read the HTTP context.

The raw logout request can instead be provided directly to the component by setting the LogoutRequestRequestContent property. If the method is able to successfully parse the logout request, the information fields in the LogoutRequestInfo property are populated.

The method is equivalent to calling the following methods. See the specific methods for more information.

• ParseLogoutRequest
• ValidateLogoutRequest

ProcessSAMLResponse Method (SAML Component)

Processes a SAML response.

Syntax

void __fastcall ProcessSAMLResponse();

Remarks

This method processes the SAML response found in the SAMLResponseInfo property or from the current HTTP request. If the SAMLResponse object contains an assertion, the component will automatically process the assertion as well.

The HTTP request containing the SAMLResponse parameter can be provided to the component either by setting the SAMLResponseBody and SAMLResponseHeaders properties or by accessing it from the current HTTP Context, if available. The HTTP request is taken directly from the SAMLResponseHeaders and SAMLResponseBody properties if set; otherwise, it will try to read the HTTP context.

The raw SAML response can instead be provided directly to the component by setting the SAMLResponseResponseContent property. If the method is able to successfully parse the SAML response, the information fields in the SAMLResponseInfo property are populated.

The method is equivalent to calling the following methods. See the specific methods for more information.

• ParseSAMLResponse
• ValidateSAMLResponse
• ParseAssertion
• ValidateAssertion

RequestIdentityMetadata Method (SAML Component)

Requests an identity provider's SAML metadata document.

Syntax

void __fastcall RequestIdentityMetadata(String URL);

Remarks

This method makes an HTTP GET request to get the Identity Provider metadata document from the URL location. Once the document has been retrieved, the method will parse and validate the metadata document. After the document has been parsed, the IdentityProviderEncryptingCert, IdentityProviderMetadata, IdentityProviderSigningCert, and IdentityProviderURIs properties will be populated with the information that is available in the document.

Reset Method (SAML Component)

This method will reset the component.

Syntax

void __fastcall Reset();

Remarks

This method will reset the component's properties to their default values.

ValidateAssertion Method (SAML Component)

Validates an assertion.

Syntax

void __fastcall ValidateAssertion();

Remarks

This method validates the assertion found in the AssertionInfo property. If an assertion is validated properly, then the user of the application can be authenticated as the subject of the assertion. If the validation fails, then the user should not be authenticated to the application.

The assertion can either be manually set via the AssertionAssertionContent property or by first calling ParseSAMLResponse on a SAML response that contains an assertion. Before attempting this validation, the Assertion event provides an opportunity to configure the component to successfully validate the assertion. If the validation fails at any point, the method will throw an exception with the error code corresponding to the reason.

The following checks are performed on the assertion:

To skip certain checks, see AssertionValidationFlags.

ValidateLogoutRequest Method (SAML Component)

Validates a SAML logout request.

Syntax

void __fastcall ValidateLogoutRequest();

Remarks

This method validates a logout request. If a logout request is successfully validated, then the application should use the LogoutRequestNameId and LogoutRequestSessionIndex properties to logout the user from their current session with the application.

The logout request must first be parsed by calling the ParseLogoutRequest method. Before attempting validation, the LogoutRequest event provides an opportunity to configure the component to successfully validate the logout request.

The following checks are performed on the Logout Request:

To skip certain checks, see LogoutRequestValidationFlags. Note that this method does not validate the assertion if one is found within the SAML response. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

ValidateSAMLResponse Method (SAML Component)

Validates a SAML response.

Syntax

void __fastcall ValidateSAMLResponse();

Remarks

This method validates a SAML response. If a SAML response is successfully validated and in response to an authentication request, then the assertion should be parsed and validated to finish the authentication process. If it is in response to a logout request, then the application should finish it's logout process for the user.

The SAML response must first be parsed by calling the ParseSAMLResponse method. Before attempting validation, the SAMLResponse event provides an opportunity to configure the component to successfully validate the SAML response.

The following checks are performed on the SAML response:

To skip certain checks, see SAMLResponseValidationFlags. Note that this method does not validate the assertion if one is found within the SAML response. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

Assertion Event (SAML Component)

Fired when an assertion is validated.

Syntax

typedef struct {
  String Issuer;
  String InResponseTo;
} TciSAMLAssertionEventParams;
typedef void __fastcall (__closure *TciSAMLAssertionEvent)(System::TObject* Sender, TciSAMLAssertionEventParams *e);
__property TciSAMLAssertionEvent OnAssertion = { read=FOnAssertion, write=FOnAssertion };

Remarks

This event is fired before an assertion is validated. The Issuer parameter is the Id of the entity that issued the assertion. The InResponseTo parameter is the Id of the SAMLRequest that requested the assertion. Note that these two parameters are found in the assertion and are not set in the IdentityProviderMetadataEntityId and SAMLRequestId properties respectively. This event allows certain settings to be configured before the validation checks happen to ensure the assertion is validated correctly. See ValidateAssertion for more information about the validation process.

Error Event (SAML Component)

Fired when information is available about errors during data delivery.

Syntax

typedef struct {
  int ErrorCode;
  String Description;
} TciSAMLErrorEventParams;
typedef void __fastcall (__closure *TciSAMLErrorEvent)(System::TObject* Sender, TciSAMLErrorEventParams *e);
__property TciSAMLErrorEvent OnError = { read=FOnError, write=FOnError };

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the component raises an exception.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

Log Event (SAML Component)

Fired once for each log message.

Syntax

typedef struct {
  int LogLevel;
  String Message;
  String LogType;
} TciSAMLLogEventParams;
typedef void __fastcall (__closure *TciSAMLLogEvent)(System::TObject* Sender, TciSAMLLogEventParams *e);
__property TciSAMLLogEvent OnLog = { read=FOnLog, write=FOnLog };

Remarks

This event is fired once for each log message generated by the component. The verbosity is controlled by the LogLevel setting.

LogLevel indicates the level of message. Possible values are as follows:

The value 1 (Info) logs basic information, including the URL, HTTP version, and status details.

The value 2 (Verbose) logs additional information about the request and response.

The value 3 (Debug) logs the headers and body for both the request and response, as well as additional debug information (if any).

Message is the log entry.

LogType identifies the type of log entry. Possible values are as follows:

• "Info"
• "RequestHeaders"
• "ResponseHeaders"
• "RequestBody"
• "ResponseBody"
• "ProxyRequest"
• "ProxyResponse"
• "FirewallRequest"
• "FirewallResponse"

LogoutRequest Event (SAML Component)

Fired when a logout request is validated.

Syntax

typedef struct {
  String Issuer;
} TciSAMLLogoutRequestEventParams;
typedef void __fastcall (__closure *TciSAMLLogoutRequestEvent)(System::TObject* Sender, TciSAMLLogoutRequestEventParams *e);
__property TciSAMLLogoutRequestEvent OnLogoutRequest = { read=FOnLogoutRequest, write=FOnLogoutRequest };

Remarks

This event is fired before the logout request is validated. This event allows certain settings to be configured before the validation checks happen to ensure the logout request is validated correctly. See ValidateLogoutRequest for more information about the validation process.

The Issuer parameter is the ID attribute parsed from the current logout request. When validating, the ID attribute needs to match the IdentityProviderMetadataEntityId property for validation to succeed. If there are multiple Identity Providers supported, this parameter allows you to configure the component for the specified Identity Provider before continuing with validation.

Redirect Event (SAML Component)

Fired when a redirection is received from the server.

Syntax

typedef struct {
  String Location;
  bool Accept;
} TciSAMLRedirectEventParams;
typedef void __fastcall (__closure *TciSAMLRedirectEvent)(System::TObject* Sender, TciSAMLRedirectEventParams *e);
__property TciSAMLRedirectEvent OnRedirect = { read=FOnRedirect, write=FOnRedirect };

Remarks

This event is fired in cases in which the client can decide whether or not to continue with the redirection process. The Accept parameter is always True by default, but if you do not want to follow the redirection, Accept may be set to False, in which case the component raises an exception. Location is the location to which the client is being redirected. Further control over redirection is provided in the FollowRedirects property.

SAMLResponse Event (SAML Component)

Fired when a SAML response is validated.

Syntax

typedef struct {
  String Issuer;
  String InResponseTo;
} TciSAMLSAMLResponseEventParams;
typedef void __fastcall (__closure *TciSAMLSAMLResponseEvent)(System::TObject* Sender, TciSAMLSAMLResponseEventParams *e);
__property TciSAMLSAMLResponseEvent OnSAMLResponse = { read=FOnSAMLResponse, write=FOnSAMLResponse };

Remarks

This event is fired before the SAML response is validated. This event allows certain settings to be configured before the validation checks happen to ensure the SAML response is validated correctly. See ValidateSAMLResponse for more information about the validation process.

The Issuer parameter is the ID attribute parsed from the current SAML response. When validating, the ID attribute needs to match the IdentityProviderMetadataEntityId property for validation to succeed. If there are multiple Identity Provider's supported, this parameter allows you to configure the component for the specified identity provider before continuing with validation.

The InResponseTo parameter is the InResponseTo attribute parsed from the current SAML response. When validating, the InResponseTo attribute needs to match the SAMLRequestId property for validation to succeed. If there are multiple outstanding requests, this parameter allows you to configure the component for the specified request before continuing with validation.

SSLServerAuthentication Event (SAML Component)

Fired after the server presents its certificate to the client.

Syntax

typedef struct {
  String CertEncoded;
  DynamicArray<Byte> CertEncodedB;
  String CertSubject;
  String CertIssuer;
  String Status;
  bool Accept;
} TciSAMLSSLServerAuthenticationEventParams;
typedef void __fastcall (__closure *TciSAMLSSLServerAuthenticationEvent)(System::TObject* Sender, TciSAMLSSLServerAuthenticationEventParams *e);
__property TciSAMLSSLServerAuthenticationEvent OnSSLServerAuthentication = { read=FOnSSLServerAuthentication, write=FOnSSLServerAuthentication };

Remarks

During this event, the client can decide whether or not to continue with the connection process. The Accept parameter is a recommendation on whether to continue or close the connection. This is just a suggestion: application software must use its own logic to determine whether or not to continue.

When Accept is False, Status shows why the verification failed (otherwise, Status contains the string OK). If it is decided to continue, you can override and accept the certificate by setting the Accept parameter to True.

SSLStatus Event (SAML Component)

Fired when secure connection progress messages are available.

Syntax

typedef struct {
  String Message;
} TciSAMLSSLStatusEventParams;
typedef void __fastcall (__closure *TciSAMLSSLStatusEvent)(System::TObject* Sender, TciSAMLSSLStatusEventParams *e);
__property TciSAMLSSLStatusEvent OnSSLStatus = { read=FOnSSLStatus, write=FOnSSLStatus };

Remarks

The event is fired for informational and logging purposes only. This event tracks the progress of the connection.

Config Settings (SAML Component)

The component accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

SAML Config Settings

HTTP Config Settings

TCPClient Config Settings

SSL Config Settings

Socket Config Settings

Base Config Settings

Trappable Errors (SAML Component)

SAML Errors

The component may also return one of the following error codes, which are inherited from other components.

HTTP Errors

The component may also return one of the following error codes, which are inherited from other components.

TCPClient Errors

SSL Errors

TCP/IP Errors