SAML Class

Properties   Methods   Events   Config Settings   Errors  

The SAML class provides an easy way to add SAML-based SSO to your application.

Class Name

CloudSSO_SAML

Procedural Interface

 cloudsso_saml_open();
 cloudsso_saml_close($res);
 cloudsso_saml_register_callback($res, $id, $function);
 cloudsso_saml_get_last_error($res);
 cloudsso_saml_get_last_error_code($res);
 cloudsso_saml_set($res, $id, $index, $value);
 cloudsso_saml_get($res, $id, $index);
 cloudsso_saml_do_buildauthnrequest($res);
 cloudsso_saml_do_buildlogoutrequest($res, $nameidentifier);
 cloudsso_saml_do_buildlogoutresponse($res);
 cloudsso_saml_do_buildservicemetadata($res);
 cloudsso_saml_do_config($res, $configurationstring);
 cloudsso_saml_do_doevents($res);
 cloudsso_saml_do_getassertionattribute($res, $attrname);
 cloudsso_saml_do_interrupt($res);
 cloudsso_saml_do_loadidentitymetadata($res, $metadatadocument, $validate);
 cloudsso_saml_do_parseassertion($res);
 cloudsso_saml_do_parselogoutrequest($res);
 cloudsso_saml_do_parsesamlresponse($res);
 cloudsso_saml_do_processlogoutrequest($res);
 cloudsso_saml_do_processsamlresponse($res);
 cloudsso_saml_do_requestidentitymetadata($res, $url);
 cloudsso_saml_do_reset($res);
 cloudsso_saml_do_validateassertion($res);
 cloudsso_saml_do_validatelogoutrequest($res);
 cloudsso_saml_do_validatesamlresponse($res);

Remarks

The Security Assertion Markup Language (SAML) protocol provides a standardized way to add Single Sign-on (SSO) to applications. Service Providers (i.e., your application) using SAML-based SSO can eliminate the need to store and manage user passwords. When using SAML, the responsibility of identifying a user can be shifted to the Identity Provider.

In a Web environment, this is typically done by redirecting a user with a SAML request from your application to the Identity Provider's login page where a user already has an account. The user will login, and the Identity Provider will return an assertion in a SAML response, which is a set of information about the user and the authentication steps taken to identify the user.

When a Service Provider (i.e., your web application) receives this SAML response, it will verify both the SAML response and its accompanying assertion to ensure that both were requested by the Service Provider and issued by the Identity Provider. Once the SAML response and assertion have been verified, the assertion will typically contain attributes about the user and its profile with the Identity Provider.

SAML also supports Single Logout (SLO) that can be used to log a user out of the Identity Provider and, depending on the configuration of the Identity Provider, all other accounts that used the Identity Provider to authenticate the user.

Setup

To get started with the class, information about the Identity Provider is needed. Typically, this information is provided by a SAML Metadata Document that is either provided during the setup or requested from a URI. The RequestIdentityMetadata and LoadIdentityMetadata methods are both ways to populate the IdentityProviderMetadata, IdentityProviderSigningCert, and IdentityProviderURIs properties.

Usage: Requesting and Reloading the Identity Provider Metadata Document

saml.RequestIdentityMetadata("https://example.com/federationmetadata/federationmetadata.xml"); string raw_document = saml.IdentityProviderMetadata.MetadataContent; //... saml.LoadIdentityMetadata(raw_document, true);

Additionally, the class needs to be configured with the information about the Service Provider (i.e., your application). The ServiceProviderMetadata, ServiceProviderSigningCert, and ServiceProviderURIs properties can be used to provide information about the Service Provider. These are used by the class to build a valid SAML request and to verify the SAML response and its assertions. Additionally, to easily supply this information to an Identity Provider, the BuildServiceMetadata method can be used to create a SAML Metadata Document that describes your application (the Service Provider) to the Identity Provider.

Usage: Configuring Service Provider Metadata

saml.ServiceProviderMetadata.EntityId = "ServiceProviderId"; saml.ServiceProviderMetadata.AuthnRequestSigned = true; saml.ServiceProviderMetadata.WantAssertionsSigned = true; saml.ServiceProviderSigningCert = new Certificate(CertStoreTypes.cstPFXFile, "cert.pfx", "password", "*"); URI acs = new URI(); acs.URIType = SAMLURITypes.sutACS; acs.Location = "https://service_provider.com/acs/"; acs.BindingType = subPost; saml.ServiceProviderURIs.Add(acs); URI logout = new URI(); logout.URIType = SAMLURITypes.sutLogout; logout.Location = "https://service_provider.com/logout/"; logout.Binding = subRedirect; saml.ServiceProviderURIs.Add(acs); saml.BuildServiceMetadata();

Authentication Request

Once configured, the BuildAuthnRequest method can be used to build a SAML request that has been configured by the SAMLRequestSettings. Additionally, to provide state information between the request and the response, the RelayState property can be set. Typically the RelayState property can be used to return a user back to the location within the application once they have been authenticated. After the request has been created, the SAMLRequestId and SAMLRequestIssuer properties need to be saved for verification purposes. The SAMLRequestIssuer property will be used to check that the SAML response is meant for this Service Provider. The SAMLRequestId property is used to verify that the response corresponds to a request that was made by the Service Provider.

Usage: Building an Authn Request

saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.RequestBinding = SAMLRequestBindings.srbHTTPRedirect; saml.SAMLRequestSettings.SignRequest = true; saml.RelayState = "https://service_provider.com/landing"; saml.BuildAuthnRequest(); string requestId = saml.SAMLRequestSettings.Id; //save for later

Depending on how the SAMLRequestRequestBinding property is configured, the results will be provided through the SAMLRequestBody and SAMLRequestURL properties. Using the information from the properties, the user that needs identifying should be directed to the SAMLRequestURL. If using the srbHTTPRedirect binding, this is typically done by redirecting the user to the URL. This URL will contain the SAMLRequest and RelayState as query parameters that are parsed by the Identity Provider. If using the srbHTTPPost binding, this is done by using an HTML form post as seen below:

string htmlContent = $@" <!DOCTYPE html> <html> <head> <title>SAML POST</title> </head> <body onload='document.forms[0].submit()'> <form method='post' action='{saml.SAMLRequestURL}'> <input type='hidden' name='SAMLRequest' value='{saml.SAMLRequestBody}'/> <input type='hidden' name='RelayState' value='{saml.RelayState}'/> </form> </body> </html>";

Authentication Response

Once the user has completed authentication, the Identity Provider will return the user to the Assertion Consumer Service (ASC) URI that was configured in the ServiceProviderURIs properties. If authentication was successful, this response should also contain an assertion as well as information about the authentication context.

To handle an incoming HTTP request that contains the SAML response, the ProcessSAMLResponse or ParseSAMLResponse methods can be used. To provide the HTTP headers and body that contain the SAML response directly to the class, the SAMLResponseHeaders and SAMLResponseBody properties can be set before calling ParseSAMLResponse or ProcessSAMLResponse. For example:

saml.SAMLResponseBody = "HTTP Body"; saml.SAMLResponseHeaders = "HTTP Headers";

If working in a framework that does not provide the raw HTTP request that contains the SAML response to the application, the SAMLResponseResponseContent can be set directly with the SAML response before calling the ProcessSAMLResponse or ParseSAMLResponse methods.

Once the HTTP request that contains the SAML response has been provided, the application can then call the ProcessSAMLResponse method. While the ProcessSAMLResponse method processes the SAML response, the class fires the SAMLResponse and Assertion events. These events can be used to provide the class the information needed to correctly verify the SAML response such as the SAMLRequestId and SAMLRequestIssuer properties that were saved after creating the SAML request. If the SAML response and assertion are valid, the method will return without any errors. Additionally, the SAMLResponseInfo, AssertionInfo, AssertionAttributeInfo, and AssertionAuthnInfo properties will be populated. saml.RequestIdentityMetadata("https://example.com/federationmetadata/federationmetadata.xml"); //Setup Service Provider URI acs = new URI(); acs.URIType = SAMLURITypes.sutACS; acs.Location = "https://service_provider.com/acs/"; acs.BindingType = URIBindings.subPost saml.ServiceProviderURIs.Add(acs); //Provide information about the SAML request. saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.Id = requestId; saml.ProcessSAMLResponse();

The ProcessSAMLResponse method performs multiple steps automatically, making it a simple method to handle the SAML response. The method is the equivalent to calling the ParseSAMLResponse, ValidateSAMLResponse, ParseAssertion, and ValidateAssertion methods. These methods can be used in place of calling ProcessSAMLResponse if there are additional considerations or extra control is needed by your application. saml.ParseSAMLResponse(); saml.ValidateSAMLResponse(); saml.ParseAssertion(); saml.ValidateAssertion();

Assertions

The SAML 2.0 specification gives Identity Providers many different options for what can be included in an assertion. In the Web SSO profile, typically the assertion will contain the Issuer, Signature, Subject, Conditions, AttributeStatement, and AuthnStatement. Information found from the Issuer, Signature, Subject, and Conditions sections of the assertion can be found in the AssertionInfo property. Along with providing information about the assertion, these fields are also used to verify the assertion. An important field to note is the AssertionSubjectNameId property. This property provides the unique identifier for the user which can be used for authorization purposes. See below for information about the AttributeStatement and AuthnStatement sections.

Assertion Authentication Context

The AuthnStatement section is used by the Identity Provider to provide the Service Provider with information about its authentication session with the user. The statement is parsed to the AssertionAuthnInfo property. Some commonly used information is how the user authenticated with the Identity Provider (see AssertionAuthnInfoContextClassReference) and the session identifier created by the Identity Provider for the Service Provider (see AssertionAuthnInfoSessionIndex).

Assertion Attributes

Along with the AssertionSubjectNameId, the Identity Provider may give additional information about the user in the AttributeStatement section. What exactly is provided depends on how the connection between the Identity Provider and Service Provider was configured. Since there is no defined list of attributes, the AssertionAttributeInfo properties will be populated with each attribute found. Each attribute has a name and one or more values. For example, take the following attribute that describes a list of emails attached to the user.

<Attribute Name="verified_emails"> <AttributeValue>email@test.com</AttributeValue> <AttributeValue>other@example.com</AttributeValue> </Attribute>

In this assertion attribute statement, the user has two emails that have been verified. There are two ways to get this information using the SAML class. First, using the collection, the application can iterate through the collection for the attribute and then iterate through the associated values. Using this method is useful if there are multiple acceptable names for the attributes that could be accepted. For example: List<string> verified_emails = new List<string>(); for (int i = 0; i < saml.AssertionAttributeInfo.Count; i++) { if (saml.AssertionAttributeInfo[i].Name == "verified_emails" || saml.AssertionAttributeInfo[i].Name == "verified_email") { for (int j = 0; j < saml.AssertionAttributeInfo[i].AttributeValueCount; j++) { saml.AssertionAttributeInfo[i].AttributeValueIndex = j; verified_emails.Add(saml.AssertionAttributeInfo[i].AttributeValueData); } } }

The other option is to use the GetAssertionAttribute method. This method will search the assertion's attribute statement for the first attribute with a matching name. Like in the example above, if the attribute has multiple values, the method will return them in a semicolon-separated list. This method simplifies the process of searching the collection for a specific attribute if the name of the attribute is known ahead of time. For example: string[] verified_emails = saml.GetAssertionAttribute("verified_emails").Split(';');

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

AssertionAttributeInfoCount Property (CloudSSO_SAML Class)

The number of records in the AssertionAttributeInfo arrays.

Object Oriented Interface

public function getAssertionAttributeInfoCount();
public function setAssertionAttributeInfoCount($value);

Procedural Interface

cloudsso_saml_get($res, 1 );
cloudsso_saml_set($res, 1, $value );

Default Value

0

Remarks

This property controls the size of the following arrays:

• AssertionAttributeInfoAttributeContent
• AssertionAttributeInfoAttributeValueCount
• AssertionAttributeInfoAttributeValueData
• AssertionAttributeInfoAttributeValueIndex
• AssertionAttributeInfoFriendlyName
• AssertionAttributeInfoName
• AssertionAttributeInfoNameFormat

The array indices start at 0 and end at AssertionAttributeInfoCount - 1.

This property is not available at design time.

Data Type

Integer

AssertionAttributeInfoAttributeContent Property (CloudSSO_SAML Class)

The raw XML of the attribute.

Object Oriented Interface

public function getAssertionAttributeInfoAttributeContent($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 2 , $assertionattributeinfoindex);

Default Value

''

Remarks

The raw XML of the attribute. In cases where the content of the attribute is complex, this property can be used to do additional XML parsing.

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoAttributeValueCount Property (CloudSSO_SAML Class)

In cases where there are multiple values for a single attribute, this count will be updated to reflect the size of the list.

Object Oriented Interface

public function getAssertionAttributeInfoAttributeValueCount($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 3 , $assertionattributeinfoindex);

Default Value

0

Remarks

In cases where there are multiple values for a single attribute, this count will be updated to reflect the size of the list. If the value of the attribute is not a list, the count will be set to 1. See AssertionAttributeValueIndex for more information.

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

Integer

AssertionAttributeInfoAttributeValueData Property (CloudSSO_SAML Class)

The content of the attribute value selected by AttributeValueIndex .

Object Oriented Interface

public function getAssertionAttributeInfoAttributeValueData($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 4 , $assertionattributeinfoindex);

Default Value

''

Remarks

The content of the attribute value selected by AssertionAttributeValueIndex.

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoAttributeValueIndex Property (CloudSSO_SAML Class)

The index of the attribute value that should be populated in the AttributeValueData property.

Object Oriented Interface

public function getAssertionAttributeInfoAttributeValueIndex($assertionattributeinfoindex);
public function setAssertionAttributeInfoAttributeValueIndex($assertionattributeinfoindex, $value);

Procedural Interface

cloudsso_saml_get($res, 5 , $assertionattributeinfoindex);
cloudsso_saml_set($res, 5, $value , $assertionattributeinfoindex);

Default Value

0

Remarks

The index of the attribute value that should be populated in the AssertionAttributeValueData property. Valid ranges for this property are from 0 to AssertionAttributeValueCount - 1. By default, this property is set to 0. In cases where there is only a singular value, that value will be at index 0. For example:

Multi-value attribute

<Attribute Name="ValueName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <AttributeValue>Value1</AttributeValue> <AttributeValue>Value2</AttributeValue> </Attribute>

Iterating through each value in an attribute

for (int i = 0; i < saml.AssertionAttributeInfo[0].AttributeValueCount; i++) { saml.AssertionAttributeInfo[0].AttributeValueIndex = i; string attribute_value = saml.AssertionAttributeInfo[0].AttributeValueData; //... the rest of the processing }

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is not available at design time.

Data Type

Integer

AssertionAttributeInfoFriendlyName Property (CloudSSO_SAML Class)

A human-readable version of the attribute name, if provided.

Object Oriented Interface

public function getAssertionAttributeInfoFriendlyName($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 6 , $assertionattributeinfoindex);

Default Value

''

Remarks

A human-readable version of the attribute name, if provided. This value is intended to be used for informational and logging purposes only.

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoName Property (CloudSSO_SAML Class)

The name of the attribute.

Object Oriented Interface

public function getAssertionAttributeInfoName($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 7 , $assertionattributeinfoindex);

Default Value

''

Remarks

The name of the attribute. The format of the name (if provided) can be found in the AssertionNameFormat property.

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAttributeInfoNameFormat Property (CloudSSO_SAML Class)

A URI reference to how the Name of the attribute is formatted.

Object Oriented Interface

public function getAssertionAttributeInfoNameFormat($assertionattributeinfoindex);

Procedural Interface

cloudsso_saml_get($res, 8 , $assertionattributeinfoindex);

Default Value

''

Remarks

A URI reference to how the AssertionName of the attribute is formatted. If not set, Unspecified is used.

Some common values are:

The $assertionattributeinfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAttributeInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoCount Property (CloudSSO_SAML Class)

The number of records in the AssertionAuthnInfo arrays.

Object Oriented Interface

public function getAssertionAuthnInfoCount();
public function setAssertionAuthnInfoCount($value);

Procedural Interface

cloudsso_saml_get($res, 9 );
cloudsso_saml_set($res, 9, $value );

Default Value

0

Remarks

This property controls the size of the following arrays:

• AssertionAuthnInfoAuthenticatingAuthorites
• AssertionAuthnInfoAuthnInstant
• AssertionAuthnInfoContextClassReference
• AssertionAuthnInfoContextDeclaration
• AssertionAuthnInfoSessionExpiration
• AssertionAuthnInfoSessionIndex
• AssertionAuthnInfoStatementContent

The array indices start at 0 and end at AssertionAuthnInfoCount - 1.

This property is not available at design time.

Data Type

Integer

AssertionAuthnInfoAuthenticatingAuthorites Property (CloudSSO_SAML Class)

A semicolon-separated list of authorities involved with the current authentication context.

Object Oriented Interface

public function getAssertionAuthnInfoAuthenticatingAuthorites($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 10 , $assertionauthninfoindex);

Default Value

''

Remarks

A semicolon-separated list of authorities involved with the current authentication context. Typically, this list includes other parties involved with the authentication of the subject besides the issuer that issued the assertion.

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoAuthnInstant Property (CloudSSO_SAML Class)

The time at which the authentication took place.

Object Oriented Interface

public function getAssertionAuthnInfoAuthnInstant($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 11 , $assertionauthninfoindex);

Default Value

''

Remarks

The time at which the authentication took place.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoContextClassReference Property (CloudSSO_SAML Class)

A per-defined URI reference identifying an authentication context class that describes how authentication was provided.

Object Oriented Interface

public function getAssertionAuthnInfoContextClassReference($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 12 , $assertionauthninfoindex);

Default Value

''

Remarks

A per-defined URI reference identifying an authentication context class that describes how authentication was provided. For example, if the user used a password to perform authentication, this will be set to urn:oasis:names:tc:SAML:2.0:ac:classes:Password.

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoContextDeclaration Property (CloudSSO_SAML Class)

A description or URI that describes additional information about the authentication context past the ContextClassReference .

Object Oriented Interface

public function getAssertionAuthnInfoContextDeclaration($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 13 , $assertionauthninfoindex);

Default Value

''

Remarks

A description or URI that describes additional information about the authentication context past the AssertionContextClassReference. This provides more detail about the authentication process when provided by the Identity Provider.

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoSessionExpiration Property (CloudSSO_SAML Class)

The time at which the session between the principal and Identity Provider must be considered ended.

Object Oriented Interface

public function getAssertionAuthnInfoSessionExpiration($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 14 , $assertionauthninfoindex);

Default Value

''

Remarks

The time at which the session between the principal and Identity Provider must be considered ended.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoSessionIndex Property (CloudSSO_SAML Class)

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP).

Object Oriented Interface

public function getAssertionAuthnInfoSessionIndex($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 15 , $assertionauthninfoindex);

Default Value

''

Remarks

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP). It is common (but not required) to use this value as the session identifier between the user and the Service Provider (your application).

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAuthnInfoStatementContent Property (CloudSSO_SAML Class)

The raw XML of the Authn statement.

Object Oriented Interface

public function getAssertionAuthnInfoStatementContent($assertionauthninfoindex);

Procedural Interface

cloudsso_saml_get($res, 16 , $assertionauthninfoindex);

Default Value

''

Remarks

The raw XML of the Authn statement. Typically, this is used in cases to get additional information from the Authn statement that is not provided by the class.

The $assertionauthninfoindex parameter specifies the index of the item in the array. The size of the array is controlled by the AssertionAuthnInfoCount property.

This property is read-only and not available at design time.

Data Type

String

AssertionAssertionContent Property (CloudSSO_SAML Class)

The raw XML of the assertion.

Object Oriented Interface

public function getAssertionAssertionContent();
public function setAssertionAssertionContent($value);

Procedural Interface

cloudsso_saml_get($res, 17 );
cloudsso_saml_set($res, 17, $value );

Default Value

''

Remarks

The raw XML of the assertion. This property can be set to provide the assertion to the class for the ParseAssertion method to parse the assertion without the SAML response.

Data Type

Binary String

AssertionExpirationDate Property (CloudSSO_SAML Class)

When the assertion expires.

Object Oriented Interface

public function getAssertionExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 18 );

Default Value

''

Remarks

When the assertion expires. This represents the NotOnOrAfter attribute of the Conditions element if the attribute is present in the assertion.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionId Property (CloudSSO_SAML Class)

The unique Id of the assertion generated by the identity provider.

Object Oriented Interface

public function getAssertionId();

Procedural Interface

cloudsso_saml_get($res, 19 );

Default Value

''

Remarks

The unique Id of the assertion generated by the identity provider. This is not an Id that is tied to a user but rather to the assertion itself.

This property is read-only.

Data Type

String

AssertionIsSigned Property (CloudSSO_SAML Class)

Whether the assertion has been signed by the identity provider.

Object Oriented Interface

public function getAssertionIsSigned();

Procedural Interface

cloudsso_saml_get($res, 20 );

Default Value

false

Remarks

Whether the assertion has been signed by the identity provider. This is set to true when the Signature element is present in the assertion.

This property is read-only.

Data Type

Boolean

AssertionIssuedTime Property (CloudSSO_SAML Class)

The time at which the assertion was issued by the Issuer (typically the identity provider).

Object Oriented Interface

public function getAssertionIssuedTime();

Procedural Interface

cloudsso_saml_get($res, 21 );

Default Value

''

Remarks

The time at which the assertion was issued by the AssertionIssuer (typically the identity provider). This property represents the IssueInstant attribute of the Assertion element.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionIssuer Property (CloudSSO_SAML Class)

The issuer of the assertion.

Object Oriented Interface

public function getAssertionIssuer();

Procedural Interface

cloudsso_saml_get($res, 22 );

Default Value

''

Remarks

The issuer of the assertion. Typically, this is the same as the identity provider that provided the SAML response. This property represents the Issuer element in the Assertion element.

This property is read-only.

Data Type

String

AssertionNotBeforeDate Property (CloudSSO_SAML Class)

The time at which the assertion becomes valid.

Object Oriented Interface

public function getAssertionNotBeforeDate();

Procedural Interface

cloudsso_saml_get($res, 23 );

Default Value

''

Remarks

The time at which the assertion becomes valid. If the current time is before this property, then the assertion is not considered valid yet. This represents the NotBefore attribute of the Conditions element if the attribute is present in the assertion.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

AssertionOneTimeUse Property (CloudSSO_SAML Class)

Whether the issuer only considers this information valid for this single instance.

Object Oriented Interface

public function getAssertionOneTimeUse();

Procedural Interface

cloudsso_saml_get($res, 24 );

Default Value

false

Remarks

Whether the issuer only considers this information valid for this single instance. The information saved here typically should not be cached or saved for future use. This represents the OneTimeUse element of the Conditions element if the element is present in the assertion.

This property is read-only.

Data Type

Boolean

AssertionSubjectNameId Property (CloudSSO_SAML Class)

The name identifier for the subject of the current assertion.

Object Oriented Interface

public function getAssertionSubjectNameId();

Procedural Interface

cloudsso_saml_get($res, 25 );

Default Value

''

Remarks

The name identifier for the subject of the current assertion. Typically, the subject is the user that is being authenticated. The format of this name Id can be found in the AssertionSubjectNameIdFormat property. This represents the NameId element of the Subject element if the element is present in the assertion.

This property is read-only.

Data Type

String

AssertionSubjectNameIdFormat Property (CloudSSO_SAML Class)

A URI reference to how the SubjectNameId of the element is formatted.

Object Oriented Interface

public function getAssertionSubjectNameIdFormat();

Procedural Interface

cloudsso_saml_get($res, 26 );

Default Value

''

Remarks

A URI reference to how the AssertionSubjectNameId of the element is formatted. If not set, Unspecified is used. This represents the Format attribute of the NameID element if the attribute is present in the assertion.

Some common values are:

This property is read-only.

Data Type

String

FirewallAutoDetect Property (CloudSSO_SAML Class)

Whether to automatically detect and use firewall system settings, if available.

Object Oriented Interface

public function getFirewallAutoDetect();
public function setFirewallAutoDetect($value);

Procedural Interface

cloudsso_saml_get($res, 27 );
cloudsso_saml_set($res, 27, $value );

Default Value

false

Remarks

Whether to automatically detect and use firewall system settings, if available.

Data Type

Boolean

FirewallType Property (CloudSSO_SAML Class)

The type of firewall to connect through.

Object Oriented Interface

public function getFirewallType();
public function setFirewallType($value);

Procedural Interface

cloudsso_saml_get($res, 28 );
cloudsso_saml_set($res, 28, $value );

Default Value

0

Remarks

The type of firewall to connect through. The applicable values are as follows:

Data Type

Integer

FirewallHost Property (CloudSSO_SAML Class)

The name or IP address of the firewall (optional).

Object Oriented Interface

public function getFirewallHost();
public function setFirewallHost($value);

Procedural Interface

cloudsso_saml_get($res, 29 );
cloudsso_saml_set($res, 29, $value );

Default Value

''

Remarks

The name or IP address of the firewall (optional). If a FirewallHost is given, the requested connections will be authenticated through the specified firewall when connecting.

If this property is set to a Domain Name, a DNS request is initiated. Upon successful termination of the request, this property is set to the corresponding address. If the search is not successful, the class fails with an error.

Data Type

String

FirewallPassword Property (CloudSSO_SAML Class)

A password if authentication is to be used when connecting through the firewall.

Object Oriented Interface

public function getFirewallPassword();
public function setFirewallPassword($value);

Procedural Interface

cloudsso_saml_get($res, 30 );
cloudsso_saml_set($res, 30, $value );

Default Value

''

Remarks

A password if authentication is to be used when connecting through the firewall. If FirewallHost is specified, the FirewallUser and FirewallPassword properties are used to connect and authenticate to the given firewall. If the authentication fails, the class fails with an error.

Data Type

String

FirewallPort Property (CloudSSO_SAML Class)

The Transmission Control Protocol (TCP) port for the firewall Host .

Object Oriented Interface

public function getFirewallPort();
public function setFirewallPort($value);

Procedural Interface

cloudsso_saml_get($res, 31 );
cloudsso_saml_set($res, 31, $value );

Default Value

0

Remarks

The Transmission Control Protocol (TCP) port for the firewall FirewallHost. See the description of the FirewallHost property for details.

Note: This property is set automatically when FirewallType is set to a valid value. See the description of the FirewallType property for details.

Data Type

Integer

FirewallUser Property (CloudSSO_SAML Class)

A username if authentication is to be used when connecting through a firewall.

Object Oriented Interface

public function getFirewallUser();
public function setFirewallUser($value);

Procedural Interface

cloudsso_saml_get($res, 32 );
cloudsso_saml_set($res, 32, $value );

Default Value

''

Remarks

A username if authentication is to be used when connecting through a firewall. If FirewallHost is specified, this property and the FirewallPassword property are used to connect and authenticate to the given Firewall. If the authentication fails, the class fails with an error.

Data Type

String

FollowRedirects Property (CloudSSO_SAML Class)

Determines what happens when the server issues a redirect.

Object Oriented Interface

public function getFollowRedirects();
public function setFollowRedirects($value);

Procedural Interface

cloudsso_saml_get($res, 33 );
cloudsso_saml_set($res, 33, $value );

Default Value

0

Remarks

This property determines what happens when the server issues a redirect. Normally, the class returns an error if the server responds with an "Object Moved" message. If this property is set to frAlways (1), the new URL for the object is retrieved automatically every time.

If this property is set to frSameScheme (2), the new URL is retrieved automatically only if the URLScheme is the same; otherwise, the class fails with an error.

Note: Following the HTTP specification, unless this property is set to frAlways (1), automatic redirects will be performed only for GET or HEAD requests. Other methods potentially could change the conditions of the initial request and create security vulnerabilities.

Furthermore, if either the new URL server or port are different from the existing one, User and Password are also reset to empty. If, however, this property is set to frAlways (1), the same credentials are used to connect to the new server.

A Redirect event is fired for every URL the product is redirected to. In the case of automatic redirections, the Redirect event is a good place to set properties related to the new connection (e.g., new authentication parameters).

The default value is frNever (0). In this case, redirects are never followed, and the class fails with an error instead.

Data Type

Integer

IdentityProviderEncryptingCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getIdentityProviderEncryptingCertStore();
public function setIdentityProviderEncryptingCertStore($value);

Procedural Interface

cloudsso_saml_get($res, 49 );
cloudsso_saml_set($res, 49, $value );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The IdentityProviderEncryptingCertStoreType property denotes the type of the certificate store specified by IdentityProviderEncryptingCertStore. If the store is password-protected, specify the password in IdentityProviderEncryptingCertStorePassword.

IdentityProviderEncryptingCertStore is used in conjunction with the IdentityProviderEncryptingCertSubject property to specify client certificates. If IdentityProviderEncryptingCertStore has a value, and IdentityProviderEncryptingCertSubject or IdentityProviderEncryptingCertEncoded is set, a search for a certificate is initiated. Please see the IdentityProviderEncryptingCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Binary String

IdentityProviderEncryptingCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getIdentityProviderEncryptingCertStorePassword();
public function setIdentityProviderEncryptingCertStorePassword($value);

Procedural Interface

cloudsso_saml_get($res, 50 );
cloudsso_saml_set($res, 50, $value );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

IdentityProviderEncryptingCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getIdentityProviderEncryptingCertStoreType();
public function setIdentityProviderEncryptingCertStoreType($value);

Procedural Interface

cloudsso_saml_get($res, 51 );
cloudsso_saml_set($res, 51, $value );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

IdentityProviderEncryptingCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getIdentityProviderEncryptingCertSubject();
public function setIdentityProviderEncryptingCertSubject($value);

Procedural Interface

cloudsso_saml_get($res, 59 );
cloudsso_saml_set($res, 59, $value );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

IdentityProviderEncryptingCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getIdentityProviderEncryptingCertEncoded();
public function setIdentityProviderEncryptingCertEncoded($value);

Procedural Interface

cloudsso_saml_get($res, 60 );
cloudsso_saml_set($res, 60, $value );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The IdentityProviderEncryptingCertStore and IdentityProviderEncryptingCertSubject properties also may be used to specify a certificate.

When IdentityProviderEncryptingCertEncoded is set, a search is initiated in the current IdentityProviderEncryptingCertStore for the private key of the certificate. If the key is found, IdentityProviderEncryptingCertSubject is updated to reflect the full subject of the selected certificate; otherwise, IdentityProviderEncryptingCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Binary String

IdentityProviderMetadataEntityId Property (CloudSSO_SAML Class)

The unique Id for the identity provider that is being described.

Object Oriented Interface

public function getIdentityProviderMetadataEntityId();
public function setIdentityProviderMetadataEntityId($value);

Procedural Interface

cloudsso_saml_get($res, 61 );
cloudsso_saml_set($res, 61, $value );

Default Value

''

Remarks

The unique Id for the identity provider that is being described. This is used for verification purposes when verifying the issuer of an SAML response or assertion.

Data Type

String

IdentityProviderMetadataExpirationDate Property (CloudSSO_SAML Class)

The expiration date of the Identity Provider description provided by the metadata document.

Object Oriented Interface

public function getIdentityProviderMetadataExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 62 );

Default Value

''

Remarks

The expiration date of the Identity Provider description provided by the metadata document. This represents the valid attribute of the IDPSSODescriptor element if the attribute is present in the document.

This property is read-only.

Data Type

String

IdentityProviderMetadataMetadataContent Property (CloudSSO_SAML Class)

The raw metadata for the identity provider.

Object Oriented Interface

public function getIdentityProviderMetadataMetadataContent();
public function setIdentityProviderMetadataMetadataContent($value);

Procedural Interface

cloudsso_saml_get($res, 63 );
cloudsso_saml_set($res, 63, $value );

Default Value

''

Remarks

The raw metadata for the identity provider. To avoid repeated requests to the Identity Provider, this value can be saved for later to be used with the LoadIdentityMetadata method.

Data Type

Binary String

IdentityProviderMetadataRequestsSignedAuthnRequests Property (CloudSSO_SAML Class)

Whether the identity provider requests that authentication (Authn) requests are signed.

Object Oriented Interface

public function getIdentityProviderMetadataRequestsSignedAuthnRequests();
public function setIdentityProviderMetadataRequestsSignedAuthnRequests($value);

Procedural Interface

cloudsso_saml_get($res, 64 );
cloudsso_saml_set($res, 64, $value );

Default Value

false

Remarks

Whether the identity provider requests that authentication (Authn) requests are signed.

Data Type

Boolean

IdentityProviderMetadataSignedMetadata Property (CloudSSO_SAML Class)

Whether the identity provider's parsed metadata is signed.

Object Oriented Interface

public function getIdentityProviderMetadataSignedMetadata();

Procedural Interface

cloudsso_saml_get($res, 65 );

Default Value

false

Remarks

Whether the identity provider's parsed metadata is signed.

This property is read-only.

Data Type

Boolean

IdentityProviderMetadataSupportedAttributeProfiles Property (CloudSSO_SAML Class)

A semicolon-separated list of attribute profiles supported by the identity provider.

Object Oriented Interface

public function getIdentityProviderMetadataSupportedAttributeProfiles();

Procedural Interface

cloudsso_saml_get($res, 66 );

Default Value

''

Remarks

A semicolon-separated list of attribute profiles supported by the identity provider.

Some common attribute profiles are:

• urn:oasis:names:tc:SAML:2.0:profiles:attribute:basic
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:UUID
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE
• urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML

This property is read-only.

Data Type

String

IdentityProviderMetadataSupportedAttributes Property (CloudSSO_SAML Class)

A semicolon-separated list of attributes supported by the identity provider as presented by the Identity Provider's metadata document.

Object Oriented Interface

public function getIdentityProviderMetadataSupportedAttributes();

Procedural Interface

cloudsso_saml_get($res, 67 );

Default Value

''

Remarks

A semicolon-separated list of attributes supported by the identity provider as presented by the Identity Provider's metadata document. This is a list of attributes that are explicitly supported by the Identity Provider but is not a full list of all the supported attributes. The list will contain the Name of each attribute found in the IDPSSODescriptor element.

This property is read-only.

Data Type

String

IdentityProviderMetadataSupportedNameIdFormats Property (CloudSSO_SAML Class)

The name identifier formats supported by the identity provider if provided by the metadata document.

Object Oriented Interface

public function getIdentityProviderMetadataSupportedNameIdFormats();

Procedural Interface

cloudsso_saml_get($res, 68 );

Default Value

''

Remarks

The name identifier formats supported by the identity provider if provided by the metadata document. Some common values are:

• Unspecified - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
• Email Address - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• Windows Domain Qualified Name - urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName

This property is read-only.

Data Type

String

IdentityProviderSigningCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getIdentityProviderSigningCertStore();
public function setIdentityProviderSigningCertStore($value);

Procedural Interface

cloudsso_saml_get($res, 84 );
cloudsso_saml_set($res, 84, $value );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The IdentityProviderSigningCertStoreType property denotes the type of the certificate store specified by IdentityProviderSigningCertStore. If the store is password-protected, specify the password in IdentityProviderSigningCertStorePassword.

IdentityProviderSigningCertStore is used in conjunction with the IdentityProviderSigningCertSubject property to specify client certificates. If IdentityProviderSigningCertStore has a value, and IdentityProviderSigningCertSubject or IdentityProviderSigningCertEncoded is set, a search for a certificate is initiated. Please see the IdentityProviderSigningCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Binary String

IdentityProviderSigningCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getIdentityProviderSigningCertStorePassword();
public function setIdentityProviderSigningCertStorePassword($value);

Procedural Interface

cloudsso_saml_get($res, 85 );
cloudsso_saml_set($res, 85, $value );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

IdentityProviderSigningCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getIdentityProviderSigningCertStoreType();
public function setIdentityProviderSigningCertStoreType($value);

Procedural Interface

cloudsso_saml_get($res, 86 );
cloudsso_saml_set($res, 86, $value );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

IdentityProviderSigningCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getIdentityProviderSigningCertSubject();
public function setIdentityProviderSigningCertSubject($value);

Procedural Interface

cloudsso_saml_get($res, 94 );
cloudsso_saml_set($res, 94, $value );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

IdentityProviderSigningCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getIdentityProviderSigningCertEncoded();
public function setIdentityProviderSigningCertEncoded($value);

Procedural Interface

cloudsso_saml_get($res, 95 );
cloudsso_saml_set($res, 95, $value );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The IdentityProviderSigningCertStore and IdentityProviderSigningCertSubject properties also may be used to specify a certificate.

When IdentityProviderSigningCertEncoded is set, a search is initiated in the current IdentityProviderSigningCertStore for the private key of the certificate. If the key is found, IdentityProviderSigningCertSubject is updated to reflect the full subject of the selected certificate; otherwise, IdentityProviderSigningCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Binary String

IdentityProviderURICount Property (CloudSSO_SAML Class)

The number of records in the IdentityProviderURI arrays.

Object Oriented Interface

public function getIdentityProviderURICount();
public function setIdentityProviderURICount($value);

Procedural Interface

cloudsso_saml_get($res, 96 );
cloudsso_saml_set($res, 96, $value );

Default Value

0

Remarks

This property controls the size of the following arrays:

• IdentityProviderURIBindingRef
• IdentityProviderURIBindingType
• IdentityProviderURIIndex
• IdentityProviderURIIsDefault
• IdentityProviderURILocation
• IdentityProviderURIType

The array indices start at 0 and end at IdentityProviderURICount - 1.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIBindingRef Property (CloudSSO_SAML Class)

The URI reference for the set BindingType .

Object Oriented Interface

public function getIdentityProviderURIBindingRef($identityprovideruriidx);
public function setIdentityProviderURIBindingRef($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 97 , $identityprovideruriidx);
cloudsso_saml_set($res, 97, $value , $identityprovideruriidx);

Default Value

''

Remarks

The URI reference for the set IdentityProviderURIBindingType. When the IdentityProviderURIBindingType is set, this property will be updated to match. The exception is the subCustom value, which allows for any value to be placed in this property.

If this property is set instead, the class will attempt to set the IdentityProviderURIBindingType property to match. If it can't, subCustom will also be used.

When parsing a metadata document, the class will also use the subCustom value for any binding types that are not recognized by the class.

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

String

IdentityProviderURIBindingType Property (CloudSSO_SAML Class)

The type of binding that is supported for this URI.

Object Oriented Interface

public function getIdentityProviderURIBindingType($identityprovideruriidx);
public function setIdentityProviderURIBindingType($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 98 , $identityprovideruriidx);
cloudsso_saml_set($res, 98, $value , $identityprovideruriidx);

Default Value

0

Remarks

The type of binding that is supported for this URI. The class only supports using the HTTP Redirect and HTTP POST bindings. The HTTP Artifact and other bindings are informational, and support for them must be implemented directly.

When setting this property, the IdentityProviderURIBindingRef property will also be updated with the matching URI. The exception is the subCustom value, which allows for any value to be placed in the IdentityProviderURIBindingRef property.

If the IdentityProviderURIBindingRef property is set, during the processing of a metadata document the class will attempt to set this property as well with the matching value. If it can't, subCustom will be used instead.

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIIsDefault Property (CloudSSO_SAML Class)

Whether this URI is the default URI that should be used for the specific URIType and BindingType combination.

Object Oriented Interface

public function getIdentityProviderURIIsDefault($identityprovideruriidx);
public function setIdentityProviderURIIsDefault($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 99 , $identityprovideruriidx);
cloudsso_saml_set($res, 99, $value , $identityprovideruriidx);

Default Value

false

Remarks

Whether this URI is the default URI that should be used for the specific IdentityProviderURIURIType and IdentityProviderURIBindingType combination.

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Boolean

IdentityProviderURILocation Property (CloudSSO_SAML Class)

The address of the URI.

Object Oriented Interface

public function getIdentityProviderURILocation($identityprovideruriidx);
public function setIdentityProviderURILocation($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 100 , $identityprovideruriidx);
cloudsso_saml_set($res, 100, $value , $identityprovideruriidx);

Default Value

''

Remarks

The address of the URI.

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

String

IdentityProviderURIIndex Property (CloudSSO_SAML Class)

The index for the URI that can be optionally used if multiple URIs of the same URIType and BindingType are provided.

Object Oriented Interface

public function getIdentityProviderURIIndex($identityprovideruriidx);
public function setIdentityProviderURIIndex($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 101 , $identityprovideruriidx);
cloudsso_saml_set($res, 101, $value , $identityprovideruriidx);

Default Value

0

Remarks

The index for the URI that can be optionally used if multiple URIs of the same IdentityProviderURIURIType and IdentityProviderURIBindingType are provided.

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

IdentityProviderURIType Property (CloudSSO_SAML Class)

The purpose of the URI.

Object Oriented Interface

public function getIdentityProviderURIType($identityprovideruriidx);
public function setIdentityProviderURIType($identityprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 102 , $identityprovideruriidx);
cloudsso_saml_set($res, 102, $value , $identityprovideruriidx);

Default Value

0

Remarks

The purpose of the URI.

Possible values are:

The $identityprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the IdentityProviderURICount property.

This property is not available at design time.

Data Type

Integer

LogoutRequestBody Property (CloudSSO_SAML Class)

The HTTP body for a SAML logout request.

Object Oriented Interface

public function getLogoutRequestBody();
public function setLogoutRequestBody($value);

Procedural Interface

cloudsso_saml_get($res, 103 );
cloudsso_saml_set($res, 103, $value );

Default Value

''

Remarks

This property can be set before calling the ParseLogoutRequest or ProcessLogoutRequest methods to directly provide the HTTP body of a logout request that should be parsed or processed. If using the HTTP context, this property is populated with the HTTP body containing the logout request that was parsed from the HTTP context after calling ParseLogoutRequest or ProcessLogoutRequest.

Data Type

Binary String

LogoutRequestHeaders Property (CloudSSO_SAML Class)

The HTTP headers for a SAML logout request.

Object Oriented Interface

public function getLogoutRequestHeaders();
public function setLogoutRequestHeaders($value);

Procedural Interface

cloudsso_saml_get($res, 104 );
cloudsso_saml_set($res, 104, $value );

Default Value

''

Remarks

This property can be set before calling the ParseLogoutRequest or ProcessLogoutRequest methods to directly provide the HTTP headers that contain a logout request from the Identity Provider. If using the HTTP context, this property is populated with the HTTP headers that were parsed from the HTTP context after calling ParseLogoutRequest or ProcessLogoutRequest.

Data Type

String

LogoutRequestConsent Property (CloudSSO_SAML Class)

Whether consent from a principal was provided when this logout request was sent.

Object Oriented Interface

public function getLogoutRequestConsent();

Procedural Interface

cloudsso_saml_get($res, 105 );

Default Value

''

Remarks

Whether consent from a principal was provided when this logout request was sent. This typically is set to some URI reference that matches the method used by the Identity Provider to obtain consent from the principal (user).

Some common URI values are:

• Unspecified - urn:oasis:names:tc:SAML:2.0:consent:unspecified
• Obtained - urn:oasis:names:tc:SAML:2.0:consent:obtained
• Prior - urn:oasis:names:tc:SAML:2.0:consent:prior
• Implicit - urn:oasis:names:tc:SAML:2.0:consent:current-implicit
• Explicit - urn:oasis:names:tc:SAML:2.0:consent:current-explicit
• Unavailable - urn:oasis:names:tc:SAML:2.0:consent:unavailable
• Inapplicable - urn:oasis:names:tc:SAML:2.0:consent:inapplicable

This property is read-only.

Data Type

String

LogoutRequestDestination Property (CloudSSO_SAML Class)

A URI reference for the intended destination for this logout request.

Object Oriented Interface

public function getLogoutRequestDestination();

Procedural Interface

cloudsso_saml_get($res, 106 );

Default Value

''

Remarks

A URI reference for the intended destination for this logout request. This is useful to prevent malicious forwarding of requests to unintended recipients.

This property is read-only.

Data Type

String

LogoutRequestExpirationDate Property (CloudSSO_SAML Class)

When this logout request expires.

Object Oriented Interface

public function getLogoutRequestExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 107 );

Default Value

''

Remarks

When this logout request expires. This represents the NotOnOrAfter element in the LogoutRequest element if present in the request.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

LogoutRequestId Property (CloudSSO_SAML Class)

The unique Id for the logout request that was created by the Issuer .

Object Oriented Interface

public function getLogoutRequestId();

Procedural Interface

cloudsso_saml_get($res, 108 );

Default Value

''

Remarks

The unique Id for the logout request that was created by the LogoutRequestIssuer.

This property is read-only.

Data Type

String

LogoutRequestIssuedTime Property (CloudSSO_SAML Class)

The time at which the SAML response was issued by the Issuer .

Object Oriented Interface

public function getLogoutRequestIssuedTime();

Procedural Interface

cloudsso_saml_get($res, 109 );

Default Value

''

Remarks

The time at which the SAML response was issued by the LogoutRequestIssuer.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

LogoutRequestIssuer Property (CloudSSO_SAML Class)

The Entity Id of the issuer of the logout request.

Object Oriented Interface

public function getLogoutRequestIssuer();

Procedural Interface

cloudsso_saml_get($res, 110 );

Default Value

''

Remarks

The Entity Id of the issuer of the logout request. Typically, this will be the LogoutRequestEntityId of the Identity Provider.

This property is read-only.

Data Type

String

LogoutRequestNameId Property (CloudSSO_SAML Class)

The name identifier for the subject of the logout request.

Object Oriented Interface

public function getLogoutRequestNameId();

Procedural Interface

cloudsso_saml_get($res, 111 );

Default Value

''

Remarks

The name identifier for the subject of the logout request. This identifies the user that should be logged out of this application. The format of this identifier can be found in the LogoutRequestNameIdFormat property. This represents the NameId element of the LogoutRequest element.

This property is read-only.

Data Type

String

LogoutRequestNameIdFormat Property (CloudSSO_SAML Class)

A URI reference to how the NameId of the element is formatted.

Object Oriented Interface

public function getLogoutRequestNameIdFormat();

Procedural Interface

cloudsso_saml_get($res, 112 );

Default Value

''

Remarks

A URI reference to how the LogoutRequestNameId of the element is formatted. If not set, Unspecified is used. This represents the Format attribute of the NameID element if the attribute is present in the logout request.

Some common values are:

This property is read-only.

Data Type

String

LogoutRequestReason Property (CloudSSO_SAML Class)

The reason the Identity Provider sent the the logout request.

Object Oriented Interface

public function getLogoutRequestReason();

Procedural Interface

cloudsso_saml_get($res, 113 );

Default Value

''

Remarks

The reason the Identity Provider sent the the logout request. This represents the optional Reason element of the LogoutRequest element.

Some common values are:

This property is read-only.

Data Type

String

LogoutRequestRequestContent Property (CloudSSO_SAML Class)

The full XML of the SAML logout request after being parsed or processed by the class after calling ParseLogoutRequest or ProcessLogoutRequest .

Object Oriented Interface

public function getLogoutRequestRequestContent();
public function setLogoutRequestRequestContent($value);

Procedural Interface

cloudsso_saml_get($res, 114 );
cloudsso_saml_set($res, 114, $value );

Default Value

''

Remarks

The full XML of the SAML logout request after being parsed or processed by the class after calling ParseLogoutRequest or ProcessLogoutRequest. Optionally, this setting can be set to provide a logout request directly to the class to be used with the ParseLogoutRequest or ProcessLogoutRequest methods.

Data Type

Binary String

LogoutRequestSessionIndex Property (CloudSSO_SAML Class)

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP).

Object Oriented Interface

public function getLogoutRequestSessionIndex();

Procedural Interface

cloudsso_saml_get($res, 115 );

Default Value

''

Remarks

The unique identifier for a particular session established between the user (principal) and the Service Provider (SP), as provided by the Identity Provider (IdP). This index specifies the session that is being ended between the Identity Provider and your application.

This property is read-only.

Data Type

String

LogoutRequestSigned Property (CloudSSO_SAML Class)

Whether the SAML logout request is signed.

Object Oriented Interface

public function getLogoutRequestSigned();

Procedural Interface

cloudsso_saml_get($res, 116 );

Default Value

false

Remarks

Whether the SAML logout request is signed. If the logout request contains no signatures, this property will be set to false.

This property is read-only.

Data Type

Boolean

LogoutResponseBody Property (CloudSSO_SAML Class)

The HTTP body for a built logout response.

Object Oriented Interface

public function getLogoutResponseBody();

Procedural Interface

cloudsso_saml_get($res, 117 );

Default Value

''

Remarks

This property contains the generated HTTP body for the response that should be provided to the LogoutResponseURL if required by the selected binding. It is generated alongside the LogoutResponseURL property when calling BuildLogoutResponse.

This property is read-only.

Data Type

Binary String

LogoutResponseConsent Property (CloudSSO_SAML Class)

Whether consent from a principal (the user) was provided before building this response.

Object Oriented Interface

public function getLogoutResponseConsent();
public function setLogoutResponseConsent($value);

Procedural Interface

cloudsso_saml_get($res, 118 );
cloudsso_saml_set($res, 118, $value );

Default Value

0

Remarks

Whether consent from a principal (the user) was provided before building this response. This typically is set to some URI reference of the method that was used by the application to obtain consent from the principal. This setting specifically sets the Consent attribute in the LogoutResponse element in the logout response.

By default, the scidUnspecified value is used. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomConsent configuration setting will be used instead.

Data Type

Integer

LogoutResponseDestination Property (CloudSSO_SAML Class)

A URI reference for the intended destination for the logout response.

Object Oriented Interface

public function getLogoutResponseDestination();
public function setLogoutResponseDestination($value);

Procedural Interface

cloudsso_saml_get($res, 119 );
cloudsso_saml_set($res, 119, $value );

Default Value

''

Remarks

A URI reference for the intended destination for the logout response. This is useful to prevent malicious forwarding of responses to unintended recipients. If left blank and there is a URI with the LogoutResponseURIType sutLogout for the Identity Provider, then the class will use that as the destination.

Data Type

String

LogoutResponseId Property (CloudSSO_SAML Class)

A unique Id of the SAML logout response.

Object Oriented Interface

public function getLogoutResponseId();
public function setLogoutResponseId($value);

Procedural Interface

cloudsso_saml_get($res, 120 );
cloudsso_saml_set($res, 120, $value );

Default Value

''

Remarks

A unique Id of the SAML logout response.

When building a logout response using the BuildLogoutResponse method, the class will use this value for the Id attribute in the response. If left empty before building the response, the class will generate a new one.

Data Type

String

LogoutResponseInResponseTo Property (CloudSSO_SAML Class)

The Id of the SAML logout request that is being responded to.

Object Oriented Interface

public function getLogoutResponseInResponseTo();
public function setLogoutResponseInResponseTo($value);

Procedural Interface

cloudsso_saml_get($res, 121 );
cloudsso_saml_set($res, 121, $value );

Default Value

''

Remarks

The Id of the SAML logout request that is being responded to.

For an Identity Provider to validate the SAML response, the InResponseTo attribute needs to be set to the Id of the logout request that is being responded to. If left blank, the class will check the Id found in the LogoutResponseId property that is set after calling ParseLogoutRequest or ProcessLogoutRequest. If building a request that is not parsed by the class, this property will need to be set.

Data Type

String

LogoutResponseIssuedTime Property (CloudSSO_SAML Class)

The time at which the logout response will be issued.

Object Oriented Interface

public function getLogoutResponseIssuedTime();
public function setLogoutResponseIssuedTime($value);

Procedural Interface

cloudsso_saml_get($res, 122 );
cloudsso_saml_set($res, 122, $value );

Default Value

''

Remarks

The time at which the logout response will be issued. If not set, the class will use the current time.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

Data Type

String

LogoutResponseIssuer Property (CloudSSO_SAML Class)

The issuer for the logout request.

Object Oriented Interface

public function getLogoutResponseIssuer();
public function setLogoutResponseIssuer($value);

Procedural Interface

cloudsso_saml_get($res, 123 );
cloudsso_saml_set($res, 123, $value );

Default Value

''

Remarks

The issuer for the logout request. Typically, this should be set to the Service Provider's Entity Id that was configured with the Identity Provider for this application.

Data Type

String

LogoutResponseResponseBinding Property (CloudSSO_SAML Class)

The binding that will be used to send the response.

Object Oriented Interface

public function getLogoutResponseResponseBinding();
public function setLogoutResponseResponseBinding($value);

Procedural Interface

cloudsso_saml_get($res, 124 );
cloudsso_saml_set($res, 124, $value );

Default Value

0

Remarks

The binding that will be used to send the response.

By default, the class will use the srbHTTPRedirect binding which provides the SAMLResponse value through a query parameter. The srbHTTPRedirect binding will set just the LogoutResponseURL property.

If set to the srbHTTPPost binding, the SAMLResponse value is provided in an HTML body that should be used to make a form post request. This will set both the LogoutResponseURL and LogoutResponseBody properties.

Data Type

Integer

LogoutResponseSignResponse Property (CloudSSO_SAML Class)

Whether the logout response should be signed when using the BuildLogoutResponse method.

Object Oriented Interface

public function getLogoutResponseSignResponse();
public function setLogoutResponseSignResponse($value);

Procedural Interface

cloudsso_saml_get($res, 125 );
cloudsso_saml_set($res, 125, $value );

Default Value

false

Remarks

Whether the logout response should be signed when using the BuildLogoutResponse method. The class will use the certificate set in the ServiceProviderSigningCert property to sign the response.

Data Type

Boolean

LogoutResponseStatusCodes Property (CloudSSO_SAML Class)

A semicolon-separated list of status codes that should be added in the SAML response.

Object Oriented Interface

public function getLogoutResponseStatusCodes();
public function setLogoutResponseStatusCodes($value);

Procedural Interface

cloudsso_saml_get($res, 126 );
cloudsso_saml_set($res, 126, $value );

Default Value

''

Remarks

A semicolon-separated list of status codes that should be added in the SAML response. A compliant SAML response will always contain a top-level response with one of the following values.

After the top-level status code, second-level codes can also be included to provide additional information about the top-level status code. These second-level codes are also typically a URI reference like the top-level codes. For example, if the application was unable to find a currently authenticated user that matches the logout request's LogoutResponseNameId, this setting could be set to:

urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal

Sometimes, a message is also provided with the status. See LogoutResponseStatusMessage for more information.

Data Type

String

LogoutResponseStatusMessage Property (CloudSSO_SAML Class)

The message that should be provided in the status of the logout response.

Object Oriented Interface

public function getLogoutResponseStatusMessage();
public function setLogoutResponseStatusMessage($value);

Procedural Interface

cloudsso_saml_get($res, 127 );
cloudsso_saml_set($res, 127, $value );

Default Value

''

Remarks

The message that should be provided in the status of the logout response. This property needs to be set alongside LogoutResponseStatusCodes and can be used to provide more information about the status.

Data Type

String

LogoutResponseURL Property (CloudSSO_SAML Class)

The URL for SAML logout responses.

Object Oriented Interface

public function getLogoutResponseURL();

Procedural Interface

cloudsso_saml_get($res, 128 );

Default Value

''

Remarks

This property contains the generated URL to an identity provider for a logoff service. Depending on the binding used, the URL may contain the SAMLResponse parameter, or the LogoutResponseBody property will be populated to be sent along with the response. It is generated using the BuildLogoutResponse method.

This property is read-only.

Data Type

String

ProxyAuthScheme Property (CloudSSO_SAML Class)

The type of authorization to perform when connecting to the proxy.

Object Oriented Interface

public function getProxyAuthScheme();
public function setProxyAuthScheme($value);

Procedural Interface

cloudsso_saml_get($res, 129 );
cloudsso_saml_set($res, 129, $value );

Default Value

0

Remarks

The type of authorization to perform when connecting to the proxy. This is used only when the ProxyUser and ProxyPassword properties are set.

ProxyAuthScheme should be set to authNone (3) when no authentication is expected.

By default, ProxyAuthScheme is authBasic (0), and if the ProxyUser and ProxyPassword properties are set, the class will attempt basic authentication.

If ProxyAuthScheme is set to authDigest (1), digest authentication will be attempted instead.

If ProxyAuthScheme is set to authProprietary (2), then the authorization token will not be generated by the class. Look at the configuration file for the class being used to find more information about manually setting this token.

If ProxyAuthScheme is set to authNtlm (4), NTLM authentication will be used.

For security reasons, setting this property will clear the values of ProxyUser and ProxyPassword.

Data Type

Integer

ProxyAutoDetect Property (CloudSSO_SAML Class)

Whether to automatically detect and use proxy system settings, if available.

Object Oriented Interface

public function getProxyAutoDetect();
public function setProxyAutoDetect($value);

Procedural Interface

cloudsso_saml_get($res, 130 );
cloudsso_saml_set($res, 130, $value );

Default Value

false

Remarks

Whether to automatically detect and use proxy system settings, if available. The default value is false.

Data Type

Boolean

ProxyPassword Property (CloudSSO_SAML Class)

A password if authentication is to be used for the proxy.

Object Oriented Interface

public function getProxyPassword();
public function setProxyPassword($value);

Procedural Interface

cloudsso_saml_get($res, 131 );
cloudsso_saml_set($res, 131, $value );

Default Value

''

Remarks

A password if authentication is to be used for the proxy.

If ProxyAuthScheme is set to Basic Authentication, the ProxyUser and ProxyPassword properties are Base64 encoded and the proxy authentication token will be generated in the form Basic [encoded-user-password].

If ProxyAuthScheme is set to Digest Authentication, the ProxyUser and ProxyPassword properties are used to respond to the Digest Authentication challenge from the server.

If ProxyAuthScheme is set to NTLM Authentication, the ProxyUser and ProxyPassword properties are used to authenticate through NTLM negotiation.

Data Type

String

ProxyPort Property (CloudSSO_SAML Class)

The Transmission Control Protocol (TCP) port for the proxy Server (default 80).

Object Oriented Interface

public function getProxyPort();
public function setProxyPort($value);

Procedural Interface

cloudsso_saml_get($res, 132 );
cloudsso_saml_set($res, 132, $value );

Default Value

80

Remarks

The Transmission Control Protocol (TCP) port for the proxy ProxyServer (default 80). See the description of the ProxyServer property for details.

Data Type

Integer

ProxyServer Property (CloudSSO_SAML Class)

If a proxy Server is given, then the HTTP request is sent to the proxy instead of the server otherwise specified.

Object Oriented Interface

public function getProxyServer();
public function setProxyServer($value);

Procedural Interface

cloudsso_saml_get($res, 133 );
cloudsso_saml_set($res, 133, $value );

Default Value

''

Remarks

If a proxy ProxyServer is given, then the HTTP request is sent to the proxy instead of the server otherwise specified.

If the ProxyServer property is set to a domain name, a DNS request is initiated. Upon successful termination of the request, the ProxyServer property is set to the corresponding address. If the search is not successful, an error is returned.

Data Type

String

ProxySSL Property (CloudSSO_SAML Class)

When to use a Secure Sockets Layer (SSL) for the connection to the proxy.

Object Oriented Interface

public function getProxySSL();
public function setProxySSL($value);

Procedural Interface

cloudsso_saml_get($res, 134 );
cloudsso_saml_set($res, 134, $value );

Default Value

0

Remarks

When to use a Secure Sockets Layer (SSL) for the connection to the proxy. The applicable values are as follows:

Data Type

Integer

ProxyUser Property (CloudSSO_SAML Class)

A username if authentication is to be used for the proxy.

Object Oriented Interface

public function getProxyUser();
public function setProxyUser($value);

Procedural Interface

cloudsso_saml_get($res, 135 );
cloudsso_saml_set($res, 135, $value );

Default Value

''

Remarks

A username if authentication is to be used for the proxy.

If ProxyAuthScheme is set to Basic Authentication, the ProxyUser and ProxyPassword properties are Base64 encoded and the proxy authentication token will be generated in the form Basic [encoded-user-password].

If ProxyAuthScheme is set to Digest Authentication, the ProxyUser and ProxyPassword properties are used to respond to the Digest Authentication challenge from the server.

If ProxyAuthScheme is set to NTLM Authentication, the ProxyUser and ProxyPassword properties are used to authenticate through NTLM negotiation.

Data Type

String

RelayState Property (CloudSSO_SAML Class)

The RelayState for a SAML request or response.

Object Oriented Interface

public function getRelayState();
public function setRelayState($value);

Procedural Interface

cloudsso_saml_get($res, 136 );
cloudsso_saml_set($res, 136, $value );

Default Value

''

Remarks

When set before building a request using the BuildAuthnRequest and BuildLogoutRequest methods, this property will set the RelayState parameter that is provided with the SAML request. Any value may be specified here and it will be returned exactly as it was sent. This can be used to maintain state within the application, and also may be used for security purposes. The contents of this property are treated as an opaque value.

After calling ProcessSAMLResponse or ParseSAMLResponse on an HTTP request that contains a response from the Identity Provider, this setting will also be set to match the RelayState parameter if it was provided by the Identity Provider. This does not work if the SAML response was provided directly to the methods using the SAMLResponseInfo property.

Data Type

String

SAMLRequestBody Property (CloudSSO_SAML Class)

The HTTP body for a SAML request.

Object Oriented Interface

public function getSAMLRequestBody();

Procedural Interface

cloudsso_saml_get($res, 137 );

Default Value

''

Remarks

This property contains the generated HTTP body for the request that should be provided to the SAMLRequestURL if required by the selected binding. It is generated alongside the SAMLRequestURL property when calling BuildAuthnRequest or BuildLogoutRequest.

This property is read-only.

Data Type

Binary String

SAMLRequestAllowCreate Property (CloudSSO_SAML Class)

This setting is only used for authentication requests.

Object Oriented Interface

public function getSAMLRequestAllowCreate();
public function setSAMLRequestAllowCreate($value);

Procedural Interface

cloudsso_saml_get($res, 138 );
cloudsso_saml_set($res, 138, $value );

Default Value

false

Remarks

This setting is only used for authentication requests. It controls whether the class will set the AllowCreate attribute in the NameIDPolicy element that is specific to the AuthnRequest element. When set to true, this will inform the Identity Provider that it is allowed to create a new identifier to represent the principal. When set to false (default), the Identity Provider should only issue an assertion if an acceptable identifier is already created.

Data Type

Boolean

SAMLRequestConsent Property (CloudSSO_SAML Class)

This setting specifies whether consent from a principal was provided when this request was sent.

Object Oriented Interface

public function getSAMLRequestConsent();
public function setSAMLRequestConsent($value);

Procedural Interface

cloudsso_saml_get($res, 139 );
cloudsso_saml_set($res, 139, $value );

Default Value

0

Remarks

This setting specifies whether consent from a principal was provided when this request was sent. This typically is set to some URI reference that was used by the application to obtain consent from the principal (user). This setting specifically sets the Consent attribute in the AuthnRequest or LogoutRequest elements in a SAML request.

By default, the scidUnspecified value is used. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomConsent configuration setting will be used instead.

Data Type

Integer

SAMLRequestDestination Property (CloudSSO_SAML Class)

This setting specifies a URI reference for the intended destination for the SAML request.

Object Oriented Interface

public function getSAMLRequestDestination();
public function setSAMLRequestDestination($value);

Procedural Interface

cloudsso_saml_get($res, 140 );
cloudsso_saml_set($res, 140, $value );

Default Value

''

Remarks

This setting specifies a URI reference for the intended destination for the SAML request. This is useful to prevent malicious forwarding of responses to unintended recipients. If left blank the class will set this to match the endpoint selected by the class. See SAMLRequestUseDefaultEndpoint and SAMLRequestSelectedEndpoint for more information.

Data Type

String

SAMLRequestId Property (CloudSSO_SAML Class)

This setting specifies the unique Id of the SAML request.

Object Oriented Interface

public function getSAMLRequestId();
public function setSAMLRequestId($value);

Procedural Interface

cloudsso_saml_get($res, 141 );
cloudsso_saml_set($res, 141, $value );

Default Value

''

Remarks

This setting specifies the unique Id of the SAML request.

When building a SAML request using the BuildAuthnRequest or BuildLogoutRequest methods, the class will use this value for the Id attribute in the request. If left empty before building the request, the class will generate a new one.

When validating a SAML response or assertion, this property is used to provide the Id of the request to the class. The SAML response and assertion both have an InResponseTo attribute that needs to match this property. See SAMLRequestInResponseTo for more information. This is important, to check to ensure that the SAML response or assertion was in response to a request that was made by this application.

Due to needing the value for validation purposes this setting, (along with the SAMLRequestIssuer property) should be cached in a secure location for later. This Id should match the Id of the InResponseTo attribute of the matching SAMLResponse . Due to this, after BuildAuthnRequest or BuildLogoutRequest is used to create a request, this setting

Data Type

String

SAMLRequestIssuedTime Property (CloudSSO_SAML Class)

This setting sets the time at which the SAML request was issued.

Object Oriented Interface

public function getSAMLRequestIssuedTime();
public function setSAMLRequestIssuedTime($value);

Procedural Interface

cloudsso_saml_get($res, 142 );
cloudsso_saml_set($res, 142, $value );

Default Value

''

Remarks

This setting sets the time at which the SAML request was issued. If not set, the class will use the current time.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

Data Type

String

SAMLRequestIssuer Property (CloudSSO_SAML Class)

The issuer for the SAML request.

Object Oriented Interface

public function getSAMLRequestIssuer();
public function setSAMLRequestIssuer($value);

Procedural Interface

cloudsso_saml_get($res, 143 );
cloudsso_saml_set($res, 143, $value );

Default Value

''

Remarks

The issuer for the SAML request. Typically, this should be set to the Entity Id configured for the Identity Provider.

Data Type

String

SAMLRequestNameIdFormat Property (CloudSSO_SAML Class)

This setting is only used for authentication requests.

Object Oriented Interface

public function getSAMLRequestNameIdFormat();
public function setSAMLRequestNameIdFormat($value);

Procedural Interface

cloudsso_saml_get($res, 144 );
cloudsso_saml_set($res, 144, $value );

Default Value

0

Remarks

This setting is only used for authentication requests. If supported by the Identity Provider, this setting can be used to tailor the name identifier for the subject in the response to an authentication request.

By default, the snidUnspecified format will be used, which informs the Identity Provider to use whatever name identifier format they prefer. This setting specifically sets the Format attribute in the NameIDPolicy element in an authentication request. If a format needs to be used that is not listed here, the snidCustom value can be used instead. When set, the CustomNameIdFormat configuration setting will be used instead.

Data Type

Integer

SAMLRequestRequestBinding Property (CloudSSO_SAML Class)

This setting controls the binding that will be used to make the request.

Object Oriented Interface

public function getSAMLRequestRequestBinding();
public function setSAMLRequestRequestBinding($value);

Procedural Interface

cloudsso_saml_get($res, 145 );
cloudsso_saml_set($res, 145, $value );

Default Value

0

Remarks

This setting controls the binding that will be used to make the request.

By default, the class will use the srbHTTPRedirect binding which provides the SAMLRequest value through a query parameter. The srbHTTPRedirect binding will set just the SAMLRequestURL property.

If set to the srbHTTPPost binding, the SAMLRequest value is provided in an HTML body that should be used to make a form post request. This will set both the SAMLRequestURL and SAMLRequestBody properties.

Note: This setting does not control the binding of the response, just how the request will be made.

Data Type

Integer

SAMLRequestSelectedEndpoint Property (CloudSSO_SAML Class)

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider.

Object Oriented Interface

public function getSAMLRequestSelectedEndpoint();
public function setSAMLRequestSelectedEndpoint($value);

Procedural Interface

cloudsso_saml_get($res, 146 );
cloudsso_saml_set($res, 146, $value );

Default Value

-1

Remarks

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider. When building an Authn Request, the class will select the the ACS endpoint depending on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set to true, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, the class will use that index in the request. Otherwise, the class will select the first URI available in the ServiceProviderURIs properties.

Data Type

Integer

SAMLRequestSessionIndex Property (CloudSSO_SAML Class)

This setting only applies when building SAML logout requests.

Object Oriented Interface

public function getSAMLRequestSessionIndex();
public function setSAMLRequestSessionIndex($value);

Procedural Interface

cloudsso_saml_get($res, 147 );
cloudsso_saml_set($res, 147, $value );

Default Value

''

Remarks

This setting only applies when building SAML logout requests. SAMLRequestSessionIndex identifies the current session of the user that is being ended when the BuildLogoutRequest method is called. When the ProcessSAMLResponse or ParseAssertion methods are called, the SAMLRequestSessionIndex property will be set to the session index from the Identity Provider. Providing the session index with the logout request will typically cause the Identity Provider to send logout requests to all participating services that are also part of the session.

Data Type

String

SAMLRequestSignRequest Property (CloudSSO_SAML Class)

This setting controls whether the SAML request should be signed when using the BuildAuthnRequest or BuildLogoutRequest methods.

Object Oriented Interface

public function getSAMLRequestSignRequest();
public function setSAMLRequestSignRequest($value);

Procedural Interface

cloudsso_saml_get($res, 148 );
cloudsso_saml_set($res, 148, $value );

Default Value

false

Remarks

This setting controls whether the SAML request should be signed when using the BuildAuthnRequest or BuildLogoutRequest methods. The class will use the certificate set in the ServiceProviderSigningCert property to sign the request.

Data Type

Boolean

SAMLRequestUseDefaultEndpoint Property (CloudSSO_SAML Class)

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider.

Object Oriented Interface

public function getSAMLRequestUseDefaultEndpoint();
public function setSAMLRequestUseDefaultEndpoint($value);

Procedural Interface

cloudsso_saml_get($res, 149 );
cloudsso_saml_set($res, 149, $value );

Default Value

false

Remarks

This setting only applies to Authn Requests since there can be multiple Assertion Consumer Service (ACS) endpoints per service provider. When multiple ACS endpoints are available, a single endpoint can be selected as the default endpoint. When building an Authn Request, the class will select the the ACS endpoint depending on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set to true, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, then the class will use that index in the request. Otherwise, the class will select the first URI available in the ServiceProviderURIs properties.

Data Type

Boolean

SAMLRequestURL Property (CloudSSO_SAML Class)

The URL for SAML requests.

Object Oriented Interface

public function getSAMLRequestURL();

Procedural Interface

cloudsso_saml_get($res, 150 );

Default Value

''

Remarks

This property contains the generated URL to an identity provider for a sign-on or logoff service. Depending on the binding used, the URL may contain the SAMLRequest parameter, or the SAMLRequestBody property will be populated to be sent along with the request. It is generated using the BuildAuthnRequest or BuildLogoutRequest methods.

This property is read-only.

Data Type

String

SAMLResponseBody Property (CloudSSO_SAML Class)

The HTTP body for a SAML response.

Object Oriented Interface

public function getSAMLResponseBody();
public function setSAMLResponseBody($value);

Procedural Interface

cloudsso_saml_get($res, 151 );
cloudsso_saml_set($res, 151, $value );

Default Value

''

Remarks

This property can be set before calling the ParseSAMLResponse or ProcessSAMLResponse methods to directly provide the HTTP body of a SAML response that should be parsed or processed. If using the HTTP context, this property is populated with the HTTP body containing the SAML response that was parsed from the HTTP context after calling ParseSAMLResponse or ProcessSAMLResponse.

Data Type

Binary String

SAMLResponseHeaders Property (CloudSSO_SAML Class)

The HTTP headers for a SAML response.

Object Oriented Interface

public function getSAMLResponseHeaders();
public function setSAMLResponseHeaders($value);

Procedural Interface

cloudsso_saml_get($res, 152 );
cloudsso_saml_set($res, 152, $value );

Default Value

''

Remarks

This property can be set before calling the ParseSAMLResponse or ProcessSAMLResponse methods to directly provide the HTTP headers that contain a SAML response from the Identity Provider. If using the HTTP context, this property is populated with the HTTP headers that were parsed from the HTTP context after calling ParseSAMLResponse or ProcessSAMLResponse.

Data Type

String

SAMLResponseConsent Property (CloudSSO_SAML Class)

Whether consent from a principal was provided when this response was sent.

Object Oriented Interface

public function getSAMLResponseConsent();

Procedural Interface

cloudsso_saml_get($res, 153 );

Default Value

''

Remarks

Whether consent from a principal was provided when this response was sent. This typically is set to some URI reference that matches the method that was used by the application to obtain consent from the principal (user).

Some common URI values are:

• Unspecified - urn:oasis:names:tc:SAML:2.0:consent:unspecified
• Obtained - urn:oasis:names:tc:SAML:2.0:consent:obtained
• Prior - urn:oasis:names:tc:SAML:2.0:consent:prior
• Implicit - urn:oasis:names:tc:SAML:2.0:consent:current-implicit
• Explicit - urn:oasis:names:tc:SAML:2.0:consent:current-explicit
• Unavailable - urn:oasis:names:tc:SAML:2.0:consent:unavailable
• Inapplicable - urn:oasis:names:tc:SAML:2.0:consent:inapplicable

This property is read-only.

Data Type

String

SAMLResponseDestination Property (CloudSSO_SAML Class)

A URI reference for the intended destination for the SAML response.

Object Oriented Interface

public function getSAMLResponseDestination();

Procedural Interface

cloudsso_saml_get($res, 154 );

Default Value

''

Remarks

A URI reference for the intended destination for the SAML response. This is useful to prevent malicious forwarding of responses to unintended recipients.

This property is read-only.

Data Type

String

SAMLResponseInResponseTo Property (CloudSSO_SAML Class)

The Id of the SAML request that requested the Identity Provider to issue this SAML response.

Object Oriented Interface

public function getSAMLResponseInResponseTo();

Procedural Interface

cloudsso_saml_get($res, 155 );

Default Value

''

Remarks

The Id of the SAML request that requested the Identity Provider to issue this SAML response. The class validates this property against the original Id of the SAML request which SAMLResponseId should be set to.

This property is read-only.

Data Type

String

SAMLResponseIssuedTime Property (CloudSSO_SAML Class)

The time at which the SAML response was issued by the Issuer .

Object Oriented Interface

public function getSAMLResponseIssuedTime();

Procedural Interface

cloudsso_saml_get($res, 156 );

Default Value

''

Remarks

The time at which the SAML response was issued by the SAMLResponseIssuer.

Time-based values are specified by the SAML specification to be in UTC in the following format: YYYY-MM-DDTHH:mm:ss.sssZ

This property is read-only.

Data Type

String

SAMLResponseIssuer Property (CloudSSO_SAML Class)

The Entity Id of the issuer of the SAML response.

Object Oriented Interface

public function getSAMLResponseIssuer();

Procedural Interface

cloudsso_saml_get($res, 157 );

Default Value

''

Remarks

The Entity Id of the issuer of the SAML response. Typically, this will be the SAMLResponseEntityId of the Identity Provider.

This property is read-only.

Data Type

String

SAMLResponseResponseContent Property (CloudSSO_SAML Class)

The full XML of the SAML Response after being parsed or processed by the class after calling ParseSAMLResponse or ProcessSAMLResponse .

Object Oriented Interface

public function getSAMLResponseResponseContent();
public function setSAMLResponseResponseContent($value);

Procedural Interface

cloudsso_saml_get($res, 158 );
cloudsso_saml_set($res, 158, $value );

Default Value

''

Remarks

The full XML of the SAML Response after being parsed or processed by the class after calling ParseSAMLResponse or ProcessSAMLResponse. Optionally, this setting can be set to provide a SAML response directly to the class to be used with the ParseSAMLResponse or ProcessSAMLResponse methods.

Data Type

Binary String

SAMLResponseResponseId Property (CloudSSO_SAML Class)

The unique Id for the SAML response that was created by the Issuer .

Object Oriented Interface

public function getSAMLResponseResponseId();

Procedural Interface

cloudsso_saml_get($res, 159 );

Default Value

''

Remarks

The unique Id for the SAML response that was created by the SAMLResponseIssuer.

This property is read-only.

Data Type

String

SAMLResponseResponseType Property (CloudSSO_SAML Class)

The type of SAML response that was processed when calling ProcessSAMLResponse or manually parsed using the ParseSAMLResponse method.

Object Oriented Interface

public function getSAMLResponseResponseType();

Procedural Interface

cloudsso_saml_get($res, 160 );

Default Value

0

Remarks

The type of SAML response that was processed when calling ProcessSAMLResponse or manually parsed using the ParseSAMLResponse method.

This property is read-only.

Data Type

Integer

SAMLResponseSigned Property (CloudSSO_SAML Class)

Whether the SAML response is signed.

Object Oriented Interface

public function getSAMLResponseSigned();

Procedural Interface

cloudsso_saml_get($res, 161 );

Default Value

false

Remarks

Whether the SAML response is signed. If the SAML response contains no signatures, or only the assertion is signed, then this property will be set to false.

This property is read-only.

Data Type

Boolean

SAMLResponseStatusCodes Property (CloudSSO_SAML Class)

A semicolon-separated list of status codes found in the SAML response.

Object Oriented Interface

public function getSAMLResponseStatusCodes();

Procedural Interface

cloudsso_saml_get($res, 162 );

Default Value

''

Remarks

A semicolon-separated list of status codes found in the SAML response. A compliant SAML response will always contain a top-level response with one of the following values.

After the top-level status code, second-level codes can also be included to provide additional information about the top-level status code. These second-level codes are also typically a URI reference like the top-level codes. For example, if the Identity Provider was unable to authenticate the user, this setting could be set to:

urn:oasis:names:tc:SAML:2.0:status:Responder;urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

Sometimes, a message is also provided with the Status. See SAMLResponseStatusMessage for more information.

This property is read-only.

Data Type

String

SAMLResponseStatusMessage Property (CloudSSO_SAML Class)

The message that was provided in the status of the SAML response.

Object Oriented Interface

public function getSAMLResponseStatusMessage();

Procedural Interface

cloudsso_saml_get($res, 163 );

Default Value

''

Remarks

The message that was provided in the status of the SAML response. This property is set alongside the SAMLResponseStatusCodes and can be used to provide more information about the status.

This property is read-only.

Data Type

String

ServiceProviderMetadataAuthnRequestSigned Property (CloudSSO_SAML Class)

Whether the generated metadata document will inform the identity provider that this service provider will be sending signed requests.

Object Oriented Interface

public function getServiceProviderMetadataAuthnRequestSigned();
public function setServiceProviderMetadataAuthnRequestSigned($value);

Procedural Interface

cloudsso_saml_get($res, 164 );
cloudsso_saml_set($res, 164, $value );

Default Value

false

Remarks

Whether the generated metadata document will inform the identity provider that this service provider will be sending signed requests.

Data Type

Boolean

ServiceProviderMetadataEntityId Property (CloudSSO_SAML Class)

The Entity Id for this service provider.

Object Oriented Interface

public function getServiceProviderMetadataEntityId();
public function setServiceProviderMetadataEntityId($value);

Procedural Interface

cloudsso_saml_get($res, 165 );
cloudsso_saml_set($res, 165, $value );

Default Value

''

Remarks

The Entity Id for this service provider. This is the unique Id that will be used by the Identity Provider and should be unique to this service provider.

Data Type

String

ServiceProviderMetadataMetadataContent Property (CloudSSO_SAML Class)

The raw XML document that represents the metadata document for the configured service provider.

Object Oriented Interface

public function getServiceProviderMetadataMetadataContent();
public function setServiceProviderMetadataMetadataContent($value);

Procedural Interface

cloudsso_saml_get($res, 166 );
cloudsso_saml_set($res, 166, $value );

Default Value

''

Remarks

The raw XML document that represents the metadata document for the configured service provider. This property is populated when the BuildServiceMetadata method is used to generate a new document.

Data Type

Binary String

ServiceProviderMetadataSignedMetadata Property (CloudSSO_SAML Class)

Whether the class will sign the metadata document when it is being generated.

Object Oriented Interface

public function getServiceProviderMetadataSignedMetadata();
public function setServiceProviderMetadataSignedMetadata($value);

Procedural Interface

cloudsso_saml_get($res, 167 );
cloudsso_saml_set($res, 167, $value );

Default Value

false

Remarks

Whether the class will sign the metadata document when it is being generated. When the BuildServiceMetadata method is used to generate the metadata document, the class will use the ServiceProviderSigningCert property to sign the document.

Data Type

Boolean

ServiceProviderMetadataSupportedNameIdFormats Property (CloudSSO_SAML Class)

A semicolon-separated list of NameId formats that are supported by this service provider.

Object Oriented Interface

public function getServiceProviderMetadataSupportedNameIdFormats();
public function setServiceProviderMetadataSupportedNameIdFormats($value);

Procedural Interface

cloudsso_saml_get($res, 168 );
cloudsso_saml_set($res, 168, $value );

Default Value

''

Remarks

A semicolon-separated list of NameId formats that are supported by this service provider.

Some common values are:

To support both email addresses and Windows domain qualified name, this property would be set to:

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress;urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName

Data Type

String

ServiceProviderMetadataWantAssertionsSigned Property (CloudSSO_SAML Class)

Whether the metadata document will inform the identity provider that this service provider wants issued assertions to be signed.

Object Oriented Interface

public function getServiceProviderMetadataWantAssertionsSigned();
public function setServiceProviderMetadataWantAssertionsSigned($value);

Procedural Interface

cloudsso_saml_get($res, 169 );
cloudsso_saml_set($res, 169, $value );

Default Value

false

Remarks

Whether the metadata document will inform the identity provider that this service provider wants issued assertions to be signed.

Data Type

Boolean

ServiceProviderSigningCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getServiceProviderSigningCertStore();
public function setServiceProviderSigningCertStore($value);

Procedural Interface

cloudsso_saml_get($res, 185 );
cloudsso_saml_set($res, 185, $value );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The ServiceProviderSigningCertStoreType property denotes the type of the certificate store specified by ServiceProviderSigningCertStore. If the store is password-protected, specify the password in ServiceProviderSigningCertStorePassword.

ServiceProviderSigningCertStore is used in conjunction with the ServiceProviderSigningCertSubject property to specify client certificates. If ServiceProviderSigningCertStore has a value, and ServiceProviderSigningCertSubject or ServiceProviderSigningCertEncoded is set, a search for a certificate is initiated. Please see the ServiceProviderSigningCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is not available at design time.

Data Type

Binary String

ServiceProviderSigningCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getServiceProviderSigningCertStorePassword();
public function setServiceProviderSigningCertStorePassword($value);

Procedural Interface

cloudsso_saml_get($res, 186 );
cloudsso_saml_set($res, 186, $value );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is not available at design time.

Data Type

String

ServiceProviderSigningCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getServiceProviderSigningCertStoreType();
public function setServiceProviderSigningCertStoreType($value);

Procedural Interface

cloudsso_saml_get($res, 187 );
cloudsso_saml_set($res, 187, $value );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

This property is not available at design time.

Data Type

Integer

ServiceProviderSigningCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getServiceProviderSigningCertSubject();
public function setServiceProviderSigningCertSubject($value);

Procedural Interface

cloudsso_saml_get($res, 195 );
cloudsso_saml_set($res, 195, $value );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is not available at design time.

Data Type

String

ServiceProviderSigningCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getServiceProviderSigningCertEncoded();
public function setServiceProviderSigningCertEncoded($value);

Procedural Interface

cloudsso_saml_get($res, 196 );
cloudsso_saml_set($res, 196, $value );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The ServiceProviderSigningCertStore and ServiceProviderSigningCertSubject properties also may be used to specify a certificate.

When ServiceProviderSigningCertEncoded is set, a search is initiated in the current ServiceProviderSigningCertStore for the private key of the certificate. If the key is found, ServiceProviderSigningCertSubject is updated to reflect the full subject of the selected certificate; otherwise, ServiceProviderSigningCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Binary String

ServiceProviderURICount Property (CloudSSO_SAML Class)

The number of records in the ServiceProviderURI arrays.

Object Oriented Interface

public function getServiceProviderURICount();
public function setServiceProviderURICount($value);

Procedural Interface

cloudsso_saml_get($res, 197 );
cloudsso_saml_set($res, 197, $value );

Default Value

0

Remarks

This property controls the size of the following arrays:

• ServiceProviderURIBindingRef
• ServiceProviderURIBindingType
• ServiceProviderURIIndex
• ServiceProviderURIIsDefault
• ServiceProviderURILocation
• ServiceProviderURIType

The array indices start at 0 and end at ServiceProviderURICount - 1.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIBindingRef Property (CloudSSO_SAML Class)

The URI reference for the set BindingType .

Object Oriented Interface

public function getServiceProviderURIBindingRef($serviceprovideruriidx);
public function setServiceProviderURIBindingRef($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 198 , $serviceprovideruriidx);
cloudsso_saml_set($res, 198, $value , $serviceprovideruriidx);

Default Value

''

Remarks

The URI reference for the set ServiceProviderURIBindingType. When the ServiceProviderURIBindingType is set, this property will be updated to match. The exception is the subCustom value, which allows for any value to be placed in this property.

If this property is set instead, the class will attempt to set the ServiceProviderURIBindingType property to match. If it can't, subCustom will also be used.

When parsing a metadata document, the class will also use the subCustom value for any binding types that are not recognized by the class.

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

String

ServiceProviderURIBindingType Property (CloudSSO_SAML Class)

The type of binding that is supported for this URI.

Object Oriented Interface

public function getServiceProviderURIBindingType($serviceprovideruriidx);
public function setServiceProviderURIBindingType($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 199 , $serviceprovideruriidx);
cloudsso_saml_set($res, 199, $value , $serviceprovideruriidx);

Default Value

0

Remarks

The type of binding that is supported for this URI. The class only supports using the HTTP Redirect and HTTP POST bindings. The HTTP Artifact and other bindings are informational, and support for them must be implemented directly.

When setting this property, the ServiceProviderURIBindingRef property will also be updated with the matching URI. The exception is the subCustom value, which allows for any value to be placed in the ServiceProviderURIBindingRef property.

If the ServiceProviderURIBindingRef property is set, during the processing of a metadata document the class will attempt to set this property as well with the matching value. If it can't, subCustom will be used instead.

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIIsDefault Property (CloudSSO_SAML Class)

Whether this URI is the default URI that should be used for the specific URIType and BindingType combination.

Object Oriented Interface

public function getServiceProviderURIIsDefault($serviceprovideruriidx);
public function setServiceProviderURIIsDefault($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 200 , $serviceprovideruriidx);
cloudsso_saml_set($res, 200, $value , $serviceprovideruriidx);

Default Value

false

Remarks

Whether this URI is the default URI that should be used for the specific ServiceProviderURIURIType and ServiceProviderURIBindingType combination.

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Boolean

ServiceProviderURILocation Property (CloudSSO_SAML Class)

The address of the URI.

Object Oriented Interface

public function getServiceProviderURILocation($serviceprovideruriidx);
public function setServiceProviderURILocation($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 201 , $serviceprovideruriidx);
cloudsso_saml_set($res, 201, $value , $serviceprovideruriidx);

Default Value

''

Remarks

The address of the URI.

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

String

ServiceProviderURIIndex Property (CloudSSO_SAML Class)

The index for the URI that can be optionally used if multiple URIs of the same URIType and BindingType are provided.

Object Oriented Interface

public function getServiceProviderURIIndex($serviceprovideruriidx);
public function setServiceProviderURIIndex($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 202 , $serviceprovideruriidx);
cloudsso_saml_set($res, 202, $value , $serviceprovideruriidx);

Default Value

0

Remarks

The index for the URI that can be optionally used if multiple URIs of the same ServiceProviderURIURIType and ServiceProviderURIBindingType are provided.

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

ServiceProviderURIType Property (CloudSSO_SAML Class)

The purpose of the URI.

Object Oriented Interface

public function getServiceProviderURIType($serviceprovideruriidx);
public function setServiceProviderURIType($serviceprovideruriidx, $value);

Procedural Interface

cloudsso_saml_get($res, 203 , $serviceprovideruriidx);
cloudsso_saml_set($res, 203, $value , $serviceprovideruriidx);

Default Value

0

Remarks

The purpose of the URI.

Possible values are:

The $serviceprovideruriidx parameter specifies the index of the item in the array. The size of the array is controlled by the ServiceProviderURICount property.

This property is not available at design time.

Data Type

Integer

SSLAcceptServerCertEffectiveDate Property (CloudSSO_SAML Class)

The date on which this certificate becomes valid.

Object Oriented Interface

public function getSSLAcceptServerCertEffectiveDate();

Procedural Interface

cloudsso_saml_get($res, 204 );

Default Value

''

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLAcceptServerCertExpirationDate Property (CloudSSO_SAML Class)

The date on which the certificate expires.

Object Oriented Interface

public function getSSLAcceptServerCertExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 205 );

Default Value

''

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLAcceptServerCertExtendedKeyUsage Property (CloudSSO_SAML Class)

A comma-delimited list of extended key usage identifiers.

Object Oriented Interface

public function getSSLAcceptServerCertExtendedKeyUsage();

Procedural Interface

cloudsso_saml_get($res, 206 );

Default Value

''

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprint Property (CloudSSO_SAML Class)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertFingerprint();

Procedural Interface

cloudsso_saml_get($res, 207 );

Default Value

''

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprintSHA1 Property (CloudSSO_SAML Class)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertFingerprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 208 );

Default Value

''

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLAcceptServerCertFingerprintSHA256 Property (CloudSSO_SAML Class)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertFingerprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 209 );

Default Value

''

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLAcceptServerCertIssuer Property (CloudSSO_SAML Class)

The issuer of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertIssuer();

Procedural Interface

cloudsso_saml_get($res, 210 );

Default Value

''

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLAcceptServerCertPrivateKey Property (CloudSSO_SAML Class)

The private key of the certificate (if available).

Object Oriented Interface

public function getSSLAcceptServerCertPrivateKey();

Procedural Interface

cloudsso_saml_get($res, 211 );

Default Value

''

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLAcceptServerCertPrivateKey may be available but not exportable. In this case, SSLAcceptServerCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLAcceptServerCertPrivateKeyAvailable Property (CloudSSO_SAML Class)

Whether a PrivateKey is available for the selected certificate.

Object Oriented Interface

public function getSSLAcceptServerCertPrivateKeyAvailable();

Procedural Interface

cloudsso_saml_get($res, 212 );

Default Value

false

Remarks

Whether a SSLAcceptServerCertPrivateKey is available for the selected certificate. If SSLAcceptServerCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLAcceptServerCertPrivateKeyContainer Property (CloudSSO_SAML Class)

The name of the PrivateKey container for the certificate (if available).

Object Oriented Interface

public function getSSLAcceptServerCertPrivateKeyContainer();

Procedural Interface

cloudsso_saml_get($res, 213 );

Default Value

''

Remarks

The name of the SSLAcceptServerCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKey Property (CloudSSO_SAML Class)

The public key of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertPublicKey();

Procedural Interface

cloudsso_saml_get($res, 214 );

Default Value

''

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKeyAlgorithm Property (CloudSSO_SAML Class)

The textual description of the certificate's public key algorithm.

Object Oriented Interface

public function getSSLAcceptServerCertPublicKeyAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 215 );

Default Value

''

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLAcceptServerCertPublicKeyLength Property (CloudSSO_SAML Class)

The length of the certificate's public key (in bits).

Object Oriented Interface

public function getSSLAcceptServerCertPublicKeyLength();

Procedural Interface

cloudsso_saml_get($res, 216 );

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLAcceptServerCertSerialNumber Property (CloudSSO_SAML Class)

The serial number of the certificate encoded as a string.

Object Oriented Interface

public function getSSLAcceptServerCertSerialNumber();

Procedural Interface

cloudsso_saml_get($res, 217 );

Default Value

''

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLAcceptServerCertSignatureAlgorithm Property (CloudSSO_SAML Class)

The text description of the certificate's signature algorithm.

Object Oriented Interface

public function getSSLAcceptServerCertSignatureAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 218 );

Default Value

''

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLAcceptServerCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getSSLAcceptServerCertStore();
public function setSSLAcceptServerCertStore($value);

Procedural Interface

cloudsso_saml_get($res, 219 );
cloudsso_saml_set($res, 219, $value );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The SSLAcceptServerCertStoreType property denotes the type of the certificate store specified by SSLAcceptServerCertStore. If the store is password-protected, specify the password in SSLAcceptServerCertStorePassword.

SSLAcceptServerCertStore is used in conjunction with the SSLAcceptServerCertSubject property to specify client certificates. If SSLAcceptServerCertStore has a value, and SSLAcceptServerCertSubject or SSLAcceptServerCertEncoded is set, a search for a certificate is initiated. Please see the SSLAcceptServerCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

Data Type

Binary String

SSLAcceptServerCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getSSLAcceptServerCertStorePassword();
public function setSSLAcceptServerCertStorePassword($value);

Procedural Interface

cloudsso_saml_get($res, 220 );
cloudsso_saml_set($res, 220, $value );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Data Type

String

SSLAcceptServerCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getSSLAcceptServerCertStoreType();
public function setSSLAcceptServerCertStoreType($value);

Procedural Interface

cloudsso_saml_get($res, 221 );
cloudsso_saml_set($res, 221, $value );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

Data Type

Integer

SSLAcceptServerCertSubjectAltNames Property (CloudSSO_SAML Class)

Comma-separated lists of alternative subject names for the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertSubjectAltNames();

Procedural Interface

cloudsso_saml_get($res, 222 );

Default Value

''

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintMD5 Property (CloudSSO_SAML Class)

The MD5 hash of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertThumbprintMD5();

Procedural Interface

cloudsso_saml_get($res, 223 );

Default Value

''

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintSHA1 Property (CloudSSO_SAML Class)

The SHA-1 hash of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertThumbprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 224 );

Default Value

''

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertThumbprintSHA256 Property (CloudSSO_SAML Class)

The SHA-256 hash of the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertThumbprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 225 );

Default Value

''

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLAcceptServerCertUsage Property (CloudSSO_SAML Class)

The text description of UsageFlags .

Object Oriented Interface

public function getSSLAcceptServerCertUsage();

Procedural Interface

cloudsso_saml_get($res, 226 );

Default Value

''

Remarks

The text description of SSLAcceptServerCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLAcceptServerCertUsageFlags Property (CloudSSO_SAML Class)

The flags that show intended use for the certificate.

Object Oriented Interface

public function getSSLAcceptServerCertUsageFlags();

Procedural Interface

cloudsso_saml_get($res, 227 );

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLAcceptServerCertUsageFlags is a combination of the following flags:

Please see the SSLAcceptServerCertUsage property for a text representation of SSLAcceptServerCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLAcceptServerCertVersion Property (CloudSSO_SAML Class)

The certificate's version number.

Object Oriented Interface

public function getSSLAcceptServerCertVersion();

Procedural Interface

cloudsso_saml_get($res, 228 );

Default Value

''

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLAcceptServerCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getSSLAcceptServerCertSubject();
public function setSSLAcceptServerCertSubject($value);

Procedural Interface

cloudsso_saml_get($res, 229 );
cloudsso_saml_set($res, 229, $value );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

Data Type

String

SSLAcceptServerCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getSSLAcceptServerCertEncoded();
public function setSSLAcceptServerCertEncoded($value);

Procedural Interface

cloudsso_saml_get($res, 230 );
cloudsso_saml_set($res, 230, $value );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLAcceptServerCertStore and SSLAcceptServerCertSubject properties also may be used to specify a certificate.

When SSLAcceptServerCertEncoded is set, a search is initiated in the current SSLAcceptServerCertStore for the private key of the certificate. If the key is found, SSLAcceptServerCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLAcceptServerCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Binary String

SSLCertEffectiveDate Property (CloudSSO_SAML Class)

The date on which this certificate becomes valid.

Object Oriented Interface

public function getSSLCertEffectiveDate();

Procedural Interface

cloudsso_saml_get($res, 231 );

Default Value

''

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLCertExpirationDate Property (CloudSSO_SAML Class)

The date on which the certificate expires.

Object Oriented Interface

public function getSSLCertExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 232 );

Default Value

''

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLCertExtendedKeyUsage Property (CloudSSO_SAML Class)

A comma-delimited list of extended key usage identifiers.

Object Oriented Interface

public function getSSLCertExtendedKeyUsage();

Procedural Interface

cloudsso_saml_get($res, 233 );

Default Value

''

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLCertFingerprint Property (CloudSSO_SAML Class)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Object Oriented Interface

public function getSSLCertFingerprint();

Procedural Interface

cloudsso_saml_get($res, 234 );

Default Value

''

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLCertFingerprintSHA1 Property (CloudSSO_SAML Class)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Object Oriented Interface

public function getSSLCertFingerprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 235 );

Default Value

''

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLCertFingerprintSHA256 Property (CloudSSO_SAML Class)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Object Oriented Interface

public function getSSLCertFingerprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 236 );

Default Value

''

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLCertIssuer Property (CloudSSO_SAML Class)

The issuer of the certificate.

Object Oriented Interface

public function getSSLCertIssuer();

Procedural Interface

cloudsso_saml_get($res, 237 );

Default Value

''

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLCertPrivateKey Property (CloudSSO_SAML Class)

The private key of the certificate (if available).

Object Oriented Interface

public function getSSLCertPrivateKey();

Procedural Interface

cloudsso_saml_get($res, 238 );

Default Value

''

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLCertPrivateKey may be available but not exportable. In this case, SSLCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLCertPrivateKeyAvailable Property (CloudSSO_SAML Class)

Whether a PrivateKey is available for the selected certificate.

Object Oriented Interface

public function getSSLCertPrivateKeyAvailable();

Procedural Interface

cloudsso_saml_get($res, 239 );

Default Value

false

Remarks

Whether a SSLCertPrivateKey is available for the selected certificate. If SSLCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLCertPrivateKeyContainer Property (CloudSSO_SAML Class)

The name of the PrivateKey container for the certificate (if available).

Object Oriented Interface

public function getSSLCertPrivateKeyContainer();

Procedural Interface

cloudsso_saml_get($res, 240 );

Default Value

''

Remarks

The name of the SSLCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLCertPublicKey Property (CloudSSO_SAML Class)

The public key of the certificate.

Object Oriented Interface

public function getSSLCertPublicKey();

Procedural Interface

cloudsso_saml_get($res, 241 );

Default Value

''

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLCertPublicKeyAlgorithm Property (CloudSSO_SAML Class)

The textual description of the certificate's public key algorithm.

Object Oriented Interface

public function getSSLCertPublicKeyAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 242 );

Default Value

''

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLCertPublicKeyLength Property (CloudSSO_SAML Class)

The length of the certificate's public key (in bits).

Object Oriented Interface

public function getSSLCertPublicKeyLength();

Procedural Interface

cloudsso_saml_get($res, 243 );

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLCertSerialNumber Property (CloudSSO_SAML Class)

The serial number of the certificate encoded as a string.

Object Oriented Interface

public function getSSLCertSerialNumber();

Procedural Interface

cloudsso_saml_get($res, 244 );

Default Value

''

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLCertSignatureAlgorithm Property (CloudSSO_SAML Class)

The text description of the certificate's signature algorithm.

Object Oriented Interface

public function getSSLCertSignatureAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 245 );

Default Value

''

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getSSLCertStore();
public function setSSLCertStore($value);

Procedural Interface

cloudsso_saml_get($res, 246 );
cloudsso_saml_set($res, 246, $value );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The SSLCertStoreType property denotes the type of the certificate store specified by SSLCertStore. If the store is password-protected, specify the password in SSLCertStorePassword.

SSLCertStore is used in conjunction with the SSLCertSubject property to specify client certificates. If SSLCertStore has a value, and SSLCertSubject or SSLCertEncoded is set, a search for a certificate is initiated. Please see the SSLCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

Data Type

Binary String

SSLCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getSSLCertStorePassword();
public function setSSLCertStorePassword($value);

Procedural Interface

cloudsso_saml_get($res, 247 );
cloudsso_saml_set($res, 247, $value );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Data Type

String

SSLCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getSSLCertStoreType();
public function setSSLCertStoreType($value);

Procedural Interface

cloudsso_saml_get($res, 248 );
cloudsso_saml_set($res, 248, $value );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

Data Type

Integer

SSLCertSubjectAltNames Property (CloudSSO_SAML Class)

Comma-separated lists of alternative subject names for the certificate.

Object Oriented Interface

public function getSSLCertSubjectAltNames();

Procedural Interface

cloudsso_saml_get($res, 249 );

Default Value

''

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLCertThumbprintMD5 Property (CloudSSO_SAML Class)

The MD5 hash of the certificate.

Object Oriented Interface

public function getSSLCertThumbprintMD5();

Procedural Interface

cloudsso_saml_get($res, 250 );

Default Value

''

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertThumbprintSHA1 Property (CloudSSO_SAML Class)

The SHA-1 hash of the certificate.

Object Oriented Interface

public function getSSLCertThumbprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 251 );

Default Value

''

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertThumbprintSHA256 Property (CloudSSO_SAML Class)

The SHA-256 hash of the certificate.

Object Oriented Interface

public function getSSLCertThumbprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 252 );

Default Value

''

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLCertUsage Property (CloudSSO_SAML Class)

The text description of UsageFlags .

Object Oriented Interface

public function getSSLCertUsage();

Procedural Interface

cloudsso_saml_get($res, 253 );

Default Value

''

Remarks

The text description of SSLCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLCertUsageFlags Property (CloudSSO_SAML Class)

The flags that show intended use for the certificate.

Object Oriented Interface

public function getSSLCertUsageFlags();

Procedural Interface

cloudsso_saml_get($res, 254 );

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLCertUsageFlags is a combination of the following flags:

Please see the SSLCertUsage property for a text representation of SSLCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLCertVersion Property (CloudSSO_SAML Class)

The certificate's version number.

Object Oriented Interface

public function getSSLCertVersion();

Procedural Interface

cloudsso_saml_get($res, 255 );

Default Value

''

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getSSLCertSubject();
public function setSSLCertSubject($value);

Procedural Interface

cloudsso_saml_get($res, 256 );
cloudsso_saml_set($res, 256, $value );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

Data Type

String

SSLCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getSSLCertEncoded();
public function setSSLCertEncoded($value);

Procedural Interface

cloudsso_saml_get($res, 257 );
cloudsso_saml_set($res, 257, $value );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLCertStore and SSLCertSubject properties also may be used to specify a certificate.

When SSLCertEncoded is set, a search is initiated in the current SSLCertStore for the private key of the certificate. If the key is found, SSLCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLCertSubject is set to an empty string.

This property is not available at design time.

Data Type

Binary String

SSLProvider Property (CloudSSO_SAML Class)

The Secure Sockets Layer/Transport Layer Security (SSL/TLS) implementation to use.

Object Oriented Interface

public function getSSLProvider();
public function setSSLProvider($value);

Procedural Interface

cloudsso_saml_get($res, 258 );
cloudsso_saml_set($res, 258, $value );

Default Value

0

Remarks

This property specifies the SSL/TLS implementation to use. In most cases the default value of 0 (Automatic) is recommended and should not be changed. When set to 0 (Automatic), the class will select whether to use the platform implementation or the internal implementation depending on the operating system as well as the TLS version being used.

Possible values are as follows:

Additional Notes

In most cases using the default value (Automatic) is recommended. The class will select a provider depending on the current platform.

When Automatic is selected, on Windows, the class will use the platform implementation. On Linux/macOS, the class will use the internal implementation. When TLS 1.3 is enabled via SSLEnabledProtocols, the internal implementation is used on all platforms.

Data Type

Integer

SSLServerCertEffectiveDate Property (CloudSSO_SAML Class)

The date on which this certificate becomes valid.

Object Oriented Interface

public function getSSLServerCertEffectiveDate();

Procedural Interface

cloudsso_saml_get($res, 259 );

Default Value

''

Remarks

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

This property is read-only.

Data Type

String

SSLServerCertExpirationDate Property (CloudSSO_SAML Class)

The date on which the certificate expires.

Object Oriented Interface

public function getSSLServerCertExpirationDate();

Procedural Interface

cloudsso_saml_get($res, 260 );

Default Value

''

Remarks

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

This property is read-only.

Data Type

String

SSLServerCertExtendedKeyUsage Property (CloudSSO_SAML Class)

A comma-delimited list of extended key usage identifiers.

Object Oriented Interface

public function getSSLServerCertExtendedKeyUsage();

Procedural Interface

cloudsso_saml_get($res, 261 );

Default Value

''

Remarks

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

This property is read-only.

Data Type

String

SSLServerCertFingerprint Property (CloudSSO_SAML Class)

The hex-encoded, 16-byte MD5 fingerprint of the certificate.

Object Oriented Interface

public function getSSLServerCertFingerprint();

Procedural Interface

cloudsso_saml_get($res, 262 );

Default Value

''

Remarks

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

This property is read-only.

Data Type

String

SSLServerCertFingerprintSHA1 Property (CloudSSO_SAML Class)

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate.

Object Oriented Interface

public function getSSLServerCertFingerprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 263 );

Default Value

''

Remarks

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

This property is read-only.

Data Type

String

SSLServerCertFingerprintSHA256 Property (CloudSSO_SAML Class)

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate.

Object Oriented Interface

public function getSSLServerCertFingerprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 264 );

Default Value

''

Remarks

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

This property is read-only.

Data Type

String

SSLServerCertIssuer Property (CloudSSO_SAML Class)

The issuer of the certificate.

Object Oriented Interface

public function getSSLServerCertIssuer();

Procedural Interface

cloudsso_saml_get($res, 265 );

Default Value

''

Remarks

The issuer of the certificate. This property contains a string representation of the name of the issuing authority for the certificate.

This property is read-only.

Data Type

String

SSLServerCertPrivateKey Property (CloudSSO_SAML Class)

The private key of the certificate (if available).

Object Oriented Interface

public function getSSLServerCertPrivateKey();

Procedural Interface

cloudsso_saml_get($res, 266 );

Default Value

''

Remarks

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The SSLServerCertPrivateKey may be available but not exportable. In this case, SSLServerCertPrivateKey returns an empty string.

This property is read-only.

Data Type

String

SSLServerCertPrivateKeyAvailable Property (CloudSSO_SAML Class)

Whether a PrivateKey is available for the selected certificate.

Object Oriented Interface

public function getSSLServerCertPrivateKeyAvailable();

Procedural Interface

cloudsso_saml_get($res, 267 );

Default Value

false

Remarks

Whether a SSLServerCertPrivateKey is available for the selected certificate. If SSLServerCertPrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

This property is read-only.

Data Type

Boolean

SSLServerCertPrivateKeyContainer Property (CloudSSO_SAML Class)

The name of the PrivateKey container for the certificate (if available).

Object Oriented Interface

public function getSSLServerCertPrivateKeyContainer();

Procedural Interface

cloudsso_saml_get($res, 268 );

Default Value

''

Remarks

The name of the SSLServerCertPrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

This property is read-only.

Data Type

String

SSLServerCertPublicKey Property (CloudSSO_SAML Class)

The public key of the certificate.

Object Oriented Interface

public function getSSLServerCertPublicKey();

Procedural Interface

cloudsso_saml_get($res, 269 );

Default Value

''

Remarks

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

This property is read-only.

Data Type

String

SSLServerCertPublicKeyAlgorithm Property (CloudSSO_SAML Class)

The textual description of the certificate's public key algorithm.

Object Oriented Interface

public function getSSLServerCertPublicKeyAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 270 );

Default Value

''

Remarks

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLServerCertPublicKeyLength Property (CloudSSO_SAML Class)

The length of the certificate's public key (in bits).

Object Oriented Interface

public function getSSLServerCertPublicKeyLength();

Procedural Interface

cloudsso_saml_get($res, 271 );

Default Value

0

Remarks

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

This property is read-only.

Data Type

Integer

SSLServerCertSerialNumber Property (CloudSSO_SAML Class)

The serial number of the certificate encoded as a string.

Object Oriented Interface

public function getSSLServerCertSerialNumber();

Procedural Interface

cloudsso_saml_get($res, 272 );

Default Value

''

Remarks

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

This property is read-only.

Data Type

String

SSLServerCertSignatureAlgorithm Property (CloudSSO_SAML Class)

The text description of the certificate's signature algorithm.

Object Oriented Interface

public function getSSLServerCertSignatureAlgorithm();

Procedural Interface

cloudsso_saml_get($res, 273 );

Default Value

''

Remarks

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

This property is read-only.

Data Type

String

SSLServerCertStore Property (CloudSSO_SAML Class)

The name of the certificate store for the client certificate.

Object Oriented Interface

public function getSSLServerCertStore();

Procedural Interface

cloudsso_saml_get($res, 274 );

Default Value

'MY'

Remarks

The name of the certificate store for the client certificate.

The SSLServerCertStoreType property denotes the type of the certificate store specified by SSLServerCertStore. If the store is password-protected, specify the password in SSLServerCertStorePassword.

SSLServerCertStore is used in conjunction with the SSLServerCertSubject property to specify client certificates. If SSLServerCertStore has a value, and SSLServerCertSubject or SSLServerCertEncoded is set, a search for a certificate is initiated. Please see the SSLServerCertSubject property for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

This property is read-only.

Data Type

Binary String

SSLServerCertStorePassword Property (CloudSSO_SAML Class)

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

Object Oriented Interface

public function getSSLServerCertStorePassword();

Procedural Interface

cloudsso_saml_get($res, 275 );

Default Value

''

Remarks

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

This property is read-only.

Data Type

String

SSLServerCertStoreType Property (CloudSSO_SAML Class)

The type of certificate store for this certificate.

Object Oriented Interface

public function getSSLServerCertStoreType();

Procedural Interface

cloudsso_saml_get($res, 276 );

Default Value

0

Remarks

The type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This property can take one of the following values:

This property is read-only.

Data Type

Integer

SSLServerCertSubjectAltNames Property (CloudSSO_SAML Class)

Comma-separated lists of alternative subject names for the certificate.

Object Oriented Interface

public function getSSLServerCertSubjectAltNames();

Procedural Interface

cloudsso_saml_get($res, 277 );

Default Value

''

Remarks

Comma-separated lists of alternative subject names for the certificate.

This property is read-only.

Data Type

String

SSLServerCertThumbprintMD5 Property (CloudSSO_SAML Class)

The MD5 hash of the certificate.

Object Oriented Interface

public function getSSLServerCertThumbprintMD5();

Procedural Interface

cloudsso_saml_get($res, 278 );

Default Value

''

Remarks

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertThumbprintSHA1 Property (CloudSSO_SAML Class)

The SHA-1 hash of the certificate.

Object Oriented Interface

public function getSSLServerCertThumbprintSHA1();

Procedural Interface

cloudsso_saml_get($res, 279 );

Default Value

''

Remarks

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertThumbprintSHA256 Property (CloudSSO_SAML Class)

The SHA-256 hash of the certificate.

Object Oriented Interface

public function getSSLServerCertThumbprintSHA256();

Procedural Interface

cloudsso_saml_get($res, 280 );

Default Value

''

Remarks

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

This property is read-only.

Data Type

String

SSLServerCertUsage Property (CloudSSO_SAML Class)

The text description of UsageFlags .

Object Oriented Interface

public function getSSLServerCertUsage();

Procedural Interface

cloudsso_saml_get($res, 281 );

Default Value

''

Remarks

The text description of SSLServerCertUsageFlags.

This value will be one or more of the following strings and will be separated by commas:

• Digital Signature
• Non-Repudiation
• Key Encipherment
• Data Encipherment
• Key Agreement
• Certificate Signing
• CRL Signing
• Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

This property is read-only.

Data Type

String

SSLServerCertUsageFlags Property (CloudSSO_SAML Class)

The flags that show intended use for the certificate.

Object Oriented Interface

public function getSSLServerCertUsageFlags();

Procedural Interface

cloudsso_saml_get($res, 282 );

Default Value

0

Remarks

The flags that show intended use for the certificate. The value of SSLServerCertUsageFlags is a combination of the following flags:

Please see the SSLServerCertUsage property for a text representation of SSLServerCertUsageFlags.

This functionality currently is not available when the provider is OpenSSL.

This property is read-only.

Data Type

Integer

SSLServerCertVersion Property (CloudSSO_SAML Class)

The certificate's version number.

Object Oriented Interface

public function getSSLServerCertVersion();

Procedural Interface

cloudsso_saml_get($res, 283 );

Default Value

''

Remarks

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

This property is read-only.

Data Type

String

SSLServerCertSubject Property (CloudSSO_SAML Class)

The subject of the certificate used for client authentication.

Object Oriented Interface

public function getSSLServerCertSubject();

Procedural Interface

cloudsso_saml_get($res, 284 );

Default Value

''

Remarks

The subject of the certificate used for client authentication.

This property must be set after all other certificate properties are set. When this property is set, a search is performed in the current certificate store to locate a certificate with a matching subject.

If a matching certificate is found, the property is set to the full subject of the matching certificate.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

If a field value contains a comma, it must be quoted.

This property is read-only.

Data Type

String

SSLServerCertEncoded Property (CloudSSO_SAML Class)

The certificate (PEM/Base64 encoded).

Object Oriented Interface

public function getSSLServerCertEncoded();

Procedural Interface

cloudsso_saml_get($res, 285 );

Default Value

''

Remarks

The certificate (PEM/Base64 encoded). This property is used to assign a specific certificate. The SSLServerCertStore and SSLServerCertSubject properties also may be used to specify a certificate.

When SSLServerCertEncoded is set, a search is initiated in the current SSLServerCertStore for the private key of the certificate. If the key is found, SSLServerCertSubject is updated to reflect the full subject of the selected certificate; otherwise, SSLServerCertSubject is set to an empty string.

This property is read-only and not available at design time.

Data Type

Binary String

BuildAuthnRequest Method (CloudSSO_SAML Class)

Builds an Authentication Request.

Object Oriented Interface

public function doBuildAuthnRequest();

Procedural Interface

cloudsso_saml_do_buildauthnrequest($res);

Remarks

Using the SAMLRequestSettings, this method will build a SAML request meant for authenticating the current user. To help keep track of a user's state in your application, the RelayState property can be set to add a RelayState to the request. The value set in the RelayState property will then be present in the response from the Identity Provider.

The Assertion Consumer Service (ACS) that should handle the response specified in the request depends on how SAMLRequestSettings is configured. If SAMLRequestUseDefaultEndpoint is set, the request will specify that the Identity Provider should use the URI that is configured as the default. If SAMLRequestSelectedEndpoint is set, the class will use that index in the request. Otherwise, the class will select the first URI set in the ServiceProviderURIs properties.

After the request is built, the following properties are set depending on how the SAMLRequestRequestBinding property is set.

• HTTP Redirect - SAMLRequestURL
• HTTP Post - SAMLRequestURL, SAMLRequestBody

Example: Redirect Binding

saml.SAMLRequestSettings.Issuer = "ServiceProviderId"; saml.SAMLRequestSettings.RequestBinding = SAMLRequestBindings.srbHTTPRedirect; saml.SAMLRequestSettings.SignRequest = true; saml.RelayState = "https://service_provider.com/landing"; saml.BuildAuthnRequest(); string requestId = saml.SAMLRequestSettings.Id; //save for later

Example: HTML Post Binding

string htmlContent = $@" <!DOCTYPE html> <html> <head> <title>SAML POST</title> </head> <body onload='document.forms[0].submit()'> <form method='post' action='{saml.SAMLRequestURL}'> <input type='hidden' name='SAMLRequest' value='{saml.SAMLRequestBody}'/> <input type='hidden' name='RelayState' value='{saml.RelayState}'/> </form> </body> </html>";

BuildLogoutRequest Method (CloudSSO_SAML Class)

Builds a Single Logout request.

Object Oriented Interface

public function doBuildLogoutRequest($nameidentifier);

Procedural Interface

cloudsso_saml_do_buildlogoutrequest($res, $nameidentifier);

Remarks

This method uses the SAMLRequestSettings property to build a SAML logout request that is meant for logging out the user identified by the NameIdentifier parameter. To help keep track of a user's state in your application, the RelayState property can be set to add a RelayState to the request. The value set in the RelayState property will then be present in the response from the Identity Provider. Typically, if supported, the Identity Provider will also issue logout requests for all other sessions that are active for the user. If a user is part of an active session, the SAMLRequestSessionIndex setting can be used to provide the user's current session index to be included in the logout request.

After the request is built, the following properties are set depending on how the SAMLRequestRequestBinding property is set.

• HTTP Redirect - SAMLRequestURL
• HTTP Post - SAMLRequestURL, SAMLRequestBody

BuildLogoutResponse Method (CloudSSO_SAML Class)

Builds a Single Logout response.

Object Oriented Interface

public function doBuildLogoutResponse();

Procedural Interface

cloudsso_saml_do_buildlogoutresponse($res);

Remarks

This method uses the LogoutResponseSettings property to build a SAML logout response that is meant to respond to a logout request for a specific user.

After the request is built, the following properties are set depending on how the LogoutResponseResponseBinding property is set.

• HTTP Redirect - LogoutResponseURL
• HTTP Post - LogoutResponseURL, LogoutResponseBody

BuildServiceMetadata Method (CloudSSO_SAML Class)

Builds a metadata document for a service provider.

Object Oriented Interface

public function doBuildServiceMetadata();

Procedural Interface

cloudsso_saml_do_buildservicemetadata($res);

Remarks

This method uses the ServiceProviderMetadata property to create a new federation metadata document that describes the service provider. This is typically used to provide information about the service provider to the identity provider.

The following fields and properties are used:

• ServiceProviderMetadataAuthnRequestSigned
• ServiceProviderMetadataEntityId
• ServiceProviderMetadataSignedMetadata
• ServiceProviderMetadataSupportedNameIdFormats
• ServiceProviderMetadataWantAssertionsSigned
• ServiceProviderSigningCert
• ServiceProviderURIs

Config Method (CloudSSO_SAML Class)

Sets or retrieves a configuration setting.

Object Oriented Interface

public function doConfig($configurationstring);

Procedural Interface

cloudsso_saml_do_config($res, $configurationstring);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoEvents Method (CloudSSO_SAML Class)

This method processes events from the internal message queue.

Object Oriented Interface

public function doEvents();

Procedural Interface

cloudsso_saml_do_doevents($res);

Remarks

When DoEvents is called, the class processes any available events. If no events are available, it waits for a preset period of time, and then returns.

GetAssertionAttribute Method (CloudSSO_SAML Class)

Searches for a specific assertion attribute.

Object Oriented Interface

public function doGetAssertionAttribute($attrname);

Procedural Interface

cloudsso_saml_do_getassertionattribute($res, $attrname);

Remarks

This method will search the current AssertionAttributeInfo properties for a specific attribute. The attrName parameter should be set to the attribute name. The method will then return the value of the attribute with the matching name. If there is more than one value, it will return the values in a semicolon-separated list.

Interrupt Method (CloudSSO_SAML Class)

This method interrupts the current method.

Object Oriented Interface

public function doInterrupt();

Procedural Interface

cloudsso_saml_do_interrupt($res);

Remarks

If there is no method in progress, Interrupt simply returns, doing nothing.

LoadIdentityMetadata Method (CloudSSO_SAML Class)

Loads an identity provider's metadata document.

Object Oriented Interface

public function doLoadIdentityMetadata($metadatadocument, $validate);

Procedural Interface

cloudsso_saml_do_loadidentitymetadata($res, $metadatadocument, $validate);

Remarks

This method loads in the identity provider's metadata document that is provided through the metadataDocument parameter. After the document has been loaded, the IdentityProviderEncryptingCert, IdentityProviderMetadata, IdentityProviderSigningCert and IdentityProviderURIs properties will be set with the information that is available in the document. If the metadata document is signed and the validate parameter is true, the method will also validate the metadata document's signature.

ParseAssertion Method (CloudSSO_SAML Class)

Parses an assertion.

Object Oriented Interface

public function doParseAssertion();

Procedural Interface

cloudsso_saml_do_parseassertion($res);

Remarks

This method parses the assertion found in the AssertionInfo property. The assertion can either be manually set by setting the AssertionAssertionContent property or by first calling ParseSAMLResponse on a SAML response that contains an assertion. If the method is able to successfully parse the assertion, the AssertionInfo property is populated along with the AssertionAttributeInfo and AssertionAuthnInfo collections, once for each type of statement found in the assertion.

ParseLogoutRequest Method (CloudSSO_SAML Class)

Parses a SAML logout request.

Object Oriented Interface

public function doParseLogoutRequest();

Procedural Interface

cloudsso_saml_do_parselogoutrequest($res);

Remarks

This method parses the logout request found in the LogoutRequestInfo property or from the current HTTP request. The HTTP request containing the LogoutRequest parameter can be provided to the class either by setting the LogoutRequestBody and LogoutRequestHeaders properties or by accessing it from the current HTTP Context, if available.

The raw logout request can instead be provided directly to the class by setting the LogoutRequestRequestContent property. If the method is able to successfully parse the logout request, the information fields in the LogoutRequestInfo property are populated.

To validate a logout request, see ValidateLogoutRequest.

ParseSAMLResponse Method (CloudSSO_SAML Class)

Parses a SAML response.

Object Oriented Interface

public function doParseSAMLResponse();

Procedural Interface

cloudsso_saml_do_parsesamlresponse($res);

Remarks

This method parses the SAML response found in the SAMLResponseInfo property or from the current HTTP request. The HTTP request containing the SAMLResponse parameter can be provided to the class either by setting the SAMLResponseBody and SAMLResponseHeaders properties or by accessing it from the current HTTP Context, if available.

The raw SAML response can instead be provided directly to the class by setting the SAMLResponseResponseContent property. If the method is able to successfully parse the SAML response, the information fields in the SAMLResponseInfo property are populated.

To validate a SAML response, see ValidateSAMLResponse.

Additionally, if the SAMLResponseResponseType is srtAuthn, the AssertionAssertionContent property will be populated. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

ProcessLogoutRequest Method (CloudSSO_SAML Class)

Processes a SAML logout request.

Object Oriented Interface

public function doProcessLogoutRequest();

Procedural Interface

cloudsso_saml_do_processlogoutrequest($res);

Remarks

This method processes the logout request found in the LogoutRequestInfo property or from the current HTTP request.

The HTTP request containing the LogoutRequest parameter can be provided to the class either by setting the LogoutRequestBody and LogoutRequestHeaders properties or by accessing it from the current HTTP Context, if available. The HTTP request is taken directly from the LogoutRequestHeaders and LogoutRequestBody properties if set; otherwise, it will try to read the HTTP context.

The raw logout request can instead be provided directly to the class by setting the LogoutRequestRequestContent property. If the method is able to successfully parse the logout request, the information fields in the LogoutRequestInfo property are populated.

The method is equivalent to calling the following methods. See the specific methods for more information.

• ParseLogoutRequest
• ValidateLogoutRequest

ProcessSAMLResponse Method (CloudSSO_SAML Class)

Processes a SAML response.

Object Oriented Interface

public function doProcessSAMLResponse();

Procedural Interface

cloudsso_saml_do_processsamlresponse($res);

Remarks

This method processes the SAML response found in the SAMLResponseInfo property or from the current HTTP request. If the SAMLResponse object contains an assertion, the class will automatically process the assertion as well.

The HTTP request containing the SAMLResponse parameter can be provided to the class either by setting the SAMLResponseBody and SAMLResponseHeaders properties or by accessing it from the current HTTP Context, if available. The HTTP request is taken directly from the SAMLResponseHeaders and SAMLResponseBody properties if set; otherwise, it will try to read the HTTP context.

The raw SAML response can instead be provided directly to the class by setting the SAMLResponseResponseContent property. If the method is able to successfully parse the SAML response, the information fields in the SAMLResponseInfo property are populated.

The method is equivalent to calling the following methods. See the specific methods for more information.

• ParseSAMLResponse
• ValidateSAMLResponse
• ParseAssertion
• ValidateAssertion

RequestIdentityMetadata Method (CloudSSO_SAML Class)

Requests an identity provider's SAML metadata document.

Object Oriented Interface

public function doRequestIdentityMetadata($url);

Procedural Interface

cloudsso_saml_do_requestidentitymetadata($res, $url);

Remarks

This method makes an HTTP GET request to get the Identity Provider metadata document from the URL location. Once the document has been retrieved, the method will parse and validate the metadata document. After the document has been parsed, the IdentityProviderEncryptingCert, IdentityProviderMetadata, IdentityProviderSigningCert, and IdentityProviderURIs properties will be populated with the information that is available in the document.

Reset Method (CloudSSO_SAML Class)

This method will reset the class.

Object Oriented Interface

public function doReset();

Procedural Interface

cloudsso_saml_do_reset($res);

Remarks

This method will reset the class's properties to their default values.

ValidateAssertion Method (CloudSSO_SAML Class)

Validates an assertion.

Object Oriented Interface

public function doValidateAssertion();

Procedural Interface

cloudsso_saml_do_validateassertion($res);

Remarks

This method validates the assertion found in the AssertionInfo property. If an assertion is validated properly, then the user of the application can be authenticated as the subject of the assertion. If the validation fails, then the user should not be authenticated to the application.

The assertion can either be manually set via the AssertionAssertionContent property or by first calling ParseSAMLResponse on a SAML response that contains an assertion. Before attempting this validation, the Assertion event provides an opportunity to configure the class to successfully validate the assertion. If the validation fails at any point, the method will throw an exception with the error code corresponding to the reason.

The following checks are performed on the assertion:

To skip certain checks, see AssertionValidationFlags.

ValidateLogoutRequest Method (CloudSSO_SAML Class)

Validates a SAML logout request.

Object Oriented Interface

public function doValidateLogoutRequest();

Procedural Interface

cloudsso_saml_do_validatelogoutrequest($res);

Remarks

This method validates a logout request. If a logout request is successfully validated, then the application should use the LogoutRequestNameId and LogoutRequestSessionIndex properties to logout the user from their current session with the application.

The logout request must first be parsed by calling the ParseLogoutRequest method. Before attempting validation, the LogoutRequest event provides an opportunity to configure the class to successfully validate the logout request.

The following checks are performed on the Logout Request:

To skip certain checks, see LogoutRequestValidationFlags. Note that this method does not validate the assertion if one is found within the SAML response. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

ValidateSAMLResponse Method (CloudSSO_SAML Class)

Validates a SAML response.

Object Oriented Interface

public function doValidateSAMLResponse();

Procedural Interface

cloudsso_saml_do_validatesamlresponse($res);

Remarks

This method validates a SAML response. If a SAML response is successfully validated and in response to an authentication request, then the assertion should be parsed and validated to finish the authentication process. If it is in response to a logout request, then the application should finish it's logout process for the user.

The SAML response must first be parsed by calling the ParseSAMLResponse method. Before attempting validation, the SAMLResponse event provides an opportunity to configure the class to successfully validate the SAML response.

The following checks are performed on the SAML response:

To skip certain checks, see SAMLResponseValidationFlags. Note that this method does not validate the assertion if one is found within the SAML response. See ValidateAssertion and ParseAssertion for more information on validating and parsing the assertion.

Assertion Event (CloudSSO_SAML Class)

Fired when an assertion is validated.

Object Oriented Interface

public function fireAssertion($param);

Procedural Interface

cloudsso_saml_register_callback($res, 1, array($this, 'fireAssertion'));

Parameter List

 'issuer'
 'inresponseto'

Remarks

This event is fired before an assertion is validated. The Issuer parameter is the Id of the entity that issued the assertion. The InResponseTo parameter is the Id of the SAMLRequest that requested the assertion. Note that these two parameters are found in the assertion and are not set in the IdentityProviderMetadataEntityId and SAMLRequestId properties respectively. This event allows certain settings to be configured before the validation checks happen to ensure the assertion is validated correctly. See ValidateAssertion for more information about the validation process.

Error Event (CloudSSO_SAML Class)

Fired when information is available about errors during data delivery.

Object Oriented Interface

public function fireError($param);

Procedural Interface

cloudsso_saml_register_callback($res, 2, array($this, 'fireError'));

Parameter List

 'errorcode'
 'description'

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

Log Event (CloudSSO_SAML Class)

Fired once for each log message.

Object Oriented Interface

public function fireLog($param);

Procedural Interface

cloudsso_saml_register_callback($res, 3, array($this, 'fireLog'));

Parameter List

 'loglevel'
 'message'
 'logtype'

Remarks

This event is fired once for each log message generated by the class. The verbosity is controlled by the LogLevel setting.

LogLevel indicates the level of message. Possible values are as follows:

The value 1 (Info) logs basic information, including the URL, HTTP version, and status details.

The value 2 (Verbose) logs additional information about the request and response.

The value 3 (Debug) logs the headers and body for both the request and response, as well as additional debug information (if any).

Message is the log entry.

LogType identifies the type of log entry. Possible values are as follows:

• "Info"
• "RequestHeaders"
• "ResponseHeaders"
• "RequestBody"
• "ResponseBody"
• "ProxyRequest"
• "ProxyResponse"
• "FirewallRequest"
• "FirewallResponse"

LogoutRequest Event (CloudSSO_SAML Class)

Fired when a logout request is validated.

Object Oriented Interface

public function fireLogoutRequest($param);

Procedural Interface

cloudsso_saml_register_callback($res, 4, array($this, 'fireLogoutRequest'));

Parameter List

 'issuer'

Remarks

This event is fired before the logout request is validated. This event allows certain settings to be configured before the validation checks happen to ensure the logout request is validated correctly. See ValidateLogoutRequest for more information about the validation process.

The Issuer parameter is the ID attribute parsed from the current logout request. When validating, the ID attribute needs to match the IdentityProviderMetadataEntityId property for validation to succeed. If there are multiple Identity Providers supported, this parameter allows you to configure the class for the specified Identity Provider before continuing with validation.

Redirect Event (CloudSSO_SAML Class)

Fired when a redirection is received from the server.

Object Oriented Interface

public function fireRedirect($param);

Procedural Interface

cloudsso_saml_register_callback($res, 5, array($this, 'fireRedirect'));

Parameter List

 'location'
 'accept'

Remarks

This event is fired in cases in which the client can decide whether or not to continue with the redirection process. The Accept parameter is always True by default, but if you do not want to follow the redirection, Accept may be set to False, in which case the class fails with an error. Location is the location to which the client is being redirected. Further control over redirection is provided in the FollowRedirects property.

SAMLResponse Event (CloudSSO_SAML Class)

Fired when a SAML response is validated.

Object Oriented Interface

public function fireSAMLResponse($param);

Procedural Interface

cloudsso_saml_register_callback($res, 6, array($this, 'fireSAMLResponse'));

Parameter List

 'issuer'
 'inresponseto'

Remarks

This event is fired before the SAML response is validated. This event allows certain settings to be configured before the validation checks happen to ensure the SAML response is validated correctly. See ValidateSAMLResponse for more information about the validation process.

The Issuer parameter is the ID attribute parsed from the current SAML response. When validating, the ID attribute needs to match the IdentityProviderMetadataEntityId property for validation to succeed. If there are multiple Identity Provider's supported, this parameter allows you to configure the component for the specified identity provider before continuing with validation.

The InResponseTo parameter is the InResponseTo attribute parsed from the current SAML response. When validating, the InResponseTo attribute needs to match the SAMLRequestId property for validation to succeed. If there are multiple outstanding requests, this parameter allows you to configure the component for the specified request before continuing with validation.

SSLServerAuthentication Event (CloudSSO_SAML Class)

Fired after the server presents its certificate to the client.

Object Oriented Interface

public function fireSSLServerAuthentication($param);

Procedural Interface

cloudsso_saml_register_callback($res, 7, array($this, 'fireSSLServerAuthentication'));

Parameter List

 'certencoded'
 'certsubject'
 'certissuer'
 'status'
 'accept'

Remarks

During this event, the client can decide whether or not to continue with the connection process. The Accept parameter is a recommendation on whether to continue or close the connection. This is just a suggestion: application software must use its own logic to determine whether or not to continue.

When Accept is False, Status shows why the verification failed (otherwise, Status contains the string OK). If it is decided to continue, you can override and accept the certificate by setting the Accept parameter to True.

SSLStatus Event (CloudSSO_SAML Class)

Fired when secure connection progress messages are available.

Object Oriented Interface

public function fireSSLStatus($param);

Procedural Interface

cloudsso_saml_register_callback($res, 8, array($this, 'fireSSLStatus'));

Parameter List

 'message'

Remarks

The event is fired for informational and logging purposes only. This event tracks the progress of the connection.

Config Settings (SAML Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

SAML Config Settings

HTTP Config Settings

TCPClient Config Settings

SSL Config Settings

Socket Config Settings

Base Config Settings

Trappable Errors (SAML Class)

SAML Errors

The class may also return one of the following error codes, which are inherited from other classes.

HTTP Errors

The class may also return one of the following error codes, which are inherited from other classes.

TCPClient Errors

SSL Errors

TCP/IP Errors