Chapter 3. Identity provider integration system defaults

SSO initiation type

The Red Hat identity system (sso.redhat.com) supports Service Provider-initiated single sign-on. We do not support IdP-initiated single sign-on, and do not plan to add this.

SSO binding

Only POST is allowed for new IdPs.

Name ID

Red Hat expects an ID that will allow for unspecified identification of authenticating users. However it’s up to the customer to determine what identifier they wish to use. Commonly used IDs are a UUID, an email address, a username, etc.

Other required attributes

We do not require any other attributes to be provided for authenticating users.

ACS URL

This is provided by the Identity Provider Integration tool after a customer has completed the initial setup for their IdP. We will also provide a link to our SAML metadata URL that the customer can bind with if they so choose (this would allow for them to review the configured IdP in-depth).

Assertion Signing

We require that integrating customers sign their assertions. We require that a valid x509 certificate is provided during IdP configuration that can be used to verify the assertion signature.

Response/Assertion Encryption

Encryption is not currently enforced, but as long as a valid x509 is provided we will be able to decrypt responses/assertions.

Signing AuthN requests

Red Hat signs AuthN requests. We would encourage integrating parties to verify this signature. The key we use to do this will be discoverable in the SAML metadata that we provide (mentioned above, this will be presented after the IdP has been created).

Federated Logout

Red Hat does not currently support any federated logout options. Doing so would result in your users being logged out of both Red Hat as well as your company’s SSO if they were to “log out” of a Red Hat service or application.

Federated Logout

Red Hat does not currently support any federated logout options. Doing so would result in your users being logged out of both Red Hat as well as your company’s SSO if they were to “log out” of a Red Hat service or application.

Signatures

IdP integration validates signatures and requires that tokens must be signed.

PKCE

For enhanced scurity, use Proof Key for Code Exchange (PKCE), which is an extension to the OAuth 2.0 authorization code flow. Red Hat encourages that you use S256 as the PKCE method.