Generate a SAML Response

Implement the logic that is associated with the steps 5 and 6 in "Figure SAML 2.0 based SSO between LINE WORKS and the customer." The customer SSO system should issue an authorization code and redirect it to the LINE WORKS authentication system after handling its authentication and SSO processes.

Request URL {#saml-request-url}

It is "AssertionConsumerServiceURL" included in the SAML request passed when the LINE WORKS authentication system requests a login page.

Example) https://LINEWORKSAuthSystemURL/acs/mycompany.com

Caution

• As the ACS URL can change at any time depending on user environments and LINE WORKS's policies, you must use the "AssertionConsumerServiceURL" in the SAML request.

HTTP method {#saml-request-method}

POST

As the ProtocolBinding is "HTTP-POST" in the SAML request, you must use the POST method.

Request {#saml-request-parameter}

SAML response specification {#saml-request-response-body}

<?xml version="1.0" encoding="UTF-8"?><saml2p:Responsexmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID issued by the customer SSO system}"InResponseTo="{ID included in the SAML request }" IssueInstant="{SAML response creation date and time}" Version="2.0"><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\">          {Digital signature}</Signature><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></saml2p:Status><saml2:Assertionxmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="{ID issued by the customer SSO system}" IssueInstant="{SAML response creation date and time}" Version="2.0"><saml2:Subject>      <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">{User key of the logged-in user}</saml2:NameID>      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">        <saml2:SubjectConfirmationData InResponseTo="{ID included in the SAML request }" NotOnOrAfter="{SAML Response end date and time}" Recipient="{ACS URL}" />      </saml2:SubjectConfirmation>    </saml2:Subject>    <saml2:Conditions NotBefore="{Date and time when the SAML response becomes valid.}" NotOnOrAfter="{SAML response end date and time}">      <saml2:AudienceRestriction>        <saml2:Audience>{ACS URL}</saml2:Audience>      </saml2:AudienceRestriction>    </saml2:Conditions>    <saml2:AuthnStatement AuthnInstant="{Date and time when the SAML response is created }" SessionIndex="{ID issued by the customer SSO system}"SessionNotOnOrAfter="{LINE WORKS session expiration date and time}"></saml2:AuthnStatement>  </saml2:Assertion></saml2p:Response>

The elements are described in the following table.

Note

• LINE WORKS's session expires at SessionNotOnOrAfter. Note that it can be automatically extended according to LINE WORKS's policies.
• You can control SessionNotOnOrAfter in different ways, depending on the devices your users have.
• If SessionNotOnOrAfter is not specified, the default login retention period is set to 24 hours (web browser) and 30 days (mobile app and desktop app).
  * For the public APIs, the default retention period is 1 hour (web browser), 24 hours (mobile app), and 30 days (desktop app).

SAML response example {#saml-request-response-body-example}

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response	xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 	ID="aidalcbpncbpebcnglhhgkkbojkgbplhhhlecbjb" InResponseTo="gbggljimijodibeomaehmnmjniogjebpjckecbdg" IssueInstant="2018-02-14T10:39:05.956Z" Version="2.0">    <Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\">       {Digital Signature}    </Signature>    <saml2p:Status>        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />    </saml2p:Status>    <saml2:Assertion        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="pbfijmklioghpbickikmeanhemnmijnmchhibenb" IssueInstant="2018-02-14T10:39:05.956Z" Version="2.0">        <saml2:Subject>            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">admin@company.com</saml2:NameID>            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">                <saml2:SubjectConfirmationData InResponseTo="gbggljimijodibeomaehmnmjniogjebpjckecbdg" NotOnOrAfter="2018-02-14T10:44:05.956Z" Recipient="https://auth.worksmobile.com/acs/compay.com" />            </saml2:SubjectConfirmation>        </saml2:Subject>        <saml2:Conditions NotBefore="2018-02-14T10:39:05.956Z" NotOnOrAfter="2018-02-14T10:44:05.956Z">            <saml2:AudienceRestriction>                <saml2:Audience>https://auth.worksmobile.com/acs/company.com</saml2:Audience>            </saml2:AudienceRestriction>        </saml2:Conditions>        <saml2:AuthnStatement AuthnInstant="2018-02-14T10:39:05.956Z" SessionIndex="lepcacjgfnpciekmhhjbeljadfapemdoncmhlkol" SessionNotOnOrAfter="2018-02-15T10:39:05.956Z">        </saml2:AuthnStatement>    </saml2:Assertion></saml2p:Response>

Error codes associated with SAML response verification {#saml-request-response-error-code}

The following error codes can be returned after LINE WORKS verifies the SAML response.