Upload Identity Provider's SAML Metadata to Unified Access Gateway

To configure SAML and SAML and Passthrough authentication methods in Horizon, you must upload the identity provider's SAML certificate metadata XML file to Unified Access Gateway (UAG). The upload allows UAG to trust the identity provider by verifying the signature of an assertion using the public key of the identity provider.

Prerequisites

You must have downloaded the SAML metadata XML file from the identity provider and saved this file to a computer you can access.

Procedure

1. In the Configure Manually section of the UAG Admin console, click Select.

2. In the Advanced Settings > Identity Bridging Settings section, select the Upload Identity Provider Metadata gearbox icon.

3. Enter the entity ID for the identity provider in the Entity ID text box.

   If you do not enter a value in the Entity ID text box, the identity provider name in the metadata file is parsed and used as the entity ID of the identity provider.

4. In the IDP Metadata section, click Select and browse to the location where you have saved the metadata file.

5. If the uploaded metadata supports HTTP Artifact binding, the additional settings IDP ARS URL, IDP URL thumbprints, and Trusted Certificates are displayed.

   • The IDP ARS URL is auto-populated from the uploaded metadata and cannot be edited directly.
   • Specify a thumbprint only if the IDP SSL server certificate is not issued by a trusted CA. For example, a self-signed certificate or a certificate issued by an internal CA. A thumbprint is of the format [alg=]xx:xx… where alg can be sha1, sha256 (default value), sha384, and sha512 and the xx are hexadecimal digits. Hash algorithm must meet the requirements specified for the minimum hash size. For example, sha1=C3 89 A2 19 DC 7A 48 2B 85 1C 81 EC 5E 8F 6A 3C 33 F2 95 C3, sha256=ad:5c:f1:48:47:94:7e:80:82:73:13:6c:83:52:b:e:78:ed:ff:50:23:56:a8:42:8a:d9:30:fc:3a:33:d6:c6:db, sha512=2221B24DC78018A8FAFF81B7AD348722390793DE8C0E5E5AA1D622BCC951D4DA5DBB1C76C79A258A7AFBD1727447151C90E1733E7E83A7D1D46ADF1A31C78496
   • Certificate thumbprint can be configured for certificate validation for the server's certificate returned in communication between Unified Access Gateway and IDP.

6. Select PEM as the certificate format type from the Encryption Certificate Type drop-down menu.

7. For the Private Key, click Select and browse to the location where you have saved the private key for the certificate in PEM format.

8. For the Certificate Chain, click Select and browse to the location where you have saved the certificate chain in PEM format.

9. To enable the Allow unencrypted SAML assertions option, turn on the toggle. If the toggle is turned off, unencrypted assertions are not allowed during SAML authentication.

10. To enable the Always force SAML auth function, turn on the toggle. When the toggle is turned on, it always forces the SAML auth page to be presented to the user when this Identity provider is used, provided the IDP is also configured to force SAML auth.

**Note:** When you enable the **Always force SAML auth** function, `SAML ForceAuthn="true"` is set as an attribute for the AuthnRequest to the IdP. The IdP is notified to ignore any previous security context while authenticating the user.

11. Click Save.

    The following message is displayed: Configuration is saved successfully.

    UAG shows the uploaded IDP metadata certificate details.

    Any unused IDP metadata can be deleted.

What to do next

Configure the Horizon settings on UAG for selecting the authentication method and choosing the required identity provider.