When the same Access Manager server hosts more than one SAML service provider and federate with another Access Manager acting as an identity provider for these service providers, Access Manager should send different sets of attributes in SAML 2.0 assertions to these service providers.
Perform the following steps to create multiple service providers on the same Access Manager host:
To create multiple service providers from the same identity provider metadata, manually modify the identity provider's metadata's entityID for each service provider. You can import the metadata text that was edited into the Access Manager configuration to create service providers with different entity IDs.
For more information about how to create a SAML 2.0 service provider, see Section 7.3.1, Creating a Trusted Service Provider for SAML 2.0.
In the Administration Console of the SAML 2.0 identity provider, click Devices > Identity Servers > Servers > Edit > SAML 2.0 > Service Provider > Options.
Set the SAML2_AVOID_AUDIENCE_RESTRICTION property to true. Setting this property to true avoids audience restriction in the SAML 2.0 assertion.
To avoid the spnamequalifier attribute in nameidentifier of the assertion, do the following:
Go to Access Manager Identity Server of the SAML 2.0 service provider and open the nidpconfig.properties file.
Linux: /opt/novell/nids/lib/webapp/WEB-INF/classes/nidpconfig.properties
Windows: Novell\Tomcat\webapps\nidp\WEB-INF\classes\nidpconfig.properties
Add the following:
SAML2_AVOID_SPNAMEQUALIFIER_TO = <entityID of the service provider>->true
For example, if you have configured three service provider and you want to avoid sending assertion to the service provider with entity ID "https://<service provider host>:<port>/nidp/saml2/metadata/spnameidentifier2" then add the following entry:
SAML2_AVOID_SPNAMEQUALIFIER_TO = https://< service provider host>:<port>/nidp/saml2/metadata/spnameidentifier1->true,https://< service provider host>:<port>/nidp/saml2/metadata/spnameidentifier2->true,https://< service provider host>:<port>/nidp/saml2/metadata/spnameidentifier3->true
Restart the Identity Server.
NOTE:This is possible only when the identity provider and service providers are deployed on Access Manager.