| Top | |
|
|
|
#define LASSO_LIB_HREF "urn:liberty:iff:2003-08"
Namespace for the elements specific to ID-FF 1.2 (not part of SAML 1.0)
#define LASSO_METADATA_HREF "urn:liberty:metadata:2003-08"
Namespace for ID-FF 1.2 metadatas.
#define LASSO_METADATA_PREFIX "md"
Preferred prefix for ID-FF 1.2 metadata namespace.
#define LASSO_SAML_ASSERTION_HREF "urn:oasis:names:tc:SAML:1.0:assertion"
Namespace for SAML 1.0 assertion elements.
#define LASSO_SAML_ASSERTION_PREFIX "saml"
Preferred prefix for assertion elements.
#define LASSO_SAML_PROTOCOL_HREF "urn:oasis:names:tc:SAML:1.0:protocol"
Namespace for SAML 1.0 protocol elements.
#define LASSO_SAML_PROTOCOL_PREFIX "samlp"
Preferred prefix for assertion elements.
#define LASSO_ECP_HREF "urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"
Namespace for FIXME
#define LASSO_ECP_PREFIX "ecp"
SAML 2 URN profile name for Enhanced Client & Proxy (ECP)
#define LASSO_LIB_MAJOR_VERSION_N 1
Major version of the ID-FF protocol supported.
#define LASSO_LIB_MINOR_VERSION_N 2
Minor version of the ID-FF protocol supported.
#define LASSO_SAML_MAJOR_VERSION_N 1
Major version number of the SAML specification used for ID-FF support in Lasso.
#define LASSO_SAML_MINOR_VERSION_N 1
Minor version number of the SAML specification used for ID-FF support in Lasso.
#define LASSO_LIB_NAMEID_POLICY_TYPE_NONE "none"
None policy for use in LassoLibAuthnRequest. It means an existing federation must be used and an error should be produced if none existed beforehand.
#define LASSO_LIB_NAMEID_POLICY_TYPE_ONE_TIME "onetime"
Onetime policy for use in LassoLibAuthnRequest. It means a federation must not be created between identity and service provider. A temporary name identifier should be used instead.
#define LASSO_LIB_NAMEID_POLICY_TYPE_FEDERATED "federated"
Federated policy for use in LassoLibAuthnRequest. It means a federation may be created between identity and service provider (if it didn't exist before).
#define LASSO_LIB_NAMEID_POLICY_TYPE_ANY "any"
Any policy for use in LassoLibAuthnRequest. It means a federation may be created if the principal agrees and it can fall back to onetime if he does not.
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_INTERNET_PROTOCOL
The Internet Protocol class is identified when a Principal is authenticated through the use of a provided IP address. Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_INTERNET_PROTOCOL_PASSWORD
The Internet Protocol Password class is identified when a Principal is authenticated through the use of a provided IP address, in addition to username/password. Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_MOBILE_ONE_FACTOR_UNREGISTERED
Reflects no mobile customer registration procedures and an authentication of the mobile device without requiring explicit end-user interaction. Again, this context authenticates only the device and never the user, it is useful when services other than the mobile operator want to add a secure device authentication to their authentication process.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_MOBILE_TWO_FACTOR_UNREGISTERED
Reflects no mobile customer registration procedures and a two-factor based authentication, such as secure device and user PIN. This context class is useful when a service other than the mobile operator wants to link their customer ID to a mobile supplied two-factor authentication service by capturing mobile phone data at enrollment.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_MOBILE_ONE_FACTOR_CONTRACT
Reflects mobile contract customer registration procedures and a single factor authentication. For example, a digital signing device with tamper resistant memory for key storage, such as the mobile MSISDN, but no required PIN or biometric for real-time user authentication.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_MOBILE_TWO_FACTOR_CONTRACT
Reflects mobile contract customer registration procedures and a two-factor based authentication. For example, a digital signing device with tamper resistant memory for key storage, such as a GSM SIM, that requires explicit proof of user identity and intent, such as a PIN or biometric.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_PASSWORD
The Password class is identified when a Principal authenticates to an identity provider through the presentation of a password over an unprotected HTTP session.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_PASSWORD_PROTECTED_TRANSPORT
The PasswordProtectedTransport class is identified when a Principal authenticates to an identity provider through the presentation of a password over a protected session.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_PREVIOUS_SESSION
The PreviousSession class is identified when a Principal had authenticated to an identity provider at some point in the past using any authentication context supported by that identity provider. Consequently, a subsequent authentication event that the identity provider will assert to the service provider may be significantly separated in time from the Principals current resource access request. The context for the previously authenticated session is explicitly not included in this context class because the user has not authenticated during this session, and so the mechanism that the user employed to authenticate in a previous session should not be used as part of a decision on whether to now allow access to a resource.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_SMARTCARD
The Smartcard class is identified when a Principal authenticates to an identity provider using a smartcard.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_SMARTCARD_PKI
The SmartcardPKI class is identified when a Principal authenticates to an identity provider through a two-factor authentication mechanism using a smartcard with enclosed private key and a PIN.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_SOFTWARE_PKI
The Software-PKI class is identified when a Principal uses an X.509 certificate stored in software to authenticate to the identity provider.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_CLASS_REF_TIME_SYNC_TOKEN
The TimeSyncToken class is identified when a Principal authenticates through a time synchronization token.
Source: Liberty ID-FF Authentication Context Specification v1.3
#define LASSO_LIB_AUTHN_CONTEXT_COMPARISON_EXACT "exact"
Ask for the exact authentication context.
#define LASSO_LIB_AUTHN_CONTEXT_COMPARISON_MINIMUM "minimum"
Ask for at least this authentication context.
#define LASSO_LIB_AUTHN_CONTEXT_COMPARISON_MAXIMUM "maximum"
Ask for at most this authentication context.
#define LASSO_LIB_AUTHN_CONTEXT_COMPARISON_BETTER "better"
Ask for a better authentication context than that.
#define LASSO_SAML_AUTHENTICATION_METHOD_PASSWORD "urn:oasis:names:tc:SAML:1.0:am:password"
The authentication was performed by means of a password.
#define LASSO_SAML_AUTHENTICATION_METHOD_KERBEROS "urn:ietf:rfc:1510"
The authentication was performed by means of the Kerberos protocol [RFC 1510], an instantiation of the Needham-Schroeder symmetric key authentication mechanism [Needham78].
#define LASSO_SAML_AUTHENTICATION_METHOD_SECURE_REMOTE_PASSWORD "urn:ietf:rfc:2945"
The authentication was performed by means of Secure Remote Password protocol as specified in [RFC 2945].
#define LASSO_SAML_AUTHENTICATION_METHOD_HARDWARE_TOKEN
The authentication was performed using some (unspecified) hardware token.
#define LASSO_SAML_AUTHENTICATION_METHOD_SMARTCARD_PKI "urn:ietf:rfc:2246"
The authentication was performed using either the SSL or TLS protocol with certificate-based client authentication. TLS is described in [RFC 2246].
#define LASSO_SAML_AUTHENTICATION_METHOD_SOFTWARE_PKI "urn:oasis:names:tc:SAML:1.0:am:X509-PKI"
The authentication was performed by some (unspecified) mechanism on a key authenticated by means of an X.509 PKI X.500. It may have been one of the mechanisms for which a more specific identifier has been defined below.
#define LASSO_SAML_AUTHENTICATION_METHOD_PGP "urn:oasis:names:tc:SAML:1.0:am:PGP"
The authentication was performed by some (unspecified) mechanism on a key authenticated by means of a PGP web of trust [PGP]. It may have been one of the mechanisms for which a more specific identifier has been defined below.
#define LASSO_SAML_AUTHENTICATION_METHODS_PKI "urn:oasis:names:tc:SAML:1.0:am:SPKI"
The authentication was performed by some (unspecified) mechanism on a key authenticated by means of a PGP web of trust [PGP]. It may have been one of the mechanisms for which a more specific identifier has been defined below.
#define LASSO_SAML_AUTHENTICATION_METHOD_XKMS "urn:oasis:names:tc:SAML:1.0:am:XKMS"
The authentication was performed by some (unspecified) mechanism on a key authenticated by means of a PGP web of trust [PGP]. It may have been one of the mechanisms for which a more specific identifier has been defined below.
#define LASSO_SAML_AUTHENTICATION_METHOD_XMLD_SIG "urn:ietf:rfc:3075"
The authentication was performed by means of an XML digital signature [RFC 3075].
#define LASSO_SAML_AUTHENTICATION_METHOD_UNSPECIFIED
The authentication was performed by an unspecified means.
#define LASSO_SAML_AUTHENTICATION_METHOD_LIBERTY "urn:liberty:ac:2003-08"
The authentication was performed by a liberty alliance protocol.
#define LASSO_LIB_STATUS_CODE_FEDERATION_DOES_NOT_EXIST "lib:FederationDoesNotExist"
Second level status code.
Used by an identity provider to indicate that the Principal has not federated his or her identity with the service provider, and the service provider indicated a requirement for federation.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_INVALID_ASSERTION_CONSUMER_SERVICE_INDEX
Second level status code.
If the <AssertionConsumerServiceID> element is provided, then the identity provider MUST search for the value among the id attributes in the <AssertionConsumerServiceURL> elements in the provider’s meta- data to determine the URL to use. If no match can be found, then the provider MUST return an error with a second-level <samlp:StatusCode> of lib:InvalidAssertionConsumerServiceIndex to the default URL (the <AssertionConsumerServiceURL> with an isDefault attribute of "true").
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_INVALID_SIGNATURE "lib:InvalidSignature"
Second level status code.
Indicate a failure in the processing of the signature of the request. This code is not part of the ID-FF 1.2 specification.
#define LASSO_LIB_STATUS_CODE_NO_AUTHN_CONTEXT "lib:NoAuthnContext"
Used by an identity provider to indicate that the specified authentication context information in the request prohibits authentication from taking place.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_NO_AVAILABLEIDP "lib:NoAvailableIDP"
Used by an intermediary to indicate that none of the supported identity provider URLs from the <IDPList> can be resolved or that none of the supported identity providers are available.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_NO_PASSIVE "lib:NoPassive"
Used by an identity provider or an intermediary to indicate that authentication of the Principal requires interaction and cannot be performed passively.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_NO_SUPPORTEDIDP "lib:NoSupportedIDP"
Used by an intermediary to indicate that none of the identity providers are supported by the intermediary.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_PROXY_COUNT_EXCEEDED "lib:ProxyCountExceeded"
Used by an identity provider to indicate that it cannot authenticate the principal itself, and was not permitted to relay the request further.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_UNKNOWN_PRINCIPAL "lib:UnknownPrincipal"
Used by an identity provider to indicate that the Principal is not known to it.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_UNSIGNED_AUTHN_REQUEST "lib:UnsignedAuthnRequest"
If the requesting provider’s <AuthnRequestsSigned> metadata element is "true", then any request messages it generates MUST be signed. If an unsigned request is received, then the provider MUST return an error with a second- level <samlp:StatusCode> of lib:UnsignedAuthnRequest.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_LIB_STATUS_CODE_UNSUPPORTED_PROFILE "lib:UnsupportedProfile"
If an error occurs during this further processing of the logout (for example, relying service providers may not all implement the Single Logout profile used by the requesting service provider), then the identity provider MUST respond to the original requester with a <LogoutResponse> message, indicating the status of the logout request. The value "lib:UnsupportedProfile" is provided for a second-level <samlp:StatusCode>, indicating that a service provider should retry the <LogoutRequest> using a different profile.
Source: Liberty ID-FF Protocols and Schema Specification 1.2
#define LASSO_SAML_STATUS_CODE_SUCCESS "samlp:Success"
A protocol request succeeded.
#define LASSO_SAML_STATUS_CODE_VERSION_MISMATCH "samlp:VersionMismatch"
Request failed, because the version is not supported by the provider. Look at second level status for more details.
#define LASSO_SAML_STATUS_CODE_REQUESTER "samlp:Requester"
Request failed because of the requester. Look at second level status for more details.
#define LASSO_SAML_STATUS_CODE_RESPONDER "samlp:Responder"
Request failed because of the responder. Look at second level status for more details.
#define LASSO_SAML_STATUS_CODE_REQUEST_VERSION_TOO_HIGH "samlp:RequestVersionTooHigh"
Request failed because the version of protocol used is too high. Used with LASSO_SAML_STATUS_CODE_VERSION_MISMATCH.
#define LASSO_SAML_STATUS_CODE_REQUEST_VERSION_TOO_LOW "samlp:RequestVersionTooLow"
Request failed because the version of protocol used is too low. Used with LASSO_SAML_STATUS_CODE_VERSION_MISMATCH.
#define LASSO_SAML_STATUS_CODE_REQUEST_VERSION_DEPRECATED "samlp:RequestVersionDeprecated"
Request failed because the version of protocol used is deprecated. Used with LASSO_SAML_STATUS_CODE_VERSION_MISMATCH.
#define LASSO_SAML_STATUS_CODE_TOO_MANY_RESPONSES "samlp:TooManyResponses"
Request failed because too many data should be returned. Used with LASSO_SAML_STATUS_CODE_RESPONDER.
#define LASSO_SAML_STATUS_CODE_RESOURCE_NOT_RECOGNIZED "samlp:ResourceNotRecognized"
Request failed because the responder does not wish to support resource-specific attribute queries, or the resource value provided is invalid or unrecognized. Use with LASSO_SAML_STATUS_CODE_RESPONDER.
#define LASSO_SAML_STATUS_CODE_REQUEST_DENIED "samlp:RequestDenied"
The SAML responder or SAML authority is able to process the request but has chosen not to respond. This status code MAY be used when there is concern about the security context of the request message or the sequence of request messages received from a particular requester.
Source: Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) V1.1
#define LASSO_LIB_PROTOCOL_PROFILE_BRWS_ART
Identifies the Single Sign-On "Artifact" profile; where an artifact is passed from identity provider to service provider and back to get the LassoLibAssertion.
#define LASSO_LIB_PROTOCOL_PROFILE_BRWS_POST
Identifies the Single Sign-On "POST" profile; where the LassoLibAssertion is sent directly from the identity provider to the service provider in an HTML form submission message.
#define LASSO_LIB_PROTOCOL_PROFILE_BRWS_LECP
Identifies the Single Sign-On "LECP" profile; where the LassoLibAssertion is sent directly from the identity provider to the service provider in a PAOS response. See LassoLecp.
#define LASSO_LIB_PROTOCOL_PROFILE_FED_TERM_IDP_HTTP
Identifies the Federation Termination "Redirect" profile; where the request for federation termination is sent from the identity provider to the service provider in a redirected GET request.
#define LASSO_LIB_PROTOCOL_PROFILE_RNI_IDP_HTTP "http://projectliberty.org/profiles/rni-idp-http"
#define LASSO_LIB_PROTOCOL_PROFILE_RNI_IDP_SOAP "http://projectliberty.org/profiles/rni-idp-soap"
#define LASSO_LIB_PROTOCOL_PROFILE_RNI_SP_HTTP "http://projectliberty.org/profiles/rni-sp-http"
#define LASSO_LIB_PROTOCOL_PROFILE_RNI_SP_SOAP "http://projectliberty.org/profiles/rni-sp-soap"
#define LASSO_LIB_PROTOCOL_PROFILE_SLO_SP_HTTP "http://projectliberty.org/profiles/slo-sp-http"
#define LASSO_LIB_PROTOCOL_PROFILE_SLO_SP_SOAP "http://projectliberty.org/profiles/slo-sp-soap"
#define LASSO_LIB_PROTOCOL_PROFILE_SLO_IDP_HTTP "http://projectliberty.org/profiles/slo-idp-http"
#define LASSO_LIB_PROTOCOL_PROFILE_SLO_IDP_SOAP "http://projectliberty.org/profiles/slo-idp-soap"
#define LASSO_LIB_NAME_IDENTIFIER_FORMAT_FEDERATED "urn:liberty:iff:nameid:federated"
Federated name identifier constant, used in LassoSamlNameIdentifier. It implies the name identifier belongs to a federation established between SP and IdP.
#define LASSO_LIB_NAME_IDENTIFIER_FORMAT_ONE_TIME "urn:liberty:iff:nameid:one-time"
"One-time" name identifier constant, used in LassoSamlNameIdentifier.
#define LASSO_LIB_NAME_IDENTIFIER_FORMAT_ENCRYPTED "urn:liberty:iff:nameid:encrypted"
"Encrypted" name identifier constant, used in LassoSamlNameIdentifier.
#define LASSO_LIB_NAME_IDENTIFIER_FORMAT_ENTITYID "urn:liberty:iff:nameid:entityID"
#define LASSO_LIB_CONSENT_OBTAINED_PRIOR "urn:liberty:consent:obtained:prior"
#define LASSO_LIB_CONSENT_OBTAINED_CURRENT_IMPLICIT "urn:liberty:consent:obtained:current:implicit"
#define LASSO_LIB_CONSENT_OBTAINED_CURRENT_EXPLICIT "urn:liberty:consent:obtained:current:explicit"
#define LASSO_LIB_CONSENT_UNAVAILABLE "urn:liberty:consent:unavailable"
#define LASSO_LIB_CONSENT_INAPPLICABLE "urn:liberty:consent:inapplicable"
#define LASSO_SAML_CONFIRMATION_METHOD_ARTIFACT "urn:oasis:names:tc:SAML:1.0:cm:artifact"
Confirmation method when the browser-artifact binding is used.
#define LASSO_SAML_CONFIRMATION_METHOD_ARTIFACT01 "urn:oasis:names:tc:SAML:1.0:cm:artifact-01"
Deprecated confirmation method when the browser-artifact binding is used.
#define LASSO_SAML_CONFIRMATION_METHOD_BEARER "urn:oasis:names:tc:SAML:1.0:cm:bearer"
Confirmation method when subject of the assertion is the one holding it.
#define LASSO_SAML_CONFIRMATION_METHOD_HOLDER_OF_KEY
A ds:KeyInfo must be present in the SubjecConfirmation element. It MUST be used to confirm assertion subject identity.