Environment
Novell Access Manager 3.1 Linux Novell Identity Server
Novell Access Manager 3.1 Windows Novell Identity Server
Novell Access Manager 3.1 Support Pack 3 must be applied at a minimum
Situation
When a SAML 2 environment is setup to federate between an Identity Provider (IDP) and Service Provider (SP), the user is always prompted to consent to the federation before it progresses. For example, If a user hits an IDP intersite transfer URL, authenticates and gets redirected to the SP the user is federating with, the following message appears on the browser:
"The Service Provider being authenticated has requested account federation with this site.
Service Provider domain: https://neilidp.lab.novell.com/nidp/saml2/metadata
Do you give consent for this federation?"
The Administrator does not want the user to be prompted to federate but no option seems to exist in the Admin Console that can can change this default behaviour - Admin tried going to the 'User Interaction Settings' option under the IDP servers Liberty -> Web service consumer and disabled user interactions but this had no effect.
"The Service Provider being authenticated has requested account federation with this site.
Service Provider domain: https://neilidp.lab.novell.com/nidp/saml2/metadata
Do you give consent for this federation?"
The Administrator does not want the user to be prompted to federate but no option seems to exist in the Admin Console that can can change this default behaviour - Admin tried going to the 'User Interaction Settings' option under the IDP servers Liberty -> Web service consumer and disabled user interactions but this had no effect.
Resolution
Modify the web.xml initialization
parameter with the following setting to disable the user getting
prompted whether user consents to federate with service provider.
<context-param>
<param-name>federationConsent</param-name>
<param-value>true</param-value>
</context-param>
This web.xml file is located under $TOMCAT_HOME/webapps/nidp/WEB-INF/web.xml for both WIndows
and Linux based IDP servers.
Additional Information
An example position to add it into is just below the ldapLoadThreshold parameter, as shown below.
<context-param>
<param-name>ldapLoadThreshold</param-name>
<param-value>10</param-value>
</context-param>
<context-param>
<param-name>federationConsent</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>ldapLoadThreshold</param-name>
<param-value>10</param-value>
</context-param>
<context-param>
<param-name>federationConsent</param-name>
<param-value>true</param-value>
</context-param>