Customer wants to deploy a NetScaler AAA vServer as a SAML IdP, with Cisco WebEx as the SAML SP

Cisco WebEx uses a REDIRECT binding as default, which is supported in NetScaler for 11.0 onward

---

Instructions

Log into the WebEx admin console and configure the SSO site settings as follows:


Ensure that the SSO Profile is set to SP Initiated, AthnuRequest Signed is Optional.

The Destination and Consumer SSO Service Login URL are the URL of the AAA IdP:
https://fqdn.of.vserver/saml/login

The Issuer for SAML is the URL of the FQDN of the NetScaler AAA vServer

The WebEx SAML Issuer is the URL of the SP that the client connects to.

The NameID Format can be whichever you prefer, but you will need to ensure that it matches that is specified in the NetScaler IdP Profile.

The AuthnContextClassRef is AuthnContextClassRefurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
This is the Class Reference that the NetScaler provides.


For the NetScaler IdP profile, please see the below command:
add authentication samlIdPProfilename_of_profile -samlSPCertName cert.for.sp.cer -samlIdPCertName idp.cer.pair -assertionConsumerServiceURL "URL_of_SP" -sendPassword OFF -samlIssuerName same.as.sp.profile -rejectUnsignedRequests OFF -signatureAlg RSA-SHA1 -digestMethod SHA1 -NameIDFormat unspecified -encryptAssertion OFF -encryptionAlgorithm AES256 -samlBinding REDIRECT -skewTime 5 -serviceProviderID (Match this with the SAML ID in the SP Profile) -signAssertion ASSERTION -keyTransportAlg RSA_OAEP