SAML

---

Triggering IAL2 Verification Using SAML

Users can upgrade their own status to IAL2 in AdminX by using the 1Kosmos web-based identity-proofing flow. Tenant and community administrators can trigger this flow using SAML.

Prerequisites

Before starting, ensure you have integrated your Service Provider (SP) for SSO as a SAML application. See SSO Integration in AdminX for more information on configuring your Service Provider (SP) in AdminX.

Configuring Your Service Provider (SP) in AdminX

1. Navigate to your AdminX control panel and log in as a community or tenant administrator.
2. Go to the Applications page and find your SAML application. Click the pencil icon under Actions to edit the SAML application settings.
3. Click Next to view the SAML settings for your application.
4. Under Claims Mapping, click Add new.
5. Select ial from the drop-down menu under BLOCKID LEDGER ATTRIBUTES.
6. Enter a format to use with the attribute and click Create.

Administrators can optionally map an identity attribute to use with this SAML claim, such as the user's first or last name as shown on their driver's license or passport.

1. Click Add new once more to add another claims mapping.
2. Find the identity attribute you wish to add, such as dl.lastname, and assign a format.
3. Click Create to save.
4. Click Next once you have finished mapping all your SAML claims.
5. Click Save to complete the IAL claims mapping for your SAML application.

Requesting IAL2 Verification as a Service Provider

Once the SAML attributes have been mapped in AdminX, Service Providers can request IAL2 verification using RequestedAuthnContext as part of the SAML request. When the branded claim is received by the IdP (1Kosmos), it triggers an IAL2 journey to elevate the user's identity assurance level.

<samlp:RequestedAuthnContext Comparison="exact">
  <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:IAL2</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>

From a user's standpoint, they are redirected to AdminX to perform their identity verification instead of a standard login.

SAML Responses

Depending on the user's current IAL level after performing their identity verification, the server returns different responses. The table below shows the SAML responses returned after a user has attempted an identity verification. These responses can be viewed using a SAML tracer if desired.

Requested AuthnContext	User's IAL Level After Identity Verification	SAML Response
IAL2	IAL1 (Failed Identity Verification or Insufficient Information)	<saml:AuthnContext/>
IAL2	IAL2	<saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:IAL2</saml:AuthnContextClassRef></saml:AuthnContext>
IAL2	IAL3	<saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:IAL2</saml:AuthnContextClassRef><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:IAL3</saml:AuthnContextClassRef></saml:AuthnContext>