LMS integration

The two-hop flow

SAML terminates in bizlibrary.login, never in LMS. LMS obtains identity from bizlibrary.login over an authorization-code exchange, so this IdP only ever talks to the login app.

1. browser → LMS GET /Account/Login
2. LMS → browser 302 redirect to its own /OAuth/Authorize
3. browser → bizlibrary.login (SP) follows the redirect to /OAuth/Authorize
4. SP (internal) not signed in → redirects to /SAML/RequestAuthentication
5. SP → this IdP AuthnRequest (redirect binding, via the browser)
6. user authenticates at this IdP
7. this IdP → browser auto-submitting POST form carrying the SAMLResponse
8. browser → SP POST /SAML/Consume
9. SP (internal) validates the response, signs the user in, sets the .bizlauth.login cookie
10. SP → browser → LMS 302 back through /OAuth/Authorize with an authorization code
11. LMS → SP POST /OAuth/GetOAuthToken (server-to-server, no browser)
12. SP → LMS access_token

This IdP's live SAML endpoints

These are read from the running config, so they stay correct if PUBLIC_BASE_URL or ports change.

IdP entity ID

urn:test-idp:idp

SSO / AuthnRequest endpoint

https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/sso

SLO / logout endpoint

https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/slo

Metadata

https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/metadata

Signing certificate

https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/certificate.cer (.cer file, not the metadata XML)

Signing cert fingerprint

92:CC:F9:FE:3F:78:28:66:18:49:42:28:09:34:CB:82:F2:A8:85:34:84:6D:1F:84:D9:EE:34:27:E6:47:4F:A4

Registered here as an SP

registered BizlLogin -> http://localhost:5555/SAML/Consume on Service providers. Assertion signed: true, response signed: false, attribute preset: simple.

Register with BizlLogin (bizl2)

BizlLogin resolves its SAML IdP from the AuthenticationMethod table, scoped to a tenant via Look → LookAuthenticationMethod. For local/sandbox dev that tenant is bizl2 (Look.Name = 'bizl2', LookKey = 4351). Whenever this IdP redeploys to a new URL, run this against BizlLogin's dev DB (companycollege80_DEV, via SSMS/sqlcmd) so the tenant points at the endpoints above.

BEGIN TRANSACTION;

INSERT INTO AuthenticationMethod
    (Title, Type, Active, SyncGuid, ClientKey, Configuration, CreatedBy, CreatedDate, ModifiedBy, ModifiedDate)
VALUES
    (N'TestIdp', N'SAML', 1, N'40200ED9-2D7F-41B6-B5D0-5EE2364DA025', NULL,
     N'{"IdpName":"urn:test-idp:idp","EntityId":"https://lms.bizlibrary.com/SAML/40200ed9-2d7f-41b6-b5d0-5ee2364da025","IdpAuthnRequestEndPoint":"https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/sso","IdpLogoutEndpoint":"https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/slo","CertificateName":"signing-certificate.cer","NameIdFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","ProvisionUsers":false,"ProvisionUsersDisabledMessage":"","AuthnResponseBodySigned":false,"AssertionSigned":false,"AssertionEncrypted":false,"AssertionAttributes":[{"Name":"username","Mapping":"username"}],"errors":[]}',
     N'dev-sandbox', SYSUTCDATETIME(), NULL, SYSUTCDATETIME());

INSERT INTO LookAuthenticationMethod (LookKey, AuthenticationMethodId)
VALUES (4351, SCOPE_IDENTITY());

COMMIT TRANSACTION;

What to paste into bizlibrary.login / LMS's Admin > Authentication

This is the AuthenticationMethod.Configuration JSON blob (same shape LMS's _AuthenticationConfig.cshtml form writes). Signing is left off so the round trip works before wiring up certificates — see the note below to turn it on.

{
  "IdpName": "urn:test-idp:idp",
  "EntityId": "BizlLogin",
  "IdpAuthnRequestEndPoint": "https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/sso",
  "IdpLogoutEndpoint": "https://te-346877f799a749b6a36474bdfd68b4cd.ecs.us-east-1.on.aws/saml/slo",
  "NameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
  "ProvisionUsers": false,
  "ProvisionUsersDisabledMessage": "Unknown user - contact an administrator",
  "AuthnResponseBodySigned": false,
  "AssertionSigned": false,
  "AssertionEncrypted": false,
  "AssertionAttributes": [
    {
      "Name": "username",
      "Mapping": "username"
    }
  ]
}

Field-by-field mapping for the Authentication form