Does the index value matter in the ‘Reply URL’ setting for SAML assertions?

Solved217 viewsAssertion authentication configuration Reply URL SAML
3
0 Comments

In the example given on DataMiner Docs SAML config, the URL assertions in the examples seem to have arbitrary values e.g., 0,1,2 and 3.

Do these index values need to be unique for each DMA and the configured endpoint (URL)?

My understanding is that the index serves to differentiate between multiple assertions for the same URL up to the index argument:

<AssertionConsumerService ... Location="https://dataminer.example.com/" index="0" .../>

<AssertionConsumerService ... Location="https://dataminer.example.com/" index="1" .../>

Therefore, in this context, it seems acceptable for all examples to use the same index value, such as 0, across all DMAs and endpoints. Is that correct?

<AssertionConsumerService ... Location="https://dataminer.example.com/" index="0" .../>

<AssertionConsumerService ... Location="https://dataminer.example.com/API" index="0" .../>

<AssertionConsumerService ... Location="https://dataminer.example.com/Account-Linking" index="0" .../>

Reza Biglari [DevOps Advocate] Selected answer as best 27th January 2025

1 Answer

2
760 1 Comment

Hi Reza,

These index values do not need to be unique per DMA. You can copy the same setup to every agent.

Regarding the values within a single agent.
You seem to be right in that they don't matter.
I did a quick scan of the code and they seem to be unused.
On our internal setups we just have the incrementing system everywhere.

Is there a reason for your use case why you'd want to have Index=0 for every endpoint?

Reza Biglari [DevOps Advocate] Posted new comment 27th January 2025
Reza Biglari [DevOps Advocate] commented

This response is incredibly helpful, thank you!

The reason for my question is that we've currently configured all indexes in our DMS to be unique. This means that each DMA and link is assigned its own unique index. However, this approach is unsustainable, as every time a new DMA is added, a new index must be reserved and manually configured. This process not only adds overhead but is also prone to errors.

I wanted to understand how much effort should be dedicated to optimising the indexing configuration. Based on your answer, while it’s theoretically possible to use index 0 universally, there’s no significant harm in replicating the incrementing setup of one DMA across all DMAs. So the indexes are duplicated across DMAs whereas they are incremented within a DMA.

This approach could ensure compatibility with future Skyline developments should changes to the indexes be required.