Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion _data/errors.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ oidc:
##### Why it's happening
Login.gov recognizes incoming requests from Service Providers by validating the `client_id` field sent in the request and checking it against the Issuer string of Service Providers registered with Login.gov.

This specific error occurs when Login.gov receives an OIDC request from a Service Provider that contains a `client_id` that is either not registered or not active with Login.gov. The `client_id` specified in the request must match EXACTLY the Issuer defined in the Portal.
This specific error occurs when Login.gov receives an OIDC request from a Service Provider that contains a `client_id` that is either not registered or not active with Login.gov. The `client_id` specified in the request must match EXACTLY the Issuer defined in the portal.
##### What to do:
- Ensure the authentication request has a `client_id` value
- Ensure that the `client_id` sent in the authentication request matches the Issuer registered in your application's configuration on the [Partner Portal](https://portal.int.identitysandbox.gov/){:target="_blank"}.
Expand Down
6 changes: 3 additions & 3 deletions _includes/support/faq_csp_violation.html
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@ <h5>Background:</h5>
<br/><br/>
The <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action">CSP form-action</a> directive restricts which URLs can be used as the target of form submissions from a given context. Certain Chromium-based internet browsers (e.g. Google Chrome and Microsoft Edge) enforce the form-action directive through the entire redirect chain (if any). Other non-Chromium-based browsers only check the first redirect in the chain (e.g. Firefox). For Chromium-based browsers, upon form submission, any attempts to redirect to a url not explicitly listed as a form-action source will violate the CSP directive and cause a failure to load and a console error.
<br/><br/>
This error occurs when Service Providers attempt to redirect users to a url that is not registered in the Redirect URLs field in the <a target="_blank" href="https://dashboard.int.identitysandbox.gov/">Login.gov Portal</a> application's configuration. All urls that users could be redirected to, even as a passthrough, need to be included in the list of Redirect URLs.
This error occurs when Service Providers attempt to redirect users to a url that is not registered in the Redirect URLs field in the <a target="_blank" href="https://dashboard.int.identitysandbox.gov/">Partner Portal</a> application's configuration. All urls that users could be redirected to, even as a passthrough, need to be included in the list of Redirect URLs.
</p>
<h5>Solution:</h5>
<p>
Use the Network tab of your web browser to identify which redirect (302) is hanging or failing. Add that uri to the list of Redirect URIs in your Login.gov Portal integration configuration.
</p>
Use the Network tab of your web browser to identify which redirect (302) is hanging or failing. Add that URI to the list of Redirect URIs in your portal integration configuration.
</p>
8 changes: 4 additions & 4 deletions _includes/support/faq_unauthorized_sp.html
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
<h5>Background</h5>
<p>
Login.gov recognizes incoming requests from Service Providers by validating the Issuer (for SAML) or ClientID (for OIDC) field sent in the request and checking it against Service Providers registered with Login.gov. The Issuer for each Service Provider is defined in the Issuer field on the Login.gov Portal.
Login.gov recognizes incoming requests from Service Providers by validating the Issuer (for SAML) or ClientID (for OIDC) field sent in the request and checking it against Service Providers registered with Login.gov. The Issuer for each Service Provider is defined in the Issuer field on the Partner Portal.
<br/><br/>
<img alt="Screenshot of issuer field on Login.gov portal" src="/assets/img/dashboard_issuer.png" />
<img alt="Screenshot of issuer field on the portal" src="/assets/img/dashboard_issuer.png" />
<br/><br/>
This specific error occurs when Login.gov receives a SAML request from a Service Provider that contains an Issuer field that is either not registered or not active with Login.gov. The Issuer defined in the request must match EXACTLY the Issuer defined in the Portal.
This specific error occurs when Login.gov receives a SAML request from a Service Provider that contains an Issuer field that is either not registered or not active with Login.gov. The Issuer defined in the request must match EXACTLY the Issuer defined in the portal.
</p>
<h5>Solution:</h5>
<p>
Expand All @@ -14,7 +14,7 @@ <h5>Solution:</h5>
<li>See our video <a href="https://www.youtube.com/watch?v=SzTRc_c_5I4" class="usa-link">How to Troubleshoot and Fix "Unauthorized Service Provider" Error for SAML Integrations</a> for a detailed visual explanation.</li>
</ul>

Note that certain Service Providers will not allow partners to set or change the Issuer value after the application is configured (e.g. MS Power Apps Portal). In this case, the best option would be to create the Login.gov Portal integration configuration after the Service Provider application has defined the Issuer and use that Issuer in the Portal.
Note that certain Service Providers will not allow partners to set or change the Issuer value after the application is configured (e.g. MS Power Apps Portal). In this case, the best option would be to create the Login.gov Partner Portal integration configuration after the Service Provider application has defined the Issuer and use that Issuer in the portal.
</p>

<!-- markdown has to be formatted left-aligned -->
Expand Down
4 changes: 2 additions & 2 deletions _layouts/base.html
Original file line number Diff line number Diff line change
Expand Up @@ -120,14 +120,14 @@ <h1 class="usa-logo" id="basic-logo">
</section>
</div>
<ul class="usa-nav__primary usa-accordion flex-justify">
<a href="https://dashboard.int.identitysandbox.gov/" class="mobile:display-block desktop:display-none usa-button flex-align-self-center" type="button">Go to Portal</a>
<a href="https://dashboard.int.identitysandbox.gov/" class="mobile:display-block desktop:display-none usa-button flex-align-self-center" type="button">Go to portal</a>
{% include nav/list.html
links = site.data.nav.primary
li_class = 'usa-nav__primary-item'
subnav_ul_class = 'desktop:display-none usa-sidenav__sublist'
%}
<div class="desktop:margin-right-neg-2 grid-row flex-fill flex-justify-end">
<a href="https://dashboard.int.identitysandbox.gov/" class="mobile:display-none desktop:display-inline usa-button flex-align-self-center" type="button">Go to Portal</a>
<a href="https://dashboard.int.identitysandbox.gov/" class="mobile:display-none desktop:display-inline usa-button flex-align-self-center" type="button">Go to portal</a>
</div>
</ul>
</div>
Expand Down
2 changes: 1 addition & 1 deletion _pages/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ sidenav:
<h2 id="how-to-integrate-login" class="padding-bottom-3 margin-top-0">How to integrate with Login.gov</h2>
<ol class="usa-process-list margin-bottom-4">
<li class="usa-process-list__item">
<h3>Register your application in our partner portal</h3>
<h3>Register your application in our Partner Portal</h3>
<p>
First, create a team. Then, follow the steps to create an application in a sandbox environment where you can configure and test without affecting your live systems. For more details, check out our instructions on <a class="usa-link" href="{% link _pages/testing.md %}#using-the-sandbox">using the sandbox</a>.
</p>
Expand Down
2 changes: 1 addition & 1 deletion _pages/oidc/token.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ sidenav:

---
{% capture client_assertion %}
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your integration configuration within the Portal. The JWT should use the RS256 algorithm and containing the following claims:
A [JWT](https://jwt.io/){:class="usa-link--external"} signed with the client’s private key (minimum length of 2048 bits) associated with the public key uploaded to your integration configuration within the portal. The JWT should use the RS256 algorithm and containing the following claims:
- **iss** (string) — The issuer, which must be the `client_id`.
- **sub** (string) — The subject, which must also be the `client_id`.
- **aud** (string) — The audience, which should be (or, in the case of multiple audience values, include) the URL of the token endpoint, for example: `https://idp.int.identitysandbox.gov/api/openid_connect/token`
Expand Down
2 changes: 1 addition & 1 deletion _pages/overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Login.gov is a FedRAMP moderate approved multifactor authentication and identity

This is the configuration for your application within Login.gov’s identity provider. In the sandbox environment, you will be able to determine the configuration yourself and decide what is the best fit for your needs. In the Login.gov production environment, we will manage the final configuration.
To configure a test application in the sandbox environment:
* Create an account in the [Login.gov Portal](https://portal.int.identitysandbox.gov). From here you will be able to test various configurations and determine what is right for your agency.
* Create an account in the [Partner Portal](https://portal.int.identitysandbox.gov). From here you will be able to test various configurations and determine what is right for your agency.
* Select between [OIDC]({{ site.baseurl }}/oidc/) or [SAML]({{ site.baseurl }}/saml/) protocol implementation protocols and understand which user attributes are required.
* If you have questions when testing your integration, read through our [FAQs]({{ site.baseurl }}/support/) or submit a ticket to our [technical support help desk]({{ site.baseurl}}/support/#contacting-partner-support).
* Before submitting a request to move your application's configuration to production, review the [User experience]({{ site.baseurl }}/design-guidelines/) page and the [Production]({{ site.baseurl }}/production/) page. Additional requirements, like a [signed Interagency agreement]({{ site.baseurl }}/production/#confirm-interagency-agreement-iaa) (IAA) and [agency logo]({{ site.baseurl }}/user-experience/agency-logo/), are described in these pages.
4 changes: 2 additions & 2 deletions _pages/production.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ Make sure you have the following items ready before you start the deployment pro

- [Signed Interagency Agreement (IAA) listing this integration ]({{ site.baseurl}}/production/#confirm-interagency-agreement-iaa)

- A dedicated [integration configuration within the Portal](https://dashboard.int.identitysandbox.gov/)
- A dedicated [integration configuration within the portal](https://dashboard.int.identitysandbox.gov/)
* We recommend having two configurations, one that is intended for deployment to production and one which is purely for testing purposes.
* All production urls should have .gov, .mil, or a dedicated .com address and point to an Authority to Operate (ATO) approved environment.

Expand Down Expand Up @@ -69,7 +69,7 @@ Please reach out to your agency IAA contact if you have any questions. If your a

## Production configuration process

Before you can request deployment, you need to create a new and separate integration configuration on our partner portal. This new app will include your production certificate, urls, and logo. When starting this process you need the following items ready to go:
Before you can request deployment, you need to create a new and separate integration configuration on our Partner Portal. This new app will include your production certificate, urls, and logo. When starting this process you need the following items ready to go:

- Signed IAA listing this integration 
- ATO approved environment
Expand Down
2 changes: 1 addition & 1 deletion _pages/saml/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ Here are values needed to configure your service provider (SP) to work with Logi
Consistent with the [SAML metadata specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf){:class="usa-link--external"}, Login.gov's metadata for our sandbox environment is available at [https://idp.int.identitysandbox.gov/api/saml/metadata{{ site.data.saml.year.current }}](https://idp.int.identitysandbox.gov/api/saml/metadata{{ site.data.saml.year.current }}).

### Signing Certificates
Below you can find the X509 certificates used by the Login.gov IdP to sign SAML requests. **Do not enter these certificates in the Portal when configuring an application for testing** - you can follow the instructions in our [testing article]({% link _pages/testing.md %}#creating-a-public-certificate) to generate a client certificate.
Below you can find the X509 certificates used by the Login.gov IdP to sign SAML requests. **Do not enter these certificates in the portal when configuring an application for testing** - you can follow the instructions in our [testing article]({% link _pages/testing.md %}#creating-a-public-certificate) to generate a client certificate.

{% capture saml_cert_sandbox_title %}
View {{ site.data.saml.year.current }} <strong>sandbox</strong> certificate
Expand Down
4 changes: 2 additions & 2 deletions _pages/testing.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ The Login.gov sandbox is an open environment to create and test integrations bet

**The Login.gov sandbox environment is supported M-F, 8a-5p ET.** The sandbox is typically available during these hours, though outages may occur.

In the sandbox environment, our [partner portal](https://portal.int.identitysandbox.gov/) is where you can manage your test applications. ***It is important to note that your Login.gov production account and your Login.gov sandbox account are two separate accounts.***
In the sandbox environment, our [Partner Portal](https://portal.int.identitysandbox.gov/) is where you can manage your test applications. ***It is important to note that your Login.gov production account and your Login.gov sandbox account are two separate accounts.***

## Getting access to the Login.gov sandbox

Expand All @@ -42,7 +42,7 @@ You can create an account in the sandbox environment on your own.
Ask your agency partner to help you gain access. Login.gov will not create an account or add you to a team; your partner must do this for you.

**If you are with a government entity that is not a federal agency (a state or municipality) and do not have an email ending in .gov or .mil**
Please submit a support ticket through the [Partner Support Help Desk](https://zendesk.login.gov) to get access to the Portal.
Please submit a support ticket through the [Partner Support Help Desk](https://zendesk.login.gov) to get access to the portal.

## Using the sandbox

Expand Down