MarkLogic 12 EA 1 Product Documentation

sec:saml-server

The http options include:

<headers>

A sequence of <name>value</name> pairs. The names can be anything, but many HTTP servers understand HTTP names such as content-type. These are turned into name:value HTTP headers. An error is raised if the child elements of the <headers> option are not of the form <name>value</name>.

<credential-id>

The credential id to use for authentication. This is the preferred way of providing authentication credentials because they are stored securely in the security database. When a credential id is specified, the other authentication information fields should be left empty and will be ignored. For details on obtaining a credential id, see the Usage Notes, below.

<authentication>

The credentials and the authentication method to use for this request. This element can contain the following child elements:

• username: The username of the user to be authenticated on the http server
• password: The password for username.

The authentication element can also include an optional method attribute with one of the following values: basic, digest, aws, aws4. If the authentication method is specified and the HTTP server requests a different type of authentication, then an error is raised.

<timeout>

The amount of time, in seconds, to wait until the HTTP connection times out. The default value is the http timeout for the group.

<ciphers>

A standard cipher string. For details on legal ciper strings, see http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS.

<client-cert>

A PEM encoded client certificate for identifying the client to the remote server.

<client-key>

The private key that corresponds to client-cert.

<pass-phrase>

A pass phrase, if one is needed to decrypt client-key.

<allow-sslv3>

A boolean value to specify whether to communicate using the SSL v3 protocol. The default is true, which indicates communication using the SSL v3 protocol.

<allow-tls>

A boolean value to specify whether to communicate using the TLS protocol. The default is true, which indicates communication using the TLS protocol.

<verify-cert>

A boolean value to specify whether the server's certificate should be verified. The default value is true. A value of false should only be specfied after careful consideration of the security risks since it permits communication with servers whose certificates are expired, revoked, or signed by unknown or untrusted authorities. A value of false also removes protection against a man-in-the-middle attack.

<ssl-session-cache>

A boolean value to specify whether ssl session should be cached and reused. The default value is true. A value of false should only be specfied if ssl session cache causes problem with a url.