Skip to main content

​
What FaceSign needs from Silverfort

Transfer these inputs through the agreed private partner channel before UAT:
  • The Silverfort sandbox SP metadata XML, exact case-sensitive entityID, and exact HTTPS POST ACS.
  • One sanitized, actually emitted HTTP-Redirect AuthnRequest capture and one sanitized, actually emitted HTTP-POST AuthnRequest capture. Each must include decoded XML and the outer query or form fields, including RelayState and whether Signature and SigAlg are present.
  • Whether Bridge requires signed AuthnRequests. If it does, include the SP signing certificate and required signature and digest algorithms. Signed AuthnRequests are a pilot blocker.
  • The exact Bridge sandbox version and build, plus the returned facesign.* attributes the build consumes.
  • The exact synthetic Subject value shape, NameID format, NameIDPolicy omission or format behavior, and expected returned NameID. Do not use a real workforce identity.
  • The actual RequestedAuthnContext element, its Comparison, every class reference, and confirmation that Bridge accepts FaceSign’s fixed unspecified response context.
  • A representative sanitized RelayState, its shape, and the maximum size Bridge emits.
  • Bridge’s request-generation and response-validation clock-skew allowances.
  • One exact pilot policy trigger and its expected allow, deny, timeout, and unavailable outcomes.
  • The end-to-end timeout from policy trigger and request issuance through fallback or recovery.
  • Named technical, policy, evidence, and escalation owners on both sides. Keep their names in the private worksheet, not in these public docs.
Send the SP metadata unmodified through the agreed private partner channel. Its entityID, ACS, certificates, bindings, and structure are the configuration FaceSign must review; if they expose a sensitive tenant or customer hostname, keep the file private instead of editing those fields. In the captures, remove real user identifiers, credentials, RelayState secrets, and private keys. Preserve the exact entityID, ACS, binding envelope, algorithms, and XML structure so the captures remain reproducible. Do not commit these artifacts to the public repository. Registration is coordinated with FaceSign. Sharing these inputs does not create or activate a registration automatically.

​
Import FaceSign metadata

Copy this URL into Bridge’s IdP metadata setting:
Open FaceSign IdP metadata as raw XML ↗ The metadata publishes the IdP entityID, signing certificate, SSO endpoint, Redirect and POST request bindings, and WantAuthnRequestsSigned="false".

​
Register the Bridge sandbox

FaceSign registers the exact entityID and HTTPS ACS supplied by Silverfort. SAML responses use HTTP-POST to that ACS. If an AuthnRequest supplies AssertionConsumerServiceURL, it must match the registered value exactly. Use an isolated, non-authorizing sandbox for UAT. Do not reuse a production entityID, ACS, or person identifier as a public fixture.

​
Send unsigned AuthnRequests

The deployed IdP rejects signed AuthnRequests, including requests with embedded XML signatures or Redirect/POST signature parameters. Configure Bridge to send unsigned requests. If Bridge cannot disable signing, record that as an integration blocker before UAT.

​
Supported AuthnRequest shape

The deployed IdP accepts HTTP-Redirect and HTTP-POST with these limits: Capture Bridge’s actual RequestedAuthnContext Comparison and all class references. FaceSign accepts at most one RequestedAuthnContext container. It accepts class-reference requests, rejects declaration references, and always returns urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified. Bridge acceptance of the fixed unspecified context is a joint UAT criterion. This abridged example is unsigned and intentionally omits <Subject>:

​
Optional sandbox Subject echo

Without Subject, omit NameIDPolicy or request transient or unspecified; FaceSign returns a transient, session-scoped NameID. With approved sandbox Subject echo, the Subject must contain one plain-text NameID in a format published in metadata. NameIDPolicy may be omitted or match that format. SPNameQualifier is not supported. FaceSign trims surrounding whitespace, then returns the value and approved format.
The echoed value is unsigned correlation input. It is not FaceSign identity proof and cannot authorize access.
Before enabling echo, agree on a synthetic Subject such as pilot.user@example.invalid, its exact format, and the expected returned NameID. Never place a real workforce identifier in a public fixture.

​
User and browser experience

Bridge redirects the browser to FaceSign. The person grants camera permission, completes the avatar-led flow, and returns to the registered ACS. Silverfort must tell FaceSign the end-to-end timeout and decide how its UI handles a denial, an expired flow, and an unreachable IdP. FaceSign’s overall authentication deadline is five minutes.

​
Pre-UAT checklist

  • FaceSign has coordinated registration of the exact sandbox entityID and HTTPS POST ACS.
  • Silverfort has confirmed all bindings, request-signing behavior, Subject and NameID behavior, RequestedAuthnContext, RelayState, and the end-to-end timeout.
  • Bridge sends unsigned requests and accepts FaceSign’s fixed unspecified AuthnContext.
  • Both teams have agreed on synthetic fixtures and expected pass and non-pass results.
  • Silverfort has documented its deny, timeout, and unavailable fallback without treating any of them as Success.
  • The receiving SP is ready to run the response validation checklist.