> ## Documentation Index > Fetch the complete documentation index at: https://idp-docs.facesign.dev/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Silverfort Bridge > Inputs and SAML request settings for the Silverfort Bridge pilot.

What FaceSign needs from Silverfort

Transfer these inputs through the agreed private partner channel before UAT: * The Silverfort sandbox SP metadata XML, exact case-sensitive entityID, and exact HTTPS POST ACS. * One sanitized, actually emitted HTTP-Redirect AuthnRequest capture and one sanitized, actually emitted HTTP-POST AuthnRequest capture. Each must include decoded XML and the outer query or form fields, including `RelayState` and whether `Signature` and `SigAlg` are present. * Whether Bridge requires signed AuthnRequests. If it does, include the SP signing certificate and required signature and digest algorithms. Signed AuthnRequests are a pilot blocker. * The exact Bridge sandbox version and build, plus the returned `facesign.*` attributes the build consumes. * The exact synthetic Subject value shape, NameID format, `NameIDPolicy` omission or format behavior, and expected returned NameID. Do not use a real workforce identity. * The actual `RequestedAuthnContext` element, its `Comparison`, every class reference, and confirmation that Bridge accepts FaceSign's fixed `unspecified` response context. * A representative sanitized `RelayState`, its shape, and the maximum size Bridge emits. * Bridge's request-generation and response-validation clock-skew allowances. * One exact pilot policy trigger and its expected allow, deny, timeout, and unavailable outcomes. * The end-to-end timeout from policy trigger and request issuance through fallback or recovery. * Named technical, policy, evidence, and escalation owners on both sides. Keep their names in the private worksheet, not in these public docs. Send the SP metadata unmodified through the agreed private partner channel. Its entityID, ACS, certificates, bindings, and structure are the configuration FaceSign must review; if they expose a sensitive tenant or customer hostname, keep the file private instead of editing those fields. In the captures, remove real user identifiers, credentials, RelayState secrets, and private keys. Preserve the exact entityID, ACS, binding envelope, algorithms, and XML structure so the captures remain reproducible. Do not commit these artifacts to the public repository. Registration is coordinated with FaceSign. Sharing these inputs does not create or activate a registration automatically. ## Import FaceSign metadata Copy this URL into Bridge's IdP metadata setting: ```text theme={null} https://idp.facesign.dev/api/saml/metadata ``` Open FaceSign IdP metadata as raw XML ↗ The metadata publishes the IdP entityID, signing certificate, SSO endpoint, Redirect and POST request bindings, and `WantAuthnRequestsSigned="false"`. ## Register the Bridge sandbox FaceSign registers the exact entityID and HTTPS ACS supplied by Silverfort. SAML responses use HTTP-POST to that ACS. If an AuthnRequest supplies `AssertionConsumerServiceURL`, it must match the registered value exactly. Use an isolated, non-authorizing sandbox for UAT. Do not reuse a production entityID, ACS, or person identifier as a public fixture. ## Send unsigned AuthnRequests The deployed IdP rejects signed AuthnRequests, including requests with embedded XML signatures or Redirect/POST signature parameters. Configure Bridge to send unsigned requests. If Bridge cannot disable signing, record that as an integration blocker before UAT. ## Supported AuthnRequest shape The deployed IdP accepts HTTP-Redirect and HTTP-POST with these limits: | Field | Deployed rule | | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ID` | Required; maximum 160 UTF-8 bytes. Emit a fresh unique ID. Deployed v3 does not reserve or reject duplicate AuthnRequest IDs. | | `Version` | Must be exactly `2.0`. | | `IssueInstant` | More than 60 seconds in the future or more than six minutes old is rejected. | | `` | Must exactly match the registered entityID. | | `Destination` | May be omitted. If present, it must match `https://idp.facesign.dev/api/saml/sso`. | | `AssertionConsumerServiceURL` | May be omitted. If present, it must match the registered ACS. | | `ProtocolBinding` | May be omitted. If present, it must request HTTP-POST for the response. | | `IsPassive` | `true` and `1` are rejected because verification is interactive. | | `AssertionConsumerServiceIndex` | Rejected. Use the registered ACS URL or omit the URL. | | Encoded `SAMLRequest` | Maximum 256 KiB. | | Decoded or inflated AuthnRequest XML | Maximum 1 MiB. | | `RelayState` | Returned unchanged; maximum 2,048 UTF-8 bytes. It is application state, not identity evidence. | | Subject NameID | Subject may be omitted. If present, use at most one Subject containing exactly one plain-text NameID; maximum 256 UTF-16 code units in a format published in metadata. | Capture Bridge's actual `RequestedAuthnContext` `Comparison` and all class references. FaceSign accepts at most one `RequestedAuthnContext` container. It accepts class-reference requests, rejects declaration references, and always returns `urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified`. Bridge acceptance of the fixed `unspecified` context is a joint UAT criterion. This abridged example is unsigned and intentionally omits ``: ```xml theme={null} https://bridge-sandbox.example.invalid/saml/metadata ``` ## Optional sandbox Subject echo Without Subject, omit `NameIDPolicy` or request transient or unspecified; FaceSign returns a transient, session-scoped NameID. With approved sandbox Subject echo, the Subject must contain one plain-text NameID in a format published in metadata. `NameIDPolicy` may be omitted or match that format. `SPNameQualifier` is not supported. FaceSign trims surrounding whitespace, then returns the value and approved format. The echoed value is unsigned correlation input. It is not FaceSign identity proof and cannot authorize access. Before enabling echo, agree on a synthetic Subject such as `pilot.user@example.invalid`, its exact format, and the expected returned NameID. Never place a real workforce identifier in a public fixture. ## User and browser experience Bridge redirects the browser to FaceSign. The person grants camera permission, completes the avatar-led flow, and returns to the registered ACS. Silverfort must tell FaceSign the end-to-end timeout and decide how its UI handles a denial, an expired flow, and an unreachable IdP. FaceSign's overall authentication deadline is five minutes. ## Pre-UAT checklist * FaceSign has coordinated registration of the exact sandbox entityID and HTTPS POST ACS. * Silverfort has confirmed all bindings, request-signing behavior, Subject and NameID behavior, `RequestedAuthnContext`, `RelayState`, and the end-to-end timeout. * Bridge sends unsigned requests and accepts FaceSign's fixed `unspecified` AuthnContext. * Both teams have agreed on synthetic fixtures and expected pass and non-pass results. * Silverfort has documented its deny, timeout, and unavailable fallback without treating any of them as `Success`. * The receiving SP is ready to run the [response validation checklist](/response-contract#validation-checklist).