SSO Configuration
MD Live supports SAML SSO in both a test and a production environment. Staging is the designated test and UAT environment for MD Live.
Setup Steps
Section titled “Setup Steps”- Share your IDP details. Send the MD Live team your IDP Entity ID and signing certificate for both Staging and Production.
- Configure your IDP for Staging. Use the protocol requirements, the Staging values and the SAML attributes for your integration option.
- Test SSO in Staging.
- Go live. Switch your IDP to the Production values.
Protocol Requirements
Section titled “Protocol Requirements”| Item | Requirement |
|---|---|
| Initiator | Client’s SAML2 IDP. MD Live Fed-SSO supports only IDP-initiated SSO. |
| Protocol | SAML 2.0. Earlier versions of SAML are not supported. |
| SAML Profile | Web Browser |
| SAML Binding | HTTPS POST |
| Transport | All SAML SSO HTTP requests must use a TLS/HTTPS connection. |
Assertion Signing
Section titled “Assertion Signing”The Assertion of the SAML Response must be signed with an x509 certificate.
| Environment | Certificate |
|---|---|
| Pre-production | A self-signed certificate is suitable. |
| Production | A CA-signed certificate is recommended. A self-signed certificate is still acceptable. |
Assertion Security
Section titled “Assertion Security”| Method | Supported |
|---|---|
| SAML2 assertion-level Base64 encoding | Yes (Recommended) |
| SAML2 assertion-level encryption with the SP public certificate | Yes |
| SAML2 assertion attribute-level encryption | No |
| SAML2 assertion-level plain text | No |
To encrypt the assertion, use the MD Live SP certificate for your environment below.
MD Live SP Configuration
Section titled “MD Live SP Configuration”Staging
Section titled “Staging”| Item | Value | Notes |
|---|---|---|
| SP Entity ID | https://stage-sso.mdlivetechnology.com/shibboleth |
Audience in Audience Restriction. Case-sensitive. |
| Destination | https://stage-sso.mdlivetechnology.com/Shibboleth.sso/SAML2/POST |
Assertion Consumer Service. Case-sensitive. |
| Relay State | https://stage-sso.mdlivetechnology.com/sso/goto.jsp |
Not URL-encoded. |
| SP Metadata | MD Live SSO Staging SP Metadata (2027/02/05) | Installing the SP metadata in the IDP server is not required. |
| Certificate | MD Live SSO Staging Certificate (2027/02/05) | Used by client IDP servers to encrypt the SAML2 assertion. |
Production
Section titled “Production”| Item | Value | Notes |
|---|---|---|
| SP Entity ID | https://sso.mdlive.com/shibboleth |
Audience in Audience Restriction. Case-sensitive. |
| Destination | https://sso.mdlive.com/Shibboleth.sso/SAML2/POST |
Assertion Consumer Service. Case-sensitive. |
| Relay State | https://sso.mdlive.com/sso/goto.jsp |
Not URL-encoded. |
| SP Metadata | MD Live SSO Production SP Metadata (2027/02/09) | Installing the SP metadata in the IDP server is not required. |
| Certificate | MD Live SSO Production Certificate (2027/02/09) | Used by client IDP servers to encrypt the SAML2 assertion. |
The SP Entity ID is the name (EntityID) of the MD Live SP server and must be configured in the SAML2 assertion as the Audience.
Opening the URLs in a Browser
Section titled “Opening the URLs in a Browser”If you open the SP Entity ID, Destination or Relay State URL directly in a web browser, you will see the following error pages. This is expected.
| URL | Staging | Production |
|---|---|---|
| SP Entity ID | 404 Not Found | 404 Not Found |
| Destination | MD Live Page Not Found error | opensaml::BindingException error |
| Relay State | MD Live Page Not Found error | Unknown or Unusable Identity Provider error |
Automatic Sign-Out
Section titled “Automatic Sign-Out”To sign members out of MD Live when they sign out or time out in your web portal, add the following hidden iframe to your portal’s sign-out page.
Staging (Test/UAT)
<iframe src="https://stage-members.mdlivetechnology.com/login/logout" style="display:none" id="mdlive-logout" />Production
<iframe src="https://members.mdlive.com/login/logout" style="display:none" id="mdlive-logout" />Update Your Signing Certificate
Section titled “Update Your Signing Certificate”MD Live supports dual certificates for your IDP. During the update, both the existing and the new certificate are trusted at the same time, so authentication continues without disruption.
Before You Start
Section titled “Before You Start”Send the following to MD Live:
- Updated production certificate
- IDP entityID
- MD Live deploys dual certificates. MD Live deploys both the existing and the new certificate to the Production environment for your IDP server, and lets you know when it is done.
- Test the current certificate. Perform an SSO login test in Production as soon as possible, to verify that the current certificate still works and the user experience is not affected.
- Deploy the new certificate. Deploy the new certificate on your IDP server on your preferred schedule, before the current certificate expires.
- Test the new certificate. Perform another SSO login test in Production to confirm that authentication works with the new certificate.
If you encounter any issues with the MD Live SSO experience during testing or after deploying the new certificate, contact your MD Live account manager.