Clarion RP — Herald test app

SAML settings

Point at Herald’s hub IdP metadata. When signing is enabled, AuthnRequests include an XML-DSig Signature with X509Certificate for both bindings. Redirect binding also adds SigAlg/Signature query params.

This app’s public URL IdP metadata URL IdP SSO URL (Redirect) IdP SSO URL (POST) IdP entity ID IdP SLO URL (Redirect) IdP SLO URL (POST)

SSO binding

HTTP-Redirect HTTP-POST

AuthnRequest signing

Paste the cert and key, then Save. Clarion RP stores them under secrets/ next to this app (you do not choose a path). When both are present, AuthnRequests and LogoutRequests are signed, and SP metadata sets AuthnRequestsSigned="true". Re-import metadata into Herald after enabling.

SP signing certificate (PEM)

SP signing private key (PEM) (leave blank to keep the stored key) Clear stored signing material

Register in Herald

SP metadata

https://clarionrp.iamherald.com/saml/metadata

Entity ID

https://clarionrp.iamherald.com/saml

ACS URL

https://clarionrp.iamherald.com/saml/acs

SLO URL (SLS)

https://clarionrp.iamherald.com/saml/sls

Clarion Call URL

https://clarionrp.iamherald.com/clarion

IdP ready Signing ready POST binding