A customer has the requirement to use SAML authentication on AEM using their SAML 2.0 compatible IDP. Example: AEM: www.wknd.com/content/siteB/index.html IDP: https://www.idpB.com How should an AEM Developer configure their SAML Authentication Handler?

To configure the SAML Authentication Handler for a specific site path, the path property must be set to that content path (e.g., /content/siteB). This ensures the handler is only invoked for requests under that path. The idpUrl property must be configured with the URL of the Identity Provider (IDP) to which AEM will send authentication requests. Option B correctly uses these two essential properties to meet the customer's requirement of scoping a specific IDP to a particular site within AEM.

A. The assertionConsumerServiceURL is the endpoint on AEM (the Service Provider) that receives the SAML response from the IDP; it should not be the IDP's URL.
C. The serviceProviderEntityId is the unique identifier for the AEM instance itself, not the URL of the Identity Provider. The userIntermediatePath specifies where user nodes are created, it does not scope the handler.

1. Adobe Experience Manager 6.5 Documentation, Security Guide, SAML 2.0 Authentication Handler: This official guide details the configuration properties for the SAML handler.

Section: "Configuring the SAML 2.0 Authentication Handler"

Details: The documentation explicitly states:

Path (path): "Repository path for which this authentication handler should be used by Sling. If this is empty, the authentication handler is disabled." This confirms its use for scoping the handler to /content/siteB.

IDP URL (idpUrl): "URL of the IDP where the SAML Authentication Request is sent." This confirms its value should be https://www.idpB.com.

Assertion Consumer Service URL (assertionConsumerServiceURL): "URL on the SP which will receive the SAML response." This confirms it is an AEM-side URL, invalidating option A.

Service Provider Entity ID (serviceProviderEntityId): "The ID which uniquely identifies this service provider with the IDP." This confirms it is the AEM instance's ID, invalidating option C.