0

I have configured Shibboleth 3 to give the SAML response containing the following Attribute Statement

                <saml2:AttributeStatement>
                    <saml2:Attribute FriendlyName="uid"
                        Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                        <saml2:AttributeValue>vinay.joseph@cccc.cccc</saml2:AttributeValue>
                    </saml2:Attribute>
                    <saml2:Attribute FriendlyName="memberOf"
                        Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                        <saml2:AttributeValue>cccc\cccc-cccc-cccc</saml2:AttributeValue>
                    </saml2:Attribute>
                </saml2:AttributeStatement>

I like to if its possible to configure the attribute-resolver.xml so that the following xml Attribute statement is in the SAML response.

                <saml2:AttributeStatement>
                    <saml2:Attribute FriendlyName="uid">
                        <saml2:AttributeValue>vinay.joseph@cccc.cccc</saml2:AttributeValue>
                    </saml2:Attribute>
                    <saml2:Attribute FriendlyName="memberOf">
                        <saml2:AttributeValue>cccc\cccc-cccc-cccc</saml2:AttributeValue>
                    </saml2:Attribute>
                </saml2:AttributeStatement>

The contents of my attribute-resolver.xml

<resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple" sourceAttributeID="memberOf">
        <resolver:Dependency ref="StaticGroups" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:memberOf" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="memberOf" encodeType="false" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" />
    </resolver:AttributeDefinition>
    <!-- ========================================== -->
    <!--      Data Connectors                       -->
    <!-- ========================================== -->


    <resolver:DataConnector id="StaticGroups" xsi:type="dc:Static" xmlns="urn:mace:shibboleth:2.0:resolver:dc">
         <Attribute id="memberOf">
              <Value>cccc\cccc-cccc-cccc</Value>
         </Attribute>
    </resolver:DataConnector>
1

SAML 2.0 Assertion schema tells that "Name" attribute is required. So you can't do what you want to do.

<element name="Attribute" type="saml:AttributeType"/>
<complexType name="AttributeType">
    <sequence>
        <element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/>
    </sequence>
    <attribute name="Name" type="string" use="required"/>
    <attribute name="NameFormat" type="anyURI" use="optional"/>
    <attribute name="FriendlyName" type="string" use="optional"/>
    <anyAttribute namespace="##other" processContents="lax"/>
</complexType>  

In first place why do you want that?

https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf

0

I would say it is not possible. I used to hold for true the Name attribute to be the key of the attribute tag.

But:

  1. have you checked the xml schema if (as I think) Name is a required attribute?
  2. in any way, attribute-resolver is about fetching attributes. I don't think it's the right place to search the feature you are looking for;
  3. can you downgrade to SAML1? Just vaguely remembering the naming rules of attributes were weaker: maybe you can achieve something close to your objective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.