<div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px">Hi all,</span><br style="font-family:arial,sans-serif;font-size:13px"><br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px">I'm looking to ask a question about opensaml and was told that this is the place to do so. </span><br style="font-family:arial,sans-serif;font-size:13px">
<br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px">My team is using opensaml 2.5.3 to generate saml tokens for a project we are working on. Currently, our SAML token's look like this:</span><br style="font-family:arial,sans-serif;font-size:13px">
<br style="font-family:arial,sans-serif;font-size:13px"><p style="font-family:arial,sans-serif;font-size:13px"><?xml version="1.0" encoding="UTF-8"?></p><p style="font-family:arial,sans-serif;font-size:13px">
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"</p><p style="font-family:arial,sans-serif;font-size:13px">Destination="destination location"</p><p style="font-family:arial,sans-serif;font-size:13px">
Version="2.0"></p><p style="font-family:arial,sans-serif;font-size:13px"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</p><p style="font-family:arial,sans-serif;font-size:13px">
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"</p><p style="font-family:arial,sans-serif;font-size:13px">xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:assertion"><a href="http://our.schema.location.com/" target="_blank">our.schema.location.com</a></saml2:Issuer></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"></p><p style="font-family:arial,sans-serif;font-size:13px">
<ds:SignedInfo></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>" /></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:Reference URI=""></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:Transforms></p><p style="font-family:arial,sans-serif;font-size:13px">
<ds:Transform</p><p style="font-family:arial,sans-serif;font-size:13px">Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></p><p style="font-family:arial,sans-serif;font-size:13px">
</ds:Transforms></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>" /></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:DigestValue>rocEKkS/8cZ/My3cEPFtURhSW/Y=</ds:DigestValue></p><p style="font-family:arial,sans-serif;font-size:13px"></ds:Reference></p><p style="font-family:arial,sans-serif;font-size:13px">
</ds:SignedInfo></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:SignatureValue>U1aGdRLm4GmQiNkD/W9ORZLoNpiv1yOsYoad+XveRT4HqDG+UpigMImSYRI7wGTDGHkeK1noy3jusEhNzzBIT91lGjrrFyuSkDFMBetrdmJJFeDGCQ5s60iD6OFhlkhSB4iCgaTRtBvT44ligFGHeJuLfXlL7qyGkiROCF4mjAVjmhj97TCQS+xJhKVkfEFgIdBGlXTYZFiAz090SElzRClQIcozT4+SJRkLRL3GrcWqX1awRm826DPoMAZri9f1qjqFFYL7zpbAQScaezi8DxbvziLRJykp11hKnau2EoWp9o627XgDvD5Bvu7Fa95J3wuzTZHaRcRuY/t+tzJpaA==</p>
<p style="font-family:arial,sans-serif;font-size:13px"></ds:SignatureValue></p><p style="font-family:arial,sans-serif;font-size:13px"></ds:Signature></p><p style="font-family:arial,sans-serif;font-size:13px"><saml2p:Status></p>
<p style="font-family:arial,sans-serif;font-size:13px"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></p><p style="font-family:arial,sans-serif;font-size:13px"></saml2p:Status></p>
<p style="font-family:arial,sans-serif;font-size:13px"><saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:EncryptedData xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>"</p>
<p style="font-family:arial,sans-serif;font-size:13px">Id="_a04f85fb05fda175a5e7eba026640f16" Type="<a href="http://www.w3.org/2001/04/xmlenc#Element" target="_blank">http://www.w3.org/2001/04/xmlenc#Element</a>"></p>
<p style="font-family:arial,sans-serif;font-size:13px"><xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc" target="_blank">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>"</p>
<p style="font-family:arial,sans-serif;font-size:13px">xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>" /></p><p style="font-family:arial,sans-serif;font-size:13px">
<ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:RetrievalMethod Type="<a href="http://www.w3.org/2001/04/xmlenc#EncryptedKey" target="_blank">http://www.w3.org/2001/04/xmlenc#EncryptedKey</a>"</p>
<p style="font-family:arial,sans-serif;font-size:13px">URI="#_9b07dd8a259d8ee8162adf17cd761d34" /></p><p style="font-family:arial,sans-serif;font-size:13px"></ds:KeyInfo></p><p style="font-family:arial,sans-serif;font-size:13px">
<xenc:CipherData xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>"></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:CipherValue>mGrwQumPCnQotiGSzCQbmG5V3e2pipVwYlesoLEsesmSWGxJ5AjXTOvLZeY35qeTv4/UYSLGq1v3QyBDmXLccdfztYsZfHAqau9oh4alyF/uC+h0SIW03gnlKJQ1XabCy0qIqBj6W3xqKzRAwlqC7uL34LqbBaoFIcl6SCf2Bime7zQVN/eU0vWXefFetlrMA6at51UdFvEUe37MAORoK54LdP5QB6LR5PatORwQ+XupsGV4fs9x0fTJdQ+S1sjJnOZ9K7Kau8zFxy2Y4KIMybzIwMTZzun95QRJczWcArOYVo8VueqsmveUAKMjt3XPYQl4YoIrLk7k6fCNi1CLw5VVDmHxaBAXVMA7jOwbPPZYHIYkMXEMZmcpGewtj8a0WDTwgQpA1Mhzvyfn90PHhQaWb9zfPaXqredKVY8n/VK1UhghSMlnByVJNz5KFyQLD8FoFpYORuPvU7szrOSTO3/MO6NA7n4/dvgbBnqCjFaJaBhyFOBjrvslZ8+O3jSZbX+Y2GVgpfNEwjmoqsw+tPeg55cAHjE3fv9rewkkLpQ1EE+TlHE0MXKMCmqoblp0wSt5iWN0EJSmKiNA7caZVcABZHx+eZ/lmr33E00WAQovgoShenXg96rZLREu+Fa+yP/GEruiuX0+Co6+qdY9cFLebtWy/cimKixV37Lnz07+WBEGNlJNj8NdWuDN5cvdaZzEJtNdhduLbvwShtQuyrL4DIesLCt5LHmRLuahVCAyVoeE0cjnBz+/57k7G9kTGys0EnVP2TKfHP3sAsAQ3PneGgxSurZLLGuJZQz6fRLmZXGH2hXZ/lEQYH1nNl0udVTDOPD/nki8G7SmXvGV+oyLyGjnNyIfgeUCbCD28sEthIQK3g15+vxeBlY4k6HicgcoEayOOAMkd4uhwz8ffxHP5M3iM2KHqR6Fu61IiUrTSjhAlocW1wu2RS0ueTBzHV56Iv+WgSawyWQrTXDSR1C0k8b4twh8PDeQRuSMsYfsrP8je1dIlRC/a+t2flasTYSvfb+U0ks/ubBTXa7rmkhl2+63QX375v5c4R9vsRMUmv3HNmXiluFxx9cSrNzYgS+8J2/vEtLumr48vnz1kGN5OiPbyP8eDanGvSKXBDeglc4d+EfxaVgp3Xc7RpzM8MIsKtPMP+kUoXq0JMvasU9biyzB00f0b3+1bEDOIG5x/xqvtPyXPZJ+vZC/MjHqq559BBlEd7Qaes4v+xUfP1w3Cn1sf1iSNud+JBQNpPP2suQL5Kyun0W5x50HxyVl2aG1GAq0DnGgIP+3jPhaHnYr6XIzhua1ZOJ3ZwkNcyeJ9PwCTmoKywJU1S0cQ61/dfxxssXR+2xEpu7JBukzrZ6DenUJ+352u+M0rigXXDoyQqWQGgnXOTiyJ5VfVVSn/HEoUHA1Gi5DX1EWNeIeOz14rUstMCkfl0JOacZKgefjPupYVqzCUuVb/OVi7UpMlwaFiloyj8MVJOf70p9s9NhoNMbA/TZc61wNSWfJl2rY7StbCsCtXHy9gq1W1loL16A+mngXRn9Fii4n1WIjiwY8iuBTRsWDCg/n5W5b5ke4gkmMnsVLeKJG218w9qVHeGbQ8MQSGCEatYTrMqjoqcJgxYm+E7JfXvfibDpQrAJlExyMdr4YcxUOXjgywdbySd4HQT5ZYgp9r+jwK5JFzjlWQhjtTc/1A4YnPfu/IKiU3r4xE7Hjud3DEEpHlwsSCmMMaN+5+M1+/ZUg5A6GPZ2fAfYe+QW8Bhj9WtoKR8RY3gia/v+IcQELR8/WW7y7D3bmRtUATPSzSGtwSdJoyg2hf/ZEazzpZNqwP+W3Vdgwh9hVX3K9DjSC4NuSrVaiu45Ut8KlPItD/BwQaoVjSGV97Y8giz3VvznF1SbjxVouG7IN8iaZNHHS0gwnnhzJ8KZj46pIw0AAn/jpXKutY1P9OcojAdtHi0dNF4l6CXjyrOMQlaKmnkV4ZrOEk7M/A2y1yY8UrIBwqV3lWvuMSohShw5t4deskmJg4mflN8Lpgj2ah75WfMBFN+12BDyNbUJATGse5dnGNAyKMsvervmKnYzAjO2Ri+uXtSJTQ0DxeKtFtw3Cjox+FydAxlwRyVGbGSl7s7gIaGKKYl5wQXQJaFwzsEvBWssNVTFamy9H5YU5nYYrBXcj6Y9kuuOBv/LMH1gmVqL81ujSZtxrg5nQrPn427J7TFyu3gM0NqQdHlZsafFp0ZUDEokY+HZSRO8a5AO1fZWirkcxbe5DUWMTMVm0KJ/pQ95VbIxFk0V5uDV4YTEvn0VQfnNduYdc6Pe+vSYOaHbpWchugazDLW66ZpL3W/R9/G0ELBoJmEmQ1qpTXa+i/bjkjigfsYUSpm0g7nzRBXk+dbbUy0gkyQNtozABZF3wTeFPN4uD8nLIZlzIDp1bEjsFYiV0iixzyW1wfz+rCcRrfBFQMijnQSxm7QrAttwC/MCdMLnbL3/QQspqx5wuRs24lfrp+26BBfv82GGTqsRHxU5/5nfY3w0ccsCE2l6hlsL26/pNg/1MWTm4+0CYInjAZKWF19lYdFQzLE3JWzUQCmlZEvjvWNhC3uxnVs+cRrZEnmW90/Ldg8VZ4jrFJ2+IF6UNJVHgD9vmJJ0XWpki8Qj81oFa3Bj0gMhwiH/uVeCKErO9svH7Q6vcFg1sENh2puidMdMfApiCqR536kcwai5gA9ImhlaZLkmfpSf2TaluhoCrMCcmYRVCeflevxpKSQAqQYxUjWq/rA6PwbjrXYMP8ZPh3k1d2tNDIq34AeOJs5x2uR5HECBP0e+E6eRhtzAPurAlDQg3Xebw/r8Fd+LS/xm7aMRyBY6xO6r9X9kqMUqsFPYubGDkDHI6iU7dH/PdviDyLQ6i4zEcxBwpmQGbUjRAbQvEWB6GvmQo8u5jimoE/yUpzNonIeMbNnw6LlbZ2d0BnhvKfWChew8rLBHyRocZK5C6AEwuqrs3yXNYfaZnwOm+nbxkQPjH5rVymZBF7jsccJ1YZWotjuNy1stIzh/zu0QR1ps2Yy5I2rNnC+PQMNRoQgg/gc4ajyXxG4hsc+0+6y4PsSLkA9MpHBf2+w1/cK6Y0OIlxBpV4K7H7ZrO/r5nAgHN1n7tTvOADcNXSFz4F0HZQp/Td3e+yOvAPFZu8t076FTWYcchmkBbRmaDEZYFEa0MHBYxVaAey4/14xH5aWilOUggiZtVpYUPN79DX0MXctvbY/xTsvWXZx9uPOOPVfXf74mt8Z5Dsx3zLLYzLbkd6+WIzQ3IJOh/4hp9SL1N3Y50VRQkg52oCxSdwGKpPDzxPpi6G0lXBZW7BzG4JAr7rFWC8M3V0MY7aOGNepHKsAI0ypBKQLA2xRihwq+qxxHU4DNAeurW/z6kP0nja55YlFQZF0csw46f6aNKlGxIwZVeQgzx1uNWn2g9b2fIUHNs8YuU6NMHDKDXVefXvXDONVwhmMgowvNKXhj2aTBOMJce/5uL86vHDrCoZVZx+L08liRN6ePCvN8BNkpgqT8ydnRxxWLQtYZQSWKymUJ8B6MJh3fPs+TMj5rPMxQ0Du5VXYxBsm90HnSb3b5ngDSoTKhkcT83RPBrA5z1KFf7KpA1JYp0CnmnYD58jlL2HccOXiyQSPGmwJiepHm/yDu4tcALpFDA9f6HjzpZnsV0hg6DHLT263vZbF/DB+8=</p>
<p style="font-family:arial,sans-serif;font-size:13px"></xenc:CipherValue></p><p style="font-family:arial,sans-serif;font-size:13px"></xenc:CipherData></p><p style="font-family:arial,sans-serif;font-size:13px">
</xenc:EncryptedData></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:EncryptedKey xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>"</p>
<p style="font-family:arial,sans-serif;font-size:13px">Id="_9b07dd8a259d8ee8162adf17cd761d34"></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5" target="_blank">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a>"</p>
<p style="font-family:arial,sans-serif;font-size:13px">xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>" /></p><p style="font-family:arial,sans-serif;font-size:13px">
<ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"></p><p style="font-family:arial,sans-serif;font-size:13px"><ds:X509Data></p>
<p style="font-family:arial,sans-serif;font-size:13px"><ds:X509Certificate>MIIC4DCCAcigAwIBAgIEUUrqgDANBgkqhkiG9w0BAQUFADAyMTAwLgYDVQQDEydCRFNQVUtMNzAz</p><p style="font-family:arial,sans-serif;font-size:13px">NDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20wHhcNMTMwMzIxMTEwOTUyWhcNMTQwMzIxMTEw</p>
<p style="font-family:arial,sans-serif;font-size:13px">OTUyWjAyMTAwLgYDVQQDEydCRFNQVUtMNzAzNDIzODUuY2xpZW50LmJhcmNsYXlzY29ycC5jb20w</p><p style="font-family:arial,sans-serif;font-size:13px">ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCmWG7p7iATCM06WMsKg8LlLg8AXUvyZI6l</p>
<p style="font-family:arial,sans-serif;font-size:13px">hZkz7Sc/moL6WtSUBrL60joLAi4L+P/VrbtZMNzP9kh3uyW0uZ0Vb+DhsXMQBccgdQMzq//nK2GN</p><p style="font-family:arial,sans-serif;font-size:13px">0+/F4KYKLsdYpecR28YlOQRl2Y6Gc3i8PZIk2a8bmf64tbOCyOWHzX7fNHo+MSM3JcWOLltFKZCT</p>
<p style="font-family:arial,sans-serif;font-size:13px">z8O8OJjhFqxA7fl+zLBEXprJZtxU/AOaLW6qBPh8w1LmIfU8nK5bnjlKpdobV8uXlXkKVOJWxm1P</p><p style="font-family:arial,sans-serif;font-size:13px">yjQDt1G1FKyBKLmyPbw9xY5DSDmQFpwgeZIQdOkRrrYzwYzYFCuqL9USjPw6414kYqBNr221SWei</p>
<p style="font-family:arial,sans-serif;font-size:13px">pLjbAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAILQ69plSMdO8/3nx5ZJPMWSS2MqFlThAoMW0kmK</p><p style="font-family:arial,sans-serif;font-size:13px">20DBH5o3b+6BZ4d566IEGRReOOFVxMKNbuq3thrIliUQG0Qzzu0T41UE7noFXwZOwavYxhy1BdwW</p>
<p style="font-family:arial,sans-serif;font-size:13px">B906CAb0Qq7qu1FXd8PVKzLn7IazaPXSuRkhGmoE4vcRVphRZkzU6xjkfEZ5AO+7qVE/5tcREXAB</p><p style="font-family:arial,sans-serif;font-size:13px">coxpqWeTVeZiT0oazx7eWyqVlqSaLboOqByk5O921hY4E7PZaS7HGBXHcywVHU9fXwbEIgNl0noC</p>
<p style="font-family:arial,sans-serif;font-size:13px">sduXcYkjC6WEiV8rQiuBXx5bspPkau28V+GQ1kNwuq5ypEskDW3GHUrZiAmaucooahVzvhDiBM0=</p><p style="font-family:arial,sans-serif;font-size:13px"></ds:X509Certificate></p>
<p style="font-family:arial,sans-serif;font-size:13px"></ds:X509Data></p><p style="font-family:arial,sans-serif;font-size:13px"></ds:KeyInfo></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:CipherData xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#" target="_blank">http://www.w3.org/2001/04/xmlenc#</a>"></p>
<p style="font-family:arial,sans-serif;font-size:13px"><xenc:CipherValue>LhIn8/SjXbnCsMP6ITxb++0rFYpN8S0L6K/VE74XKjh4Jtlo8IaZQi6c9HRqlII/VT5OKaVySNCO2wOaKS/EUsTt5a/0oR9Yh9mCLt9NQDpkxau1OiydwTYoo6G29fFpYgeDXEPrdR4iUlOERuulmFlNTETWu/doHb4b6hFZdsLEtQH1qSi/jBIq2Q7peXI396G8RWDoWO1urJtIQWR5HjqDckcp3eQ2AC3mXkm949g+OS3Y3g/dPi5erkAhNmFXdinOnX6SQWHEBhFkroFfzqkzEPOVlJdL5Rb9X1mgEk5tJefSUChs6HguRqMeMr0s4UFi/KUwlZbINio1hSNTZg==</p>
<p style="font-family:arial,sans-serif;font-size:13px"></xenc:CipherValue></p><p style="font-family:arial,sans-serif;font-size:13px"></xenc:CipherData></p><p style="font-family:arial,sans-serif;font-size:13px">
<xenc:ReferenceList></p><p style="font-family:arial,sans-serif;font-size:13px"><xenc:DataReference URI="#_a04f85fb05fda175a5e7eba026640f16" /></p><p style="font-family:arial,sans-serif;font-size:13px">
</xenc:ReferenceList></p><p style="font-family:arial,sans-serif;font-size:13px"></xenc:EncryptedKey></p><p style="font-family:arial,sans-serif;font-size:13px"></saml2:EncryptedAssertion></p><p style="font-family:arial,sans-serif;font-size:13px">
</saml2p:Response></p><p style="font-family:arial,sans-serif;font-size:13px"><br></p><p style="font-family:arial,sans-serif;font-size:13px">However, a colleague from another team has informed us that it is possible to hide the X509 certificate from a SAML token and replace the X509 certificate information with a "KeyName". Is it possible to configure the opensaml implementation to make this happen? I have worked out how to add the KeyName field to the token, but not how to do this and remove the X509 certificate.<br>
<br><br>Thanks in advance for the help.<br><br>Kind regards,<br>Ben Green</p></div>