Base64 image in SAML assertion

[MikeWho]

Hi all,

Am I right in thinking all attributes received in the SAML assertion (and
mapped in the attribute map) will ultimately be sent as headers in all
requests to the site? And thus, a Base64 encoded image in an attribute in
the assertion would be sent in the headers of every request? 

Hopefully we can put in place a policy that the image size is limited, but
if the images are already in place in AD on the IdP side we might not have a
choice. Base64 probably adds another 30-40% onto the size, which doesn't
help either.

For context:
In a new SAML integration we're looking to handle a Base64-encoded user
profile image as part of the assertion. We've done this previously in a
non-Shibboleth integration, but not yet using the Shibboleth SP.

Image size is potentially a problem (in any/all of Active Directory, the
IdP, Shibboleth SP, IIS, our back-end etc.). For instance I think the
'header' limit in IIS (MaxClientRequestBuffer) is set to 16K, which includes
all headers not just the individual header containing the image, so that'll
need to be increased. The bigger problem (above) is that we may be adding
bloat to every request.

Thanks for any help/comments!

 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Base64-image-in-SAML-assertion-tp7589623.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.