AuthenticatingAuthority element

[Cantor, Scott]

>  We have SAML2 proxies based on shib sp 2  and shib idp 3. To clean their acts
> the proxies would need to populate AuthenticatingAuthority element to
> follow the specification.  I am failing to find a feasible  way to do that. Is there
> a way to to have  AuthenticatingAuthority element populated with IdP 3?

There's nothing like a setting that just does it, no. That's a fairly simple RFE.

In the mean time, that's a bit tricky without modifying flows unless you assume unsigned assertions (meaning the default behavior, with the response signed). Assuming that, you probably could do this by plugging in an outbound interceptor flow with an action bean that adds this to the assertion, which is inside the outbound message context.

The outbound interceptor hook is empty/undefined in the SAML flows right now, so there's nothing particularly weird about hooking it, everything else should continue to work.

If you wanted to accomodate signed assertions, that's harder. You'd either have to be modifying the flows or you'd need to duplicate the signing logic itself and adding it to your outbound interceptor.

-- Scott