IDP rely configuration - Adobe suggests a modification of default behaviour - any hints?
Dr. Guenther Schreiner
guenther.schreiner at hs-karlsruhe.de
Mon Feb 11 10:07:08 EST 2019
During implementation of a Adobe contract, the software provider
suggests
(https://helpx.adobe.com/de/enterprise/kb/configure-shibboleth-with-adobe-sso.html)
to modify the default configuration relying-party.xml to:
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" />
<ref bean="SAML1.AttributeQuery" />
<ref bean="SAML1.ArtifactResolution" />
<bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:postAuthenticationFlows="attribute-release" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
<ref bean="Liberty.SSOS" />
</list>
</property>
</bean>
This, of course, is not our intention to push the personal mail address
to any SP.
Is there a reasonable approach to limit this behaviour to the Adobe SP?
Best regards,Guenther
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190211/de297141/attachment.html>
More information about the users
mailing list