IDP rely configuration - Adobe suggests a modification of default behaviour - any hints?

Dr. Guenther Schreiner guenther.schreiner at hs-karlsruhe.de
Mon Feb 11 10:07:08 EST 2019


During implementation of a Adobe contract, the software provider
suggests
(https://helpx.adobe.com/de/enterprise/kb/configure-shibboleth-with-adobe-sso.html)
to modify the default configuration relying-party.xml to:
        
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
    <property name="profileConfigurations">
        <list>
            <bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" />
            <ref bean="SAML1.AttributeQuery" />
            <ref bean="SAML1.ArtifactResolution" />
            <bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:postAuthenticationFlows="attribute-release" />
            <ref bean="SAML2.ECP" />
            <ref bean="SAML2.Logout" />
            <ref bean="SAML2.AttributeQuery" />
            <ref bean="SAML2.ArtifactResolution" />
            <ref bean="Liberty.SSOS" />
        </list>
    </property>
</bean>

 This, of course, is not our intention to push the personal mail address
to any SP.

 Is there a reasonable approach to limit this behaviour to the Adobe SP?

Best regards,Guenther
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190211/de297141/attachment.html>


More information about the users mailing list