Remove Address from SubjectConfirmationData

[Nate Klingenstein]

Tony,

Technically, it's spec-legal and all that you write is accurate.  Check 4.1.4.2:

https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf

and this was never changed:

https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.pdf

I'm not aware of a way to stop the IdP from sending it.  If there were an elegant, well-supported way, I would have expected to find it where you looked, and the code doesn't look like there are any hooks other than fiddling with the source itself.

/system/flows/saml/saml2/sso-abstract-flow.xml:

    <action-state id="BuildResponse">

...

        <evaluate expression="AddSubjectConfirmationToSubjects" />
...

The corresponding bean:

    <bean id="AddSubjectConfirmationToSubjects"
        class="org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects" scope="prototype"
        p:httpServletRequest-ref="shibboleth.HttpServletRequest"
        p:method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />

Might be a feature request.  Might get turned down.

Best of luck,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Plovich, Tony via users
Sent: Friday, February 5 2021, 3:16 pm
To: users at shibboleth.net
Cc: Plovich, Tony
Subject: Remove Address from SubjectConfirmationData

Hello,

I'm attempting to federate with a broken SP that isn't seeing the correct client source for the the Address attribute in SubjectConfirmationData.  Watching the assertion, Address is set correctly, but their logs say it's a mismatch.  I'm thinking their ACS
 is located behind a load-balancer / reverse proxy that's changing the client's source IP.  They claim the other IDPs they've federated with don't populate Address.

Is there a way within Shibboleth to prevent Address from being added to the SubjectConfirmationData?  My searches of the wiki haven't turned anything up, except the checkAddress RP profile config (https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11 <https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11>). 
 However, this appears to be for messages coming into the IDP, not leaving.

I get that this is in place to prevent someone from hijacking your assertion and SP session, but I need to investigate whether this can be done regardless.

Thanks,

Tony Plovich

Business Information Systems

Argonne National Laboratory

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net