Use the username in subject of SAML request

[KUMAR Hemant]

Dear Support team,

We are using the Shibboleth IDP to enable the SAML compliant interface in our custom authenticator and use this SAML IDP as the 2nd factor in the authentication flow. In the authentication run flow when the 1st factor validates the user and send the user name in the SAML request like

"<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://citrix.smartchiponline.com/cgi/samlauth" Destination="https://test.gluu.com/idp/profile/SAML2/POST/SSO" ForceAuthn="true" ID="_feb694ab8acf20a3d60cde571407c681" IssueInstant="2021-07-06T09:31:36Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" > <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://citrix.smartchiponline.com/</saml:Issuer<https://citrix.smartchiponline.com/%3c/saml:Issuer>> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /> <ds:Reference URI="#_feb694ab8acf20a3d60cde571407c681"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>XxkQu/3FfWGJL3LjOmMCfP08sQgV7L0/uJDaOI/HhWY=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>VZbFGZ63w7bjciUQ0lm95/3YaA0N+f6j0cIT10+B86mWV3beYRuh7nusrV+F3DBQEJX31MZjaSGj/cpRHR1w9g==</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>MIIDVDCCAv6gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCSU4xEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMRcwFQYDVQQKEw5OZXRTY2FsZXIgSW5jLjEZMBcGA1UECxMQU1NMIEFjY2VsZXJhdGlvbjETMBEGA1UEAxMKd3d3Lm5zLmNvbTEkMCIGCSqGSIb3DQEJARYVc3VwcG9ydEBuZXRzY2FsZXIuY29tMB4XDTIwMTIxMTE2MjUxOFoXDTIxMTIxMTE2MjUxOFowcTELMAkGA1UEBhMCSU4xCzAJBgNVBAgTAklOMQswCQYDVQQHEwJJTjEaMBgGA1UEChMRc2NscmVtb3RlLnNjbC5jb20xGjAYBgNVBAsTEXNjbHJlbW90ZS5zY2wuY29tMRAwDgYDVQQDEwdHVyBjZXJ0MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJzG4+JuiX0iUNxFSfJPxCEsmtvelddaY86GZTGyG9e6uidnSs1h6VQWivKAWBd79YmgW+TyYXbCrVPkzFCyDBkCAwEAAaOCAUgwggFEMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMC4GCWCGSAGG+EIBDQQhFh9OZXRTY2FsZXIgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSZQFewgEmqJtIKkos5J2aDGh6pVjCB1AYDVR0jBIHMMIHJgBSjw4W9fgUKtNa2bhCbsufdVNfR8qGBraSBqjCBpzELMAkGA1UEBhMCSU4xEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMRcwFQYDVQQKEw5OZXRTY2FsZXIgSW5jLjEZMBcGA1UECxMQU1NMIEFjY2VsZXJhdGlvbjETMBEGA1UEAxMKd3d3Lm5zLmNvbTEkMCIGCSqGSIb3DQEJARYVc3VwcG9ydEBuZXRzY2FsZXIuY29tggEAMA0GCSqGSIb3DQEBCwUAA0EATjDd6YDbKxAmmkMkv4FrW6h6NQYoXsEVhKoSMTMDmsJMilJCy/J2oqZDrtdW9eGu6iqBZI5C76SMVlzlnmMhlw==</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">scl1832</saml:NameID> </saml:Subject> </samlp:AuthnRequest>"

Right now in our SAML IDP authentication user need to input the username again, we want to reuse the value passed in the Subject field of the SAML request, can you guide has how we can configure the same in Shibboleth IDP.

Regards
Hemant


IDEMIA Internal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/aa2eea65/attachment.htm>