How to check Issuer existence in idp Response
Michele Innocenti
michele at etruriapa.it
Fri Jul 1 17:08:21 UTC 2022
Hi,
Is it possible to check the existence of saml:Issuer element of the idp
Response in the Shibboleth SP?
Not the saml:Issuer Assertion element.
So that, for example, this Response from the idp can be refused by
Shibboleth SP:
<!-- <?xml version="1.0"?>
<samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://xxx/Shibboleth.sso/SAML2/POST"
ID="_"
InResponseTo="_"
IssueInstant="2022-07-01T14:47:56Z" Version="2.0">
<ds:Signature>
...
</ds:Signature>
<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_" IssueInstant="2022-07-01T14:47:56Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>
...
Compared to:
<!-- <?xml version="1.0"?>
<samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://xxx/Shibboleth.sso/SAML2/POST"
ID="_"
InResponseTo="_"
IssueInstant="2022-07-01T16:22:52Z" Version="2.0">
*<saml:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>*
<ds:Signature>
...
</ds:Signature>
<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_buouwsvi-hoxb-tjuc-sppz-kbrxmrphrxcl" IssueInstant="2022-07-01T14:47:56Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>
...
--
More information about the users
mailing list