How to check Issuer existence in idp Response

Michele Innocenti michele at etruriapa.it
Fri Jul 1 17:08:21 UTC 2022


Hi,

Is it possible to check the existence of saml:Issuer element of the idp 
Response in the Shibboleth SP?
Not the saml:Issuer Assertion element.
So that, for example, this Response from the idp can be refused by 
Shibboleth SP:

<!-- <?xml version="1.0"?>

<samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#"  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://xxx/Shibboleth.sso/SAML2/POST"
  ID="_"
InResponseTo="_"
IssueInstant="2022-07-01T14:47:56Z" Version="2.0">

     <ds:Signature>

         ...

     </ds:Signature>

     <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>

     <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema"  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  ID="_" IssueInstant="2022-07-01T14:47:56Z" Version="2.0">

         <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>

     ...


Compared to:

<!-- <?xml version="1.0"?>

<samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#"  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://xxx/Shibboleth.sso/SAML2/POST"
  ID="_"
InResponseTo="_"
IssueInstant="2022-07-01T16:22:52Z" Version="2.0">

     *<saml:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>*

     
     <ds:Signature>

     ...

     </ds:Signature>

     <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>

     <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema"  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  ID="_buouwsvi-hoxb-tjuc-sppz-kbrxmrphrxcl" IssueInstant="2022-07-01T14:47:56Z" Version="2.0">

         <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>

     ...

-- 


More information about the users mailing list