How to check Issuer existence in idp Response

[Michele Innocenti]

Thanks all for the response.
You get the point exactly Scott.
The only way I could think of to force the presence of the first Issuer 
element would be to modify the AttributeExtractor to be able to generate 
an attribute from that element.

I need to check it to implement SPID authentication.
Spid is the Italian federated authentication system that is part of the 
European EIDAS.

https://www.spid.gov.it/en/

https://www.eid.gov.it/

Spid spec is based on saml2 (next version is based on OpenID).
There are 323 automated tests to pass to validate a Spid SP implementation.
Currently, my implementation fails in two tests.
One is the case set out here.

To pass that test, I need to response with a KO when the IDP send a 
Response without the first Issuer element (I have no control on the IDP 
side).


Il 02/07/22 14:00, users-request at shibboleth.net ha scritto:
On 7/1/22 3:44 PM, Cantor, Scott via users wrote:

> I don't know what you're asking or trying to do, but the SP enforces 
> the profile requirement that the Assertion's issuer must match the 
> Response issuer. They can't be different by definition for the only 
> profile supported.
In the OP's 2 examples, I believe the delta is that in the first, the
Response Issuer is omitted entirely.? I had to check the SSO profile
spec to confirm, apparently that's allowed: "The (<Response>) <Issuer>
element MAY be omitted, but if present must contain...".

So I guess what the OP asking is if there's a way to enforce the
presence.? Since the spec allows it explicitly to be omitted, I'm not
sure what the reason is.? And I doubt the SP supports arbitrary
validation rules like that anyway, right?

If the Response Issuer is omitted, one can always just use the
Assertion(s) Issuer value, since they all have to be the same anyway,
per the spec.