IDP v4.2.1 - Using SAML Proxying to another IdP

[Cantor, Scott]

On 5/23/22, 3:12 PM, "prasanna cg" <prasannacgin at yahoo.in> wrote:

>    1) If my upstream IDP is only sending the SAML Subject containing authenticated username (and no attribute
> statement), how can I map the incoming SAML Subject as SAML Subject in the Auth response from my Original
> IDP to the downstream SP ?

That's much harder than dealing with an Attribute. We do not plan on making the NameID support any easier; we want to actively push anyone to reject them just to avoid the hassle.

The support for this is explicitly linked in the SAML login topic, and covered under https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1280180722/SAML2ProxyTransformPostLoginC14NConfiguration

Older systems won't have some of the example beans involved but dist/conf/c14n/subject-c14n.xml will contain them.

>    2) I am using authn\SAML in MFA flow (as my second factor), I would like to pass the authenticated principal
> from 1st factor in my Auth request to the upstream IDP. Where do I get to configure this mapping ?

There isn't a way to do that.

>    3) How should I sign the SAML Auth request to the Upstream IDP ?

You shouldn't because that's a waste of your CPU and theirs, but the IdP will sign the request if it's told to do so by the IdP's metadata via the WantAuthnRequestsSigned flag, or by the signRequests relying party setting for that IdP.

-- Scott