New undocumented property in IdP v5.1.4

[Brent Putman]

On 4/15/25 6:43 PM, Steven Premeau via users wrote:
>
> On 04/15/2025 5:56 PM, Steven Teixeira via users wrote:
>>
>> A new install of IdP v5.1.4 shows a new property in idp.properties 
>> named “idp.http.saml.enforceAllowedParameters” but I can’t seem to 
>> find any documentation of this property, even at 
>> https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510693/PropertyReference. 
>> Was this a property for a future, unreleased version that somehow 
>> made its way into 5.1.4?
>>
>>
>
> Given my current documentation assessment, I went looking as well -- 
> I can not find documentation on this new setting (other that the git 
> commit 
> <https://git.shibboleth.net/view/?p=java-identity-provider.git;a=commitdiff;h=55c6445c633a6397499809b363995e2e32593895>).


My bad, I forgot to add it to the wiki page.


>
> The idp.properties comment is:
>> Set true if you want inbound SAML requests to enforce that only 
>> allowed HTTP parameters are present
> The default is false (enforcement disabled), matching previous behavior.


I added to the properties reference page, described as:

"When set to true, if an inbound SAML request contains HTTP parameters 
(query or POST) that are not specified for that SAML binding, the 
request will be rejected."


>
> I'll defer to others on what might need to be considered before 
> enabling this enforcement, but (as is typically the case) the default 
> setting should preserve the behavior prior to the upgrade.
>

Yes, the default of false will be the same behavior as previously.

You'd set to true if you wanted to be strict and flat out reject 
requests that contain a param unknown to that SAML binding, such as 
random params that sometimes get sent by SPs. It would also reject say 
a SAMLResponse param for an endpoint that only expects a SAMLRequest.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250415/8e590ada/attachment.htm>