Page Comparison

forceAuthn

Boolean

false

Applies a particular ForceAuthn setting irrespective of the SP’s request

encryptAssertions

Boolean

true

Whether to encrypt assertions as a whole

encryptAttributes

Boolean

false

Whether to encrypt individual SAML Attributes

maximumSPSessionLifetime

Duration

0

If non-zero, attempts to limit length of session with SP via SessionNotOnOrAfter attribute

skipEndpointValidationWhenSigned

Boolean

false

Whether to skip validation of response location via metadata if the request was signed

includeAttributeStatement

Boolean

true

Whether to include an attribute statement in the issued assertion

nameIDFormatPrecedence

List<String>

Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference.

ignoreScoping

Boolean

false

Whether to ignore <saml2:Scoping> elements within an SP's AuthnRequest, and bypass generating one in accordance with the standard when proxying

checkAddress

Boolean

true

Whether to enforce consistency between the client's address and the value within an inbound assertion's <saml2:SubjectConfirmationData> and <saml2:SubjectLocality> elements

proxyCount

Non-negative Integer

Controls the insertion of a proxy count into a <saml2:Scoping> element (when issuing SAML 2 AuthnRequests to an IdP) and into a <saml2:ProxyRestiction> element (when issuing SAML 2 assertions)

proxyAudiences

Set<String>

Controls the insertion of audiences into a <saml2:ProxyRestiction> element when issuing SAML 2 assertions

proxiedAuthnInstant

Boolean

true

Whether to pass through a proxied AuthnInstant value from an inbound assertion when issuing new assertions based on it (the alternative is to insert a fresh timestamp)

suppressAuthenticatingAuthority

Boolean

false

Whether to prevent the insertion of <AuthenticationAuthority> elements(s) in the event of proxying

maximumTimeSinceAuthn

Duration

Limits the allowable time to accept a proxied authentication assertion based on its AuthnInstant, this is principally used to cross-check use of the ForceAuthn flag

authnContextComparison

"exact", "minimum", "maximum", "better"

see below

Controls the comparison operator used when including <saml2p:RequestedAuthnContext> elements in proxied AuthnRequests

authnContextTranslationStrategy

Function<AuthnContext,Collection<Principal>

see below

Controls bidirectional translation of <saml2:AuthnContext> content when issuing requests and generating assertions to allow for remapping of values across the proxy boundary

authnContextTranslationStrategyEx

Function<ProfileRequestContext,Collection<Principal>

More advanced support for populating <saml2:AuthnContext> content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)

requireSignedRequests

Boolean

false

When true, equivalent to setting the AuthnRequestsSigned attribute in SP metadata, blocks unsigned requests. Main use for this is to facilitate blocking IdP-initiated SSO.

sPNameQualifier

URI

When proxying, populates this value into the SAML request (in a <NameIDPolicy> element)

attributeIndex

Integer

When proxying, populates this value into the SAML request’s AttributeConsumingServiceIndex attribute

requestedAttributes

Collection<RequestedAttribute>

When proxying, supplies RequestedAttribute objects to be used to populate an extension carring the attributes to request from the IdP