Page Comparison

Options specific to the SAML 2.0 Browser SSO profile:

Name / Type	Default	Description
forceAuthn Boolean	false	Applies a particular ForceAuthn setting irrespective of the SP’s request
encryptAssertions Boolean	true	Whether to encrypt assertions as a whole
encryptAttributes Boolean	false	Whether to encrypt individual SAML Attributes
maximumSPSessionLifetime Duration	0	If non-zero, attempts to limit length of session with SP via `SessionNotOnOrAfter` attribute
skipEndpointValidationWhenSigned Boolean	false	Whether to skip validation of response location via metadata if the request was signed
includeAttributeStatement Boolean	true	Whether to include an attribute statement in the issued assertion
randomizeFriendlyName ^5.1 Boolean	false	Whether to decorate the FriendlyName attribute in SAML Attributes with a varying component that can flag SPs improperly depending on the value
nameIDFormatPrecedence List<String>		Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference.
ignoreScoping Boolean	false	Whether to ignore `<saml2:Scoping>` elements within an SP's AuthnRequest, and bypass generating one in accordance with the standard when proxying
checkAddress Boolean	true	Whether to enforce consistency between the client's address and the value within an inbound assertion's `<saml2:SubjectConfirmationData>` and `<saml2:SubjectLocality>` elements
proxyCount Non-negative Integer		Controls the insertion of a proxy count into a `<saml2:Scoping>` element (when issuing SAML 2 AuthnRequests to an IdP) and into a `<saml2:ProxyRestiction>` element (when issuing SAML 2 assertions)
proxyAudiences Set<String>		Controls the insertion of audiences into a `<saml2:ProxyRestiction>` element when issuing SAML 2 assertions
proxiedAuthnInstant Boolean	true	Whether to pass through a proxied `AuthnInstant` value from an inbound assertion when issuing new assertions based on it (the alternative is to insert a fresh timestamp)
suppressAuthenticatingAuthority

^4.2

Boolean

false

Whether to prevent the insertion of

<AuthenticationAuthority>

`<AuthenticatingAuthority>` elements(s) in the event of proxying
maximumTimeSinceAuthn Duration		Limits the allowable time to accept a proxied authentication assertion based on its `AuthnInstant`, this is principally used to cross-check use of the `ForceAuthn` flag
authnContextComparison "exact", "minimum", "maximum", "better"	see below	Controls the comparison operator used when including `<saml2p:RequestedAuthnContext>` elements in proxied AuthnRequests
authnContextTranslationStrategy Function<AuthnContext,Collection<Principal>	see below	Controls bidirectional translation of `<saml2:AuthnContext>` content when issuing requests and generating assertions to allow for remapping of values across the proxy boundary
authnContextTranslationStrategyEx

^4.2

Function<ProfileRequestContext,Collection<Principal>

More advanced support for populating <saml2:AuthnContext> content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)

requireSignedRequests

^4.3

Boolean	false	When true, equivalent to setting the AuthnRequestsSigned attribute in SP metadata, blocks unsigned requests. Main use for this is to facilitate blocking IdP-initiated SSO.
sPNameQualifier URI		When proxying, populates this value into the SAML request (in a `<NameIDPolicy>` element)
attributeIndex Integer		When proxying, populates this value into the SAML request’s `AttributeConsumingServiceIndex` attribute
requestedAttributes Collection<RequestedAttribute>		When proxying, supplies RequestedAttribute objects to be used to populate an extension carring the attributes to request from the IdP

Guidance

The nameIDFormatPrecedence property is a common way of controlling the type of SAML NameIdentifier / NameID included in a response, a common requirement of many commercial services. It is in fact the only way to force the use of the ill-advised "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Format, which it must be noted is very rarely needed, despite frequent mis-documentation to the contrary.

...

Several other new settings are used when proxying and provide various kinds of policy controls familiar to SP operators, as well as new features to support remapping of potentially non-interoperable AuthnContext values. By default, the IdP operates in a fairly automatic fashion when proxying, such that any <saml2p:RequestedAuthnContext> element from an SP will be echoed essentially as-is to any upstream Identity Provider, and the data found in the incoming assertion will be echoed as-is back downstream. Since proxying is often used to firewall against interoperability problems and crosswalk between different communities of practice, functions can be plugged in to perform more flexible mapping of values, and some pre-existing machinery is in place to support this declaratively, as described in the AuthenticationConfiguration page. An additional hook was added in V4.1 that allows a similar function to be injected but with access to the entire request state to do more advanced things.

There are also a variety of settings related to delegation that are not shown above but can be found in the relevant API documentation.

Versions Compared

Old Version 1

New Version Current

Key

Guidance