Options specific to the SAML 2.0 Browser SSO profile:
Name / Type | Default | Description |
|---|---|---|
forceAuthn Boolean | false | Applies a particular ForceAuthn setting irrespective of the SP’s request |
encryptAssertions Boolean | true | Whether to encrypt assertions as a whole |
encryptAttributes Boolean | false | Whether to encrypt individual SAML Attributes |
maximumSPSessionLifetime Duration | 0 | If non-zero, attempts to limit length of session with SP via |
skipEndpointValidationWhenSigned Boolean | false | Whether to skip validation of response location via metadata if the request was signed |
includeAttributeStatement Boolean | true | Whether to include an attribute statement in the issued assertion |
randomizeFriendlyName 5.1 Boolean | false | Whether to decorate the FriendlyName attribute in SAML Attributes with a varying component that can flag SPs improperly depending on the value |
nameIDFormatPrecedence List<String> | Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference. | |
ignoreScoping Boolean | false | Whether to ignore |
checkAddress Boolean | true | Whether to enforce consistency between the client's address and the value within an inbound assertion's |
proxyCount Non-negative Integer | Controls the insertion of a proxy count into a | |
proxyAudiences Set<String> | Controls the insertion of audiences into a | |
proxiedAuthnInstant Boolean | true | Whether to pass through a proxied |
suppressAuthenticatingAuthority Boolean | false | Whether to prevent the insertion of |
<AuthenticationAuthority> | ||
maximumTimeSinceAuthn Duration | Limits the allowable time to accept a proxied authentication assertion based on its | |
authnContextComparison "exact", "minimum", "maximum", "better" | see below | Controls the comparison operator used when including |
authnContextTranslationStrategy | see below | Controls bidirectional translation of |
authnContextTranslationStrategyEx | More advanced support for populating | |
requireSignedRequests Boolean | false | When true, equivalent to setting the AuthnRequestsSigned attribute in SP metadata, blocks unsigned requests. Main use for this is to facilitate blocking IdP-initiated SSO. |
sPNameQualifier URI | When proxying, populates this value into the SAML request (in a | |
attributeIndex Integer | When proxying, populates this value into the SAML request’s | |
requestedAttributes Collection<RequestedAttribute> | When proxying, supplies RequestedAttribute objects to be used to populate an extension carring the attributes to request from the IdP |
Guidance
The nameIDFormatPrecedence property is a common way of controlling the type of SAML NameIdentifier / NameID included in a response, a common requirement of many commercial services. It is in fact the only way to force the use of the ill-advised "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Format, which it must be noted is very rarely needed, despite frequent mis-documentation to the contrary.
...
Several other new settings are used when proxying and provide various kinds of policy controls familiar to SP operators, as well as new features to support remapping of potentially non-interoperable AuthnContext values. By default, the IdP operates in a fairly automatic fashion when proxying, such that any <saml2p:RequestedAuthnContext> element from an SP will be echoed essentially as-is to any upstream Identity Provider, and the data found in the incoming assertion will be echoed as-is back downstream. Since proxying is often used to firewall against interoperability problems and crosswalk between different communities of practice, functions can be plugged in to perform more flexible mapping of values, and some pre-existing machinery is in place to support this declaratively, as described in the AuthenticationConfiguration page. An additional hook was added in V4.1 that allows a similar function to be injected but with access to the entire request state to do more advanced things.
There are also a variety of settings related to delegation that are not shown above but can be found in the relevant API documentation.