Page Comparison

encryptAssertions

Boolean

true

Whether to encrypt assertions as a whole

encryptAttributes

Boolean

false

Whether to encrypt individual SAML Attributes

maximumSPSessionLifetime

Duration

0

If non-zero, attempts to limit length of session with SP via SessionNotOnOrAfter attribute

skipEndpointValidationWhenSigned

Boolean

false

Whether to skip validation of response location via metadata if the request was signed

nameIDFormatPrecedence

List<String>

Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference.

ignoreScoping

Boolean

false

Whether to ignore <saml2:Scoping> elements within an SP's AuthnRequest, and bypass generating one in accordance with the standard when proxying

checkAddress

Boolean

true

Whether to enforce consistency between the client's address and the value within an inbound assertion's <saml2:SubjectConfirmationData> and <saml2:SubjectLocality> elements

proxyCount

Non-negative Integer

Controls the insertion of a proxy count into a <saml2:Scoping> element (when issuing SAML 2 AuthnRequests to an IdP) and into a <saml2:ProxyRestiction> element (when issuing SAML 2 assertions)

proxyAudiences

Set<String>

Controls the insertion of audiences into a <saml2:ProxyRestiction> element when issuing SAML 2 assertions

proxiedAuthnInstant

Boolean

true

Whether to pass through a proxied AuthnInstant value from an inbound assertion when issuing new assertions based on it (the alternative is to insert a fresh timestamp)

suppressAuthenticatingAuthority ^4.2

Boolean

false

Whether to prevent the insertion of

<AuthenticatingAuthority> elements(s) in the event of proxying

maximumTimeSinceAuthn

Duration

Limits the allowable time to accept a proxied authentication assertion based on its AuthnInstant, this is principally used to cross-check use of the ForceAuthn flag

authnContextComparison

"exact", "minimum", "maximum", "better"

see below

Controls the comparison operator used when including <saml2p:RequestedAuthnContext> elements in proxied AuthnRequests

authnContextTranslationStrategy

Function<AuthnContext,Collection<Principal>

see below

Controls bidirectional translation of <saml2:AuthnContext> content when issuing requests and generating assertions to allow for remapping of values across the proxy boundary

authnContextTranslationStrategyEx ^4.2

Function<ProfileRequestContext,Collection<Principal>

More advanced support for populating <saml2:AuthnContext> content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)

requireSignedRequests ^4.3

false

When true, equivalent to setting the AuthnRequestsSigned attribute in SP metadata, blocks unsigned requests. Main use for this is to facilitate blocking IdP-initiated SSO.