ProfileConfiguration-SAML2SSO

Options specific to the SAML 2.0 Browser SSO profile:

Name / Type

Default

Description

Name / Type

Default

Description

maximumSPSessionLifetime

Duration

0

If non-zero, attempts to limit length of session with SP via SessionNotOnOrAfter attribute

skipEndpointValidationWhenSigned

Boolean

false

Whether to skip validation of response location via metadata if the request was signed

nameIDFormatPrecedence

List<String>



Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference.

ignoreScoping

Boolean

false

Whether to ignore <saml2:Scoping> elements within an SP's AuthnRequest

checkAddress

Boolean

true

Whether to enforce consistency between the client's address and the value within an inbound assertion's <saml2:SubjectLocality> element

proxiedAuthnInstant

Boolean

true

Whether to pass through a proxied AuthnInstant value from an inbound assertion when issuing new assertions based on it (the alternative is to insert a fresh timestamp)

suppressAuthenticatingAuthority 4.2

Boolean

false

Whether to prevent the insertion of <AuthenticationAuthority> elements(s) in the event of proxying

maximumTimeSinceAuthn

Duration



Limits the allowable time to accept a proxied authentication assertion based on its AuthnInstant, this is principally used to cross-check use of the ForceAuthn flag

authnContextComparison

"exact", "minimum", "maximum", "better"

see below

Controls the comparison operator used when including <saml2p:RequestedAuthnContext> elements in proxied AuthnRequests

authnContextTranslationStrategy

Function<AuthnContext,Collection<Principal>

see below

Controls bidirectional translation of <saml2:AuthnContext> content when issuing requests and generating assertions to allow for remapping of values across the proxy boundary

authnContextTranslationStrategyEx 4.2

Function<ProfileRequestContext,Collection<Principal>



More advanced support for populating <saml2:AuthnContext> content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)

Guidance

The nameIDFormatPrecedence property is a common way of controlling the type of SAML NameIdentifier / NameID included in a response, a common requirement of many commercial services. It is in fact the only way to force the use of the ill-advised "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Format, which it must be noted is very rarely needed, despite frequent mis-documentation to the contrary.

In most cases, it is better to control the Format selected by including a <NameIDFormat> element in the SP's metadata. In the event that you don't control the metadata, you can inject the required element by applying a metadata filter.

Examples of nameIDFormatPrecedence property
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"> <!-- Both constants below evaluate to the string "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", and are interchangeable, they're just illustrations of different ways to reference the same string. --> <!-- Use "unspecified" NameIdentifier with Shibboleth SSO profile. --> <bean parent="Shibboleth.SSO"> <property name="nameIDFormatPrecedence"> <list> <util:constant static-field="org.opensaml.saml.saml1.core.NameIdentifier.UNSPECIFIED" /> </list> </property> </bean> <!-- Use "unspecified" NameID with SAML 2 SSO profile. --> <bean parent="SAML2.SSO"> <property name="nameIDFormatPrecedence"> <list> <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.UNSPECIFIED" /> </list> </property> </bean> <!-- Return formats from a function bean (not shown). --> <bean parent="Shibboleth.SSO" p:nameIDFormatPrecedenceLookupStrategy-ref="FormatsFunction" /> </bean>

The skipEndpointValidationWhenSigned option is attractive in many enterprise scenarios if you prefer to maintain some degree of security but avoid registration of metadata containing every individual SP endpoint, which adds a lot of overhead in massively vhosted-environments. It can also add a degree of insulation from SP changes, but in practice systems that are likely to change endpoint locations but don't support metadata-based change control are likely to misunderstand the need to keep entityIDs stable also.

The ignoreScoping setting is provided to work around interoperability issues with broken SPs.

Several other new settings are used when proxying and provide various kinds of policy controls familiar to SP operators, as well as new features to support remapping of potentially non-interoperable AuthnContext values. By default, the IdP operates in a fairly automatic fashion when proxying, such that any <saml2p:RequestedAuthnContext> element from an SP will be echoed essentially as-is to any upstream Identity Provider, and the data found in the incoming assertion will be echoed as-is back downstream. Since proxying is often used to firewall against interoperability problems and crosswalk between different communities of practice, functions can be plugged in to perform more flexible mapping of values, and some pre-existing machinery is in place to support this declaratively, as described in the AuthenticationConfiguration page. An additional hook was added in V4.1 that allows a similar function to be injected but with access to the entire request state to do more advanced things.

There are also a variety of settings related to delegation that are not shown above but can be found in the relevant API documentation.