ProfileConfiguration-SAML2SSO

Options specific to the SAML 2.0 Browser SSO profile:

Name / Type	Default	Description
forceAuthn Boolean	false	Applies a particular ForceAuthn setting irrespective of the SP’s request
encryptAssertions Boolean	true	Whether to encrypt assertions as a whole
encryptAttributes Boolean	false	Whether to encrypt individual SAML Attributes
maximumSPSessionLifetime Duration	0	If non-zero, attempts to limit length of session with SP via `SessionNotOnOrAfter` attribute
skipEndpointValidationWhenSigned Boolean	false	Whether to skip validation of response location via metadata if the request was signed
includeAttributeStatement Boolean	true	Whether to include an attribute statement in the issued assertion
randomizeFriendlyName Boolean	false	Whether to decorate the FriendlyName attribute in SAML Attributes with a varying component that can flag SPs improperly depending on the value
nameIDFormatPrecedence List<String>		Ordered list of NameID Format(s) to select for use, in the event that a relying party does not signal a preference.
ignoreScoping Boolean	false	Whether to ignore `<saml2:Scoping>` elements within an SP's AuthnRequest, and bypass generating one in accordance with the standard when proxying
checkAddress Boolean	true	Whether to enforce consistency between the client's address and the value within an inbound assertion's `<saml2:SubjectConfirmationData>` and `<saml2:SubjectLocality>` elements
proxyCount Non-negative Integer		Controls the insertion of a proxy count into a `<saml2:Scoping>` element (when issuing SAML 2 AuthnRequests to an IdP) and into a `<saml2:ProxyRestiction>` element (when issuing SAML 2 assertions)
proxyAudiences Set<String>		Controls the insertion of audiences into a `<saml2:ProxyRestiction>` element when issuing SAML 2 assertions
proxiedAuthnInstant Boolean	true	Whether to pass through a proxied `AuthnInstant` value from an inbound assertion when issuing new assertions based on it (the alternative is to insert a fresh timestamp)
suppressAuthenticatingAuthority Boolean	false	Whether to prevent the insertion of `<AuthenticatingAuthority>` elements(s) in the event of proxying
maximumTimeSinceAuthn Duration		Limits the allowable time to accept a proxied authentication assertion based on its `AuthnInstant`, this is principally used to cross-check use of the `ForceAuthn` flag
authnContextComparison "exact", "minimum", "maximum", "better"	see below	Controls the comparison operator used when including `<saml2p:RequestedAuthnContext>` elements in proxied AuthnRequests
authnContextTranslationStrategy Function<AuthnContext,Collection<Principal>	see below	Controls bidirectional translation of `<saml2:AuthnContext>` content when issuing requests and generating assertions to allow for remapping of values across the proxy boundary
authnContextTranslationStrategyEx Function<ProfileRequestContext,Collection<Principal>		More advanced support for populating `<saml2:AuthnContext>` content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)
requireSignedRequests Boolean	false	When true, equivalent to setting the AuthnRequestsSigned attribute in SP metadata, blocks unsigned requests. Main use for this is to facilitate blocking IdP-initiated SSO.
sPNameQualifier URI		When proxying, populates this value into the SAML request (in a `<NameIDPolicy>` element)
attributeIndex Integer		When proxying, populates this value into the SAML request’s `AttributeConsumingServiceIndex` attribute
requestedAttributes Collection<RequestedAttribute>		When proxying, supplies RequestedAttribute objects to be used to populate an extension carring the attributes to request from the IdP

Guidance

The nameIDFormatPrecedence property is a common way of controlling the type of SAML NameIdentifier / NameID included in a response, a common requirement of many commercial services. It is in fact the only way to force the use of the ill-advised "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Format, which it must be noted is very rarely needed, despite frequent mis-documentation to the contrary.

In most cases, it is better to control the Format selected by including a <NameIDFormat> element in the SP's metadata. In the event that you don't control the metadata, you can inject the required element by applying a metadata filter.

Examples of nameIDFormatPrecedence property

<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">

	<!--
	Both constants below evaluate to the string "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
	and are interchangeable, they're just illustrations of different ways to reference the same string.
	-->

	<!-- Use "unspecified" NameIdentifier with Shibboleth SSO profile. -->
	<bean parent="Shibboleth.SSO">
		<property name="nameIDFormatPrecedence">
			<list>
				<util:constant static-field="org.opensaml.saml.saml1.core.NameIdentifier.UNSPECIFIED" />
			</list>
		</property>
	</bean>

	<!-- Use "unspecified" NameID with SAML 2 SSO profile. -->
	<bean parent="SAML2.SSO">
		<property name="nameIDFormatPrecedence">
			<list>
				<util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.UNSPECIFIED" />
			</list>
		</property>
	</bean>

	<!-- Return formats from a function bean (not shown). -->
	<bean parent="Shibboleth.SSO" p:nameIDFormatPrecedenceLookupStrategy-ref="FormatsFunction" />

</bean>

The skipEndpointValidationWhenSigned option is attractive in many enterprise scenarios if you prefer to maintain some degree of security but avoid registration of metadata containing every individual SP endpoint, which adds a lot of overhead in massively vhosted-environments. It can also add a degree of insulation from SP changes, but in practice systems that are likely to change endpoint locations but don't support metadata-based change control are likely to misunderstand the need to keep entityIDs stable also.

The ignoreScoping setting is provided to work around interoperability issues with broken SPs.

Several other new settings are used when proxying and provide various kinds of policy controls familiar to SP operators, as well as new features to support remapping of potentially non-interoperable AuthnContext values. By default, the IdP operates in a fairly automatic fashion when proxying, such that any <saml2p:RequestedAuthnContext> element from an SP will be echoed essentially as-is to any upstream Identity Provider, and the data found in the incoming assertion will be echoed as-is back downstream. Since proxying is often used to firewall against interoperability problems and crosswalk between different communities of practice, functions can be plugged in to perform more flexible mapping of values, and some pre-existing machinery is in place to support this declaratively, as described in the AuthenticationConfiguration page.

There are also a variety of settings related to delegation that are not shown above but can be found in the relevant API documentation.