Generate custom attribute for one SP in a SAML 2.0 Federation - Identity

1
votes

We have a SAML 2.0 federated environment (IDP and SP). I would like to generate a custom attribute for assertions created only for one SP. As such, I will not modify the IDP configuration.

The snippet of the SAML Assertion we need to create:

< saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" >
Name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE:groups">

< saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
xsi:type="xsd:string">ABCD

According to SAML2 specifications, we need to modify the SP extended metadata to provide this attribute. The constant string "ABCD" is the attribute we want to send. I've modified as such, but no results. Can anyone provide insight?

< Attribute name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE:groups">

 < Value>urn:oasis:names:tc:SAML:2.0:attrname-format:uri|ABCD</Value>

< /Attribute>

Also tried:

< Attribute name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE:groups" nameformat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

 < Value>"ABCD"</Value>

< /Attribute>

1
xmlidentitysamlsaml-2.0federated-identity
Is your IDP configured to give you this attribute? – Stefan Rasmusson
No, I do not want to make modifications to the IDP. I have 5 SPs, this attribute will be only for one SP. – Rostam

1 Answers

2
votes

Looking at the metadata spec it seems like you use the following syntax to define what attributes you want from the IDP. Of course the IDP must be configured to allow the export of such attribute to..

<AttributeConsumingService>
   <ServiceName xml:lang="en">youname</ServiceName>
   <RequestedAttribute 
      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:theformat"
      Name="theAttributeName"
      FriendlyName="humanReadableName"/>
</AttributeConsumingService>

The spec of this is here at page 21 https://www.oasis-open.org/committees/download.php/35391/sstc-saml-metadata-errata-2.0-wd-04-diff.pdf