WSO2 IS 5.4.0: Using the username as attribute in SAML asserton

0
votes

Scenario:

  • WSO2 Identity Server 5.4.0 configured as SAML IDP.
  • A third party application configured as SAML Service Provider.
  • WSO2 IS uses MySQL as the JDBC user store

The SAML SP requires username, firstname and lastname as ATTRIBUTES in the SAML assertion. The SAML SP claim configuration is set as follows

firstname and lastname are sent in the SAML assertion as expected, whereas username is not sent in the SAML assertion.

Is there a way to achieve this?

Note: Further investigation showed that the username is not listed in the CLAIMS table UM_USER_ATTRIBUTE and as such may not be accessible via a claim mapping defined in WSO2 IS. Interestingly in OIDC the username is returned as the sub claim which is actually mapped to http://wso2.org/claims/username

Any hint and insight is appreciated.

1
wso2samlsaml-2.0wso2is
Can you use the claim wso2.org/claims/userid? – gusto2
In default setup wso2.org/claims/userid maps to scimId. No, that won't work – Hos
What is you subject claim URI set to? Do you get username as the subject in SAML assertion ? – Jayanga Kaushalya
Yes, the username is correctly sent as NameID. Subject Claim URI in Claim Configuration is still set to default (no attribute is selected) – Hos

1 Answers

0
votes

You need to enable scim for JDBCUserStoreManager. In user-mgt.xml file makes SCIMEnabled property to true as follows. 

<Property name="SCIMEnabled">true</Property>

Then try the SAML flow.