Skip to content

Commit 2af62ba

Browse files
author
jzuriaga
committed
Allow duplicated names in AttributeStatement by configuration.
1 parent bed44f3 commit 2af62ba

5 files changed

Lines changed: 230 additions & 44 deletions

File tree

‎core/src/main/java/com/onelogin/saml2/authn/SamlResponse.java‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,8 @@
88
import java.util.List;
99
import java.util.Map;
1010
import java.util.Objects;
11-
1211
import javax.xml.parsers.ParserConfigurationException;
1312
import javax.xml.xpath.XPathExpressionException;
14-
1513
import org.joda.time.DateTime;
1614
import org.joda.time.Instant;
1715
import org.slf4j.Logger;
@@ -22,7 +20,8 @@
2220
import org.w3c.dom.Node;
2321
import org.w3c.dom.NodeList;
2422
import org.xml.sax.SAXException;
25-
23+
import com.onelogin.saml2.exception.SettingsException;
24+
import com.onelogin.saml2.exception.ValidationError;
2625
import com.onelogin.saml2.http.HttpRequest;
2726
import com.onelogin.saml2.model.SamlResponseStatus;
2827
import com.onelogin.saml2.model.SubjectConfirmationIssue;
@@ -31,9 +30,6 @@
3130
import com.onelogin.saml2.util.SchemaFactory;
3231
import com.onelogin.saml2.util.Util;
3332

34-
import com.onelogin.saml2.exception.SettingsException;
35-
import com.onelogin.saml2.exception.ValidationError;
36-
3733
/**
3834
* SamlResponse class of OneLogin's Java Toolkit.
3935
*
@@ -553,18 +549,24 @@ public HashMap<String, List<String>> getAttributes() throws XPathExpressionExcep
553549
for (int i = 0; i < nodes.getLength(); i++) {
554550
NamedNodeMap attrName = nodes.item(i).getAttributes();
555551
String attName = attrName.getNamedItem("Name").getNodeValue();
556-
if (attributes.containsKey(attName)) {
552+
if (attributes.containsKey(attName) && !settings.isSpAllowRepeatAttributeName()) {
557553
throw new ValidationError("Found an Attribute element with duplicated Name", ValidationError.DUPLICATED_ATTRIBUTE_NAME_FOUND);
558554
}
559555

560556
NodeList childrens = nodes.item(i).getChildNodes();
561557

562-
List<String> attrValues = new ArrayList<String>();
558+
List<String> attrValues = null;
559+
if (attributes.containsKey(attName) && settings.isSpAllowRepeatAttributeName()) {
560+
attrValues = attributes.get(attName);
561+
} else {
562+
attrValues = new ArrayList<String>();
563+
}
563564
for (int j = 0; j < childrens.getLength(); j++) {
564565
if ("AttributeValue".equals(childrens.item(j).getLocalName())) {
565566
attrValues.add(childrens.item(j).getTextContent());
566567
}
567568
}
569+
568570
attributes.put(attName, attrValues);
569571
}
570572
LOGGER.debug("SAMLResponse has attributes: " + attributes.toString());

‎core/src/main/java/com/onelogin/saml2/settings/Saml2Settings.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ public class Saml2Settings {
3939
private URL spSingleLogoutServiceUrl = null;
4040
private String spSingleLogoutServiceBinding = Constants.BINDING_HTTP_REDIRECT;
4141
private String spNameIDFormat = Constants.NAMEID_UNSPECIFIED;
42+
private boolean spAllowRepeatAttributeName = false;
4243
private X509Certificate spX509cert = null;
4344
private X509Certificate spX509certNew = null;
4445
private PrivateKey spPrivateKey = null;
@@ -133,6 +134,13 @@ public final String getSpNameIDFormat() {
133134
return spNameIDFormat;
134135
}
135136

137+
/**
138+
* @return the spAllowRepeatAttributeName setting value
139+
*/
140+
public boolean isSpAllowRepeatAttributeName () {
141+
return spAllowRepeatAttributeName;
142+
}
143+
136144
/**
137145
* @return the spX509cert setting value
138146
*/
@@ -441,6 +449,16 @@ protected final void setSpNameIDFormat(String spNameIDFormat) {
441449
this.spNameIDFormat = spNameIDFormat;
442450
}
443451

452+
/**
453+
* Set the spAllowRepeatAttributeName setting value
454+
*
455+
* @param spAllowRepeatAttributeName
456+
* the spAllowRepeatAttributeName value to be set
457+
*/
458+
public void setSpAllowRepeatAttributeName (boolean spAllowRepeatAttributeName) {
459+
this.spAllowRepeatAttributeName = spAllowRepeatAttributeName;
460+
}
461+
444462
/**
445463
* Set the spX509cert setting value provided as X509Certificate object
446464
*

‎core/src/main/java/com/onelogin/saml2/settings/SettingsBuilder.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,9 @@
2020
import java.util.List;
2121
import java.util.Map;
2222
import java.util.Properties;
23-
2423
import org.apache.commons.lang3.StringUtils;
2524
import org.slf4j.Logger;
2625
import org.slf4j.LoggerFactory;
27-
2826
import com.onelogin.saml2.exception.Error;
2927
import com.onelogin.saml2.model.Contact;
3028
import com.onelogin.saml2.model.KeyStoreSettings;
@@ -62,6 +60,7 @@ public class SettingsBuilder {
6260
public final static String SP_SINGLE_LOGOUT_SERVICE_URL_PROPERTY_KEY = "onelogin.saml2.sp.single_logout_service.url";
6361
public final static String SP_SINGLE_LOGOUT_SERVICE_BINDING_PROPERTY_KEY = "onelogin.saml2.sp.single_logout_service.binding";
6462
public final static String SP_NAMEIDFORMAT_PROPERTY_KEY = "onelogin.saml2.sp.nameidformat";
63+
public final static String SP_ALLOW_REPEAT_ATTRIBUTE_NAME_PROPERTY_KEY = "onelogin.saml2.sp.allow_duplicated_attribute_name";
6564

6665
public final static String SP_X509CERT_PROPERTY_KEY = "onelogin.saml2.sp.x509cert";
6766
public final static String SP_PRIVATEKEY_PROPERTY_KEY = "onelogin.saml2.sp.privatekey";
@@ -470,6 +469,10 @@ private void loadSpSetting() {
470469
if (spNameIDFormat != null && !spNameIDFormat.isEmpty())
471470
saml2Setting.setSpNameIDFormat(spNameIDFormat);
472471

472+
Boolean spAllowRepeatAttributeName = loadBooleanProperty(SP_ALLOW_REPEAT_ATTRIBUTE_NAME_PROPERTY_KEY);
473+
if (spAllowRepeatAttributeName != null)
474+
saml2Setting.setSpAllowRepeatAttributeName(spAllowRepeatAttributeName);
475+
473476
boolean keyStoreEnabled = this.samlData.get(KEYSTORE_KEY) != null && this.samlData.get(KEYSTORE_ALIAS) != null
474477
&& this.samlData.get(KEYSTORE_KEY_PASSWORD) != null;
475478

‎core/src/test/java/com/onelogin/saml2/test/authn/AuthnResponseTest.java‎

Lines changed: 58 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,15 @@
11
package com.onelogin.saml2.test.authn;
22

3-
import com.onelogin.saml2.authn.SamlResponse;
4-
import com.onelogin.saml2.exception.Error;
5-
import com.onelogin.saml2.exception.SettingsException;
6-
import com.onelogin.saml2.exception.ValidationError;
7-
import com.onelogin.saml2.http.HttpRequest;
8-
import com.onelogin.saml2.model.SamlResponseStatus;
9-
import com.onelogin.saml2.settings.Saml2Settings;
10-
import com.onelogin.saml2.settings.SettingsBuilder;
11-
import com.onelogin.saml2.util.Constants;
12-
import com.onelogin.saml2.util.Util;
13-
14-
import org.hamcrest.Matchers;
15-
import org.joda.time.Instant;
16-
import org.junit.Rule;
17-
import org.junit.Test;
18-
import org.junit.rules.ExpectedException;
19-
import org.w3c.dom.Document;
20-
import org.w3c.dom.Node;
21-
import org.w3c.dom.NodeList;
22-
import org.xml.sax.SAXException;
23-
3+
import static org.hamcrest.CoreMatchers.containsString;
4+
import static org.hamcrest.CoreMatchers.not;
5+
import static org.hamcrest.Matchers.contains;
6+
import static org.hamcrest.Matchers.is;
7+
import static org.junit.Assert.assertEquals;
8+
import static org.junit.Assert.assertFalse;
9+
import static org.junit.Assert.assertNotNull;
10+
import static org.junit.Assert.assertNull;
11+
import static org.junit.Assert.assertThat;
12+
import static org.junit.Assert.assertTrue;
2413
import java.io.IOException;
2514
import java.util.ArrayList;
2615
import java.util.HashMap;
@@ -31,19 +20,27 @@
3120
import java.util.concurrent.Executors;
3221
import java.util.concurrent.TimeUnit;
3322
import java.util.concurrent.atomic.AtomicInteger;
34-
3523
import javax.xml.parsers.ParserConfigurationException;
3624
import javax.xml.xpath.XPathExpressionException;
37-
38-
import static org.hamcrest.CoreMatchers.containsString;
39-
import static org.hamcrest.CoreMatchers.not;
40-
import static org.hamcrest.Matchers.contains;
41-
import static org.hamcrest.Matchers.is;
42-
import static org.junit.Assert.assertEquals;
43-
import static org.junit.Assert.assertFalse;
44-
import static org.junit.Assert.assertNull;
45-
import static org.junit.Assert.assertThat;
46-
import static org.junit.Assert.assertTrue;
25+
import org.hamcrest.Matchers;
26+
import org.joda.time.Instant;
27+
import org.junit.Rule;
28+
import org.junit.Test;
29+
import org.junit.rules.ExpectedException;
30+
import org.w3c.dom.Document;
31+
import org.w3c.dom.Node;
32+
import org.w3c.dom.NodeList;
33+
import org.xml.sax.SAXException;
34+
import com.onelogin.saml2.authn.SamlResponse;
35+
import com.onelogin.saml2.exception.Error;
36+
import com.onelogin.saml2.exception.SettingsException;
37+
import com.onelogin.saml2.exception.ValidationError;
38+
import com.onelogin.saml2.http.HttpRequest;
39+
import com.onelogin.saml2.model.SamlResponseStatus;
40+
import com.onelogin.saml2.settings.Saml2Settings;
41+
import com.onelogin.saml2.settings.SettingsBuilder;
42+
import com.onelogin.saml2.util.Constants;
43+
import com.onelogin.saml2.util.Util;
4744

4845
public class AuthnResponseTest {
4946
private static final String ACS_URL = "http://localhost:8080/java-saml-jspsample/acs.jsp";
@@ -982,11 +979,38 @@ public void testGetAttributesDuplicatedNames() throws IOException, Error, XPathE
982979
samlResponse.getAttributes();
983980
}
984981

982+
/**
983+
* Tests the getAttributes method of SamlResponse
984+
* Case: Allow Duplicated names
985+
*
986+
* @throws Error
987+
* @throws IOException
988+
* @throws ValidationError
989+
* @throws SettingsException
990+
* @throws SAXException
991+
* @throws ParserConfigurationException
992+
* @throws XPathExpressionException
993+
*
994+
* @see com.onelogin.saml2.authn.SamlResponse#getAttributes
995+
*/
996+
@Test
997+
public void testGetAttributesAllowDuplicatedNames () throws IOException, Error, XPathExpressionException, ParserConfigurationException,
998+
SAXException, SettingsException, ValidationError {
999+
Saml2Settings settings = new SettingsBuilder().fromFile("config/config.allowduplicatednames.properties").build();
1000+
String samlResponseEncoded = Util.getFileAsString("data/responses/invalids/duplicated_attributes.xml.base64");
1001+
SamlResponse samlResponse = new SamlResponse(settings, newHttpRequest(samlResponseEncoded));
1002+
1003+
Map<String, List<String>> attributes = samlResponse.getAttributes();
1004+
assertNotNull(attributes);
1005+
assertTrue(attributes.containsKey("uid"));
1006+
assertEquals(2, attributes.get("uid").size());
1007+
}
1008+
9851009
/**
9861010
* Tests that queryAssertion method of SamlResponse
987-
* Case: Elements retrieved are covered by a Signature
1011+
* Case: Elements retrieved are covered by a Signature
9881012
*
989-
* @throws Exception
1013+
* @throws Exception
9901014
*
9911015
* @see com.onelogin.saml2.authn.SamlResponse#queryAssertion
9921016
*/

‎core/src/test/resources/config/config.allowduplicatednames.properties‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
# If 'strict' is True, then the Java Toolkit will reject unsigned
2+
# or unencrypted messages if it expects them signed or encrypted
3+
# Also will reject the messages if not strictly follow the SAML
4+
onelogin.saml2.strict = true
5+
6+
# Enable debug mode (to print errors)
7+
onelogin.saml2.debug = true
8+
9+
# Service Provider Data that we are deploying
10+
# Identifier of the SP entity (must be a URI)
11+
onelogin.saml2.sp.entityid = http://localhost:8080/java-saml-jspsample/metadata.jsp
12+
# Specifies info about where and how the <AuthnResponse> message MUST be
13+
# returned to the requester, in this case our SP.
14+
# URL Location where the <Response> from the IdP will be returned
15+
onelogin.saml2.sp.assertion_consumer_service.url = http://localhost:8080/java-saml-jspsample/acs.jsp
16+
# SAML protocol binding to be used when returning the <Response> or sending the <LogoutRequest>
17+
# message. Onelogin Toolkit supports for this endpoint the
18+
# HTTP-POST binding only
19+
onelogin.saml2.sp.assertion_consumer_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
20+
21+
# Specifies info about Logout service
22+
# URL Location where the <LogoutResponse> from the IdP will be returned or where to send the <LogoutRequest>
23+
onelogin.saml2.sp.single_logout_service.url = http://localhost:8080/java-saml-jspsample/sls.jsp
24+
25+
# SAML protocol binding for the Single Logout Service of the SP.
26+
# Onelogin Toolkit supports for this endpoint the HTTP-Redirect binding only
27+
onelogin.saml2.sp.single_logout_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
28+
29+
# Specifies constraints on the name identifier to be used to
30+
# represent the requested subject.
31+
# Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
32+
onelogin.saml2.sp.nameidformat = urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
33+
34+
# Enable duplicated names in the attribute statement
35+
onelogin.saml2.sp.allow_duplicated_attribute_name = true
36+
37+
# Usually x509cert and privateKey of the SP are provided by files placed at
38+
# the certs folder. But we can also provide them with the following parameters
39+
onelogin.saml2.sp.x509cert = -----BEGIN CERTIFICATE-----MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo-----END CERTIFICATE-----
40+
41+
42+
# Requires Format PKCS#8 BEGIN PRIVATE KEY
43+
# If you have PKCS#1 BEGIN RSA PRIVATE KEY convert it by openssl pkcs8 -topk8 -inform pem -nocrypt -in sp.rsa_key -outform pem -out sp.pem
44+
onelogin.saml2.sp.privatekey = -----BEGIN PRIVATE KEY-----MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOK9uFHs/nXrH9LcGorG6lB7Qs42iWK6mIE56wI7dIdsOuXf6r0ht+d+YTTis24xw+wjEHXrVN0Okh6wsKftzxo8chIo60+UB5NlKdvxAC7tpGNmrf49us/m5bdNx8IY+0pPK0c6B786UlujTvx1WFdDXh3UQPBclbWtFe5S3gLxAgMBAAECgYAPj9ngtZVZXoPWowinUbOvRmZ1ZMTVI91nsSPyCUacLM92C4I+7NuEZeYiDRUnkP7TbCyrCzXN3jwlIxdczzORhlXBBgg9Sw2fkV61CnDEMgw+aEeD5A0GDA6eTwkrawiOMs8vupjsi2/stPsa+bmpI6RnfdEKBdyDP6iQQhAxiQJBAPNtM7IMvRzlZBXoDaTTpP9rN2FR0ZcX0LT5aRZJ81qi+ZOBFeHUb6MyWvzZKfPinj9JO3s/9e3JbMXemRWBmvcCQQDuc+NfAeW200QyjoC3Ed3jueLMrY1Q3zTcSUhRPw/0pIKgRGZJerro8N6QY2JziV2mxK855gKTwwBigMHL2S9XAkEAwuBfjGDqXOG/uFHn6laNNvWshjqsIdus99Tbrj5RlfP2/YFP9VTOcsXzVYy9K0P3EA8ekVLpHQ4uCFJmF3OEjQJBAMvwO69/HOufhv1CWZ25XzAsRGhPqsRXEouw9XPfXpMavEm8FkuT9xXRJFkTVxl/i6RdJYx8Rwn/Rm34t0bUKqMCQQCrAtKCUn0PLcemAzPi8ADJlbMDG/IDXNbSej0Y4tw9Cdho1Q38XLZJi0RNdNvQJD1fWu3x9+QU/vJr7lMLzdoy-----END PRIVATE KEY-----
45+
46+
# Identity Provider Data that we want connect with our SP
47+
# Identifier of the IdP entity (must be a URI)
48+
onelogin.saml2.idp.entityid = https://pitbulk.no-ip.org/simplesaml/saml2/idp/metadata.php
49+
50+
# SSO endpoint info of the IdP. (Authentication Request protocol)
51+
# URL Target of the IdP where the SP will send the Authentication Request Message
52+
onelogin.saml2.idp.single_sign_on_service.url = https://pitbulk.no-ip.org/simplesaml/saml2/idp/SSOService.php
53+
54+
# SAML protocol binding to be used when returning the <Response>
55+
# message. Onelogin Toolkit supports for this endpoint the
56+
# HTTP-Redirect binding only
57+
onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
58+
59+
# SLO endpoint info of the IdP.
60+
# URL Location of the IdP where the SP will send the SLO Request
61+
onelogin.saml2.idp.single_logout_service.url = https://pitbulk.no-ip.org/simplesaml/saml2/idp/SingleLogoutService.php
62+
63+
# SAML protocol binding to be used when returning the <Response>
64+
# message. Onelogin Toolkit supports for this endpoint the
65+
# HTTP-Redirect binding only
66+
onelogin.saml2.idp.single_logout_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
67+
68+
# Public x509 certificate of the IdP
69+
onelogin.saml2.idp.x509cert = -----BEGIN CERTIFICATE-----MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo-----END CERTIFICATE-----
70+
71+
# Security settings
72+
#
73+
74+
# Indicates that the nameID of the <samlp:logoutRequest> sent by this SP
75+
# will be encrypted.
76+
onelogin.saml2.security.nameid_encrypted = true
77+
78+
# Indicates whether the <samlp:AuthnRequest> messages sent by this SP
79+
# will be signed. [The Metadata of the SP will offer this info]
80+
onelogin.saml2.security.authnrequest_signed = true
81+
82+
# Indicates whether the <samlp:logoutRequest> messages sent by this SP
83+
# will be signed.
84+
onelogin.saml2.security.logoutrequest_signed = true
85+
86+
# Indicates whether the <samlp:logoutResponse> messages sent by this SP
87+
# will be signed.
88+
onelogin.saml2.security.logoutresponse_signed = true
89+
90+
# Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> and
91+
# <samlp:LogoutResponse> elements received by this SP to be signed.
92+
onelogin.saml2.security.want_messages_signed = true
93+
94+
# Indicates a requirement for the <saml:Assertion> of the <samlp:Response> to be signed
95+
onelogin.saml2.security.want_assertions_signed = true
96+
97+
# Indicates a requirement for the Metadata of this SP to be signed.
98+
# Right now supported null/false (in order to not sign) or true (sign using SP private key)
99+
onelogin.saml2.security.sign_metadata = true
100+
101+
# Indicates a requirement for the Assertions received by this SP to be encrypted
102+
onelogin.saml2.security.want_assertions_encrypted = false
103+
104+
# Indicates a requirement for the NameID received by this SP to be encrypted
105+
onelogin.saml2.security.want_nameid = true
106+
107+
# Indicates a requirement for the NameID received by this SP to be encrypted
108+
onelogin.saml2.security.want_nameid_encrypted = false
109+
110+
# Authentication context.
111+
# Set Empty and no AuthContext will be sent in the AuthNRequest,
112+
# Set comma separated values urn:oasis:names:tc:SAML:2.0:ac:classes:urn:oasis:names:tc:SAML:2.0:ac:classes:Password
113+
onelogin.saml2.security.requested_authncontext = urn:oasis:names:tc:SAML:2.0:ac:classes:urn:oasis:names:tc:SAML:2.0:ac:classes:Password
114+
115+
# Allows the authn comparison parameter to be set, defaults to 'exact'
116+
onelogin.saml2.security.requested_authncontextcomparison = exact
117+
118+
119+
# Indicates if the SP will validate all received xmls.
120+
# (In order to validate the xml, 'strict' and 'wantXMLValidation' must be true).
121+
onelogin.saml2.security.want_xml_validation = true
122+
123+
# Algorithm that the toolkit will use on signing process. Options:
124+
# 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
125+
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
126+
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
127+
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
128+
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
129+
130+
# Organization
131+
onelogin.saml2.organization.name = SP Java
132+
onelogin.saml2.organization.displayname = SP Java Example
133+
onelogin.saml2.organization.url = http://sp.example.com
134+
135+
# Contacts
136+
onelogin.saml2.contacts.technical.given_name = Technical Guy
137+
onelogin.saml2.contacts.technical.email_address = technical@example.com
138+
onelogin.saml2.contacts.support.given_name = Support Guy
139+
onelogin.saml2.contacts.support.email_address = support@example.com

0 commit comments

Comments
 (0)