SAML2 Attribute Release

Attribute filtering and release policies are defined per SAML service. See this guide for more info.

Attribute Value Types

By default, attribute value blocks that are created in the final SAML2 response do not carry any type information in the encoded XML. You can, if necessary, enforce a particular type for an attribute value per the requirements of the SAML2 service provider, if any. An example of an attribute that is encoded with specific type information would be:

1
2
3
<saml2:Attribute FriendlyName="givenName" Name="givenName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">HelloWorld</saml2:AttributeValue>
</saml2:Attribute>

The following attribute value types are supported:

Type Description
XSString Mark the attribute value type as string.
XSURI Mark the attribute value type as uri.
XSBoolean Mark the attribute value type as boolean.
XSInteger Mark the attribute value type as integer.
XSDateTime Mark the attribute value type as datetime .
XSBase64Binary Mark the attribute value type as base64Binary.
XSObject Skip the attribute value type and serialize the value as a complex XML object/POJO.

…where the types for each attribute would be defined as such:

1
2
3
4
5
6
7
8
9
10
11
{
  "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService",
  "serviceId" : "the-entity-id-of-the-sp",
  "name": "SAML Service",
  "metadataLocation" : "../../sp-metadata.xml",
  "id": 1,
  "attributeValueTypes": {
    "@class": "java.util.HashMap",
    "<attribute-name>": "<attribute-value-type>"
  }
}

Attribute Name Formats

Attribute name formats can be specified per relying party in the service registry.

1
2
3
4
5
6
7
8
9
10
11
{
  "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService",
  "serviceId" : "the-entity-id-of-the-sp",
  "name": "SAML Service",
  "metadataLocation" : "../../sp-metadata.xml",
  "id": 100001,
  "attributeNameFormats": {
    "@class": "java.util.HashMap",
    "attributeName": "basic|uri|unspecified|custom-format-etc"
  }
}

Name formats for an individual attribute can be mapped to a number of pre-defined formats, or a custom format of your own choosing. A given attribute that is to be encoded in the final SAML response may contain any of the following name formats:

Type Description
basic Map the attribute to urn:oasis:names:tc:SAML:2.0:attrname-format:basic.
uri Map the attribute to urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
unspecified Map the attribute to urn:oasis:names:tc:SAML:2.0:attrname-format:basic.
urn:my:own:format Map the attribute to urn:my:own:format.

You may also have the option to define attributes and their relevant name format globally via CAS properties.

The following settings and properties are available from the CAS configuration catalog:

The configuration settings listed below are tagged as Required in the CAS configuration metadata. This flag indicates that the presence of the setting is not strictly necessary in the end-user CAS configuration, because a default value may be assigned or the feature in question may not be immediately intended for use. You may want to own the setting and update it assigned value, assuming the intended feature controlled by the setting is utilized.

  • cas.authn.saml-idp.entity-id=https://cas.example.org/idp
  • The SAML entity id for the deployment.