Federation metadata export Includes BOTH HTTP-Redirect and HTTP-Post Bindings even though we selected ONLY HTTP-Post Binding in the Federation Partnership.

Products

• CA Single Sign On Federation (SiteMinder)
• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

Federation metadata exports BOTH HTTP-Redirect and HTTP-Post Bindings even though we selected ONLY HTTP-Post Binding in the Federation Partnership.

------ Detailed Usecase:

When we are creating SAML2 Federation partnership in the SSO section we are selecting the following options:

- FLOW: Partnership Federation - Partnerships - Create Partnership - SSO and SLO section:

- Authentication Request Binding -> only HTTP-Post is selected

- SSO Binding -> only HTTP-Post is selected

- But when we take the METADATA export we see that this metadata file has two bindings like below: HTTP-Redirect and HTTP-Post even though we selected ONLY HTTP-Post Binding in the Federation Partnership.

<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://eaxample.com/affwebservices/public/saml2sso"/>

<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://eaxample.com/affwebservices/public/saml2sso"/>

Environment

CA siteminder (AKA SYMANTEC SITEMINDER) 12.8 SP4 environment

Resolution

HTTP-Redirect binding in the metadata is getting exported even though HTTP-POST binding  was selected during Federation Partnership creation.

Expectation that metadata is exported without the HTTP-Redirect binding which is not happening.
This was Identified as a bug in the product and a DEV fix was provided.

Please reach out to Broadcom support to get the fix