SAML Attributes are received in Assertion but becomes NULL after SiteMinder processing it.

Products

• SITEMINDER
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

SiteMinder is Service Provider(SP) and receiving SAML Assertion which contains SAML Attributes like username and date of birth.
But after SiteMinder process the Assertion, the SAML Attributes are reported to be NULL.

 

smtracedefault.log reports the following.

[Storing Assertion data.  Name: SampleUserName Value: NULL Flags: 0]
[Storing Assertion data.  Name: SampleDOB Value: NULL Flags: 0]

Environment

SiteMinder as Service Provider(SP)

 

SAML Attribute received as sample below.

<ns2:AttributeStatement>
        <ns2:Attribute Name="SampleUserName"
                       NameFormat="urn:oasis:names:tc:SAML:2.0:attribute-format:basic">
            <ns2:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                type="xs:string">SampleUserNameValue</ns2:AttributeValue>
        </ns2:Attribute>
        <ns2:Attribute Name="SampleDOB"
                       NameFormat="urn:oasis:names:tc:SAML:2.0:attribute-format:basic">
            <ns2:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                type="xs:string">SampleDOBValue</ns2:AttributeValue>
        </ns2:Attribute>
</ns2:AttributeStatement>

 

smtracedefault.log shows the following message.

[Storing Assertion data.  Name: SampleUserName Value: NULL Flags: 0]
[Storing Assertion data.  Name: SampleDOB Value: NULL Flags: 0]

Cause

The namespace is not declared correctly.
For the AttributeValue, the "type" is defined as "xs:string".
When using this "xs:string" then it requires "xmlns:xs=http://www.w3.org/2001/XMLSchema" and this is missing.
SiteMinder uses JAXB to marshall the data received and this fails due to above reason and as a result the value becomes NULL.

Resolution

Add the correct namespace references.