Customizing SAML Assertion NameID using Attribute Expressions

Products

• SITEMINDER

Issue/Introduction

The LDAP user record has user attribute MYID,  which is in the format of ######@exampledomain.net

SAML Federation SP expects the NameID attribute to be sent as ######@exampledomain, not ######@exampledomain.net

Within federation partnership, there are only four configuration choice out of box for NameID attribute (Static, User Attribute, Session Attribute, DN Attribute).

This article provides instructions on how to use Attribute Expressions to transform and customize original user attributes within a SAML Federation Partnership.

Use these expressions to manipulate data retrieved from your User Directory (e.g., LDAP) before sending it as a NameID or Assertion Attribute to the Service Provider (SP).

This configuration is performed within the SiteMinder Administrative UI.

 

Environment

SiteMinder Policy Server 12.8

SAML Federation Partnership

Oracle Unified Directory / LDAP User Store

Resolution

1. Define "Attribute Mapping" as expression under user directory MYLDAP  (sample user:  ######@exampledomain.net)

Name: exampleNameID

Definition: BEFORE(STRING(MYID), ".net")

This will trim the attribute MYID, only keep the front part of the string before .net

2. Edit partnership,  under "Assertion Configuration" 

Choose Name ID Type=user attribute

Value=exampleNameID

3. Recycle access gateway, test federation flow.

Confirm NameID is passed in the assertion becomes ######@exampledomain within FWSTrace.log

        <ns2:Subject>
            <ns2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">######@exampledomain</ns2:NameID>
        <ns2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">