In IdP-initiated SSO scenario we need to set NameQualifier option. This is the required result:
<saml2:NameID Format=“urn:oasis:names:tc:SAML:2.0:nameidformat:persistent” NameQualifier=“Foo”>XXX</saml2:NameID>
Using NameIDFormat in the configuration file we can set the Format option, but how do we set the NameQualifier to Foo?
This is our current code:
SAMLServiceProvider.ReceiveSSO(Request, out isInResponseTo, out partnerIdP, out authnContext, out userName, out attributes, out targetUrl);
Thank you.
Do you mean, as the identity provider, how do you set the NameQualifier?
Are you using our product to implement the identity provider as well as the service provider?
[quote]
[/quote]
Do you mean, as the identity provider, how do you set the NameQualifier? - Yes
We are using your product to implement the identity provider. 3rd party service provider is using Okta.
Our SAMLResponse needs to contain NameQualifier in the NameID.
Thank you.
Thanks for the clarification.
The SAMLIdentityProvider.InitiateSSO and SAMLIdentityProvider.SendSSO methods that create and send SAML responses, don’t expose a method for setting the NameQualifier. Nor can this be specified through the SAML configuration. In our experience, the NameQualifier isn’t used often.
You can implement the ISAMLObserver interface by extending the AbstractSAMLObserver class. These are under the ComponentSpace.SAML2.Notifications namespace.
The OnSAMLAssertionCreated method provides you with access to the SAMLAssertion object which you may modify as required.
You register your ISAMLObserver implementation by calling SAMLObservable.Subscribe.
Having said this, would you mind contacting support@componentspace.com? We might look at adding this support through the SAML configuration but I’d like to ensure we fully understand your requirements.
[quote][/quote]
Thanks for the clarification.
The SAMLIdentityProvider.InitiateSSO and SAMLIdentityProvider.SendSSO methods that create and send SAML responses, don't expose a method for setting the NameQualifier. Nor can this be specified through the SAML configuration. In our experience, the NameQualifier isn't used often.
You can implement the ISAMLObserver interface by extending the AbstractSAMLObserver class. These are under the ComponentSpace.SAML2.Notifications namespace.
The OnSAMLAssertionCreated method provides you with access to the SAMLAssertion object which you may modify as required.
You register your ISAMLObserver implementation by calling SAMLObservable.Subscribe.
Having said this, would you mind contacting support@componentspace.com? We might look at adding this support through the SAML configuration but I'd like to ensure we fully understand your requirements.
The SAMLIdentityProvider.InitiateSSO and SAMLIdentityProvider.SendSSO methods that create and send SAML responses, don't expose a method for setting the NameQualifier. Nor can this be specified through the SAML configuration. In our experience, the NameQualifier isn't used often.
You can implement the ISAMLObserver interface by extending the AbstractSAMLObserver class. These are under the ComponentSpace.SAML2.Notifications namespace.
The OnSAMLAssertionCreated method provides you with access to the SAMLAssertion object which you may modify as required.
You register your ISAMLObserver implementation by calling SAMLObservable.Subscribe.
Having said this, would you mind contacting support@componentspace.com? We might look at adding this support through the SAML configuration but I'd like to ensure we fully understand your requirements.
Thank you very much for your help!
I was able to set samlAssertion.Subject.NameID.NameQualifier using recommended AbstractSAMLObserver and OnSAMLAssertionCreated.
Thanks for the update.