Skip to main content

Change NameID format in SAML Response in WSO2 Identity Server

By default the SAML response of the WSO2 Identity Server will contain the tenant domain in the response. See the below response block which containts the tenant domain appended to the NAMEID element.

<saml2:NameIDFormat
="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">admin@carbon.super
</saml2:NameID>

If you want to get rid of the tenant domain being appended you can follow one of the below methods to accomplish this


Method 1 - Disabling this option from the management console.

Log into the management console of the Identity Server

Expand your service provider configuration and select the 'Local & Outbound Authentication Configuration' option

Untick the option 'Use tenant domain in local subject identifier'

             

Now the tenant domain would not be displayed in your SAML response.
Method 2 - Setting this value for the file based Service Provider configurations

 Given that you have configured the service provider through a configuration file following the documentation [1], below are the steps which you would need to follow to get rid of the domain being appended to the Nameid in the SAML response.


1. Open up you service provider configuration file and then navigate to the configuration marked as <LocalAndOutBoundAuthenticationConfig> . Just above the closing tag of it add the below xml configuration. This will set the subject claim to be the given name instead of the domain qualified name.

<subjectClaimUri>http://wso2.org/claims/givenname</subjectClaimUri>

2. Next we need to add the below configuration which is highlighted under the claim configuration section of the same file.

<RequestPathAuthenticatorConfigs></RequestPathAuthenticatorConfigs> <InboundProvisioningConfig></InboundProvisioningConfig> <OutboundProvisioningConfig></OutboundProvisioningConfig> 

 <!-- ADD NEW CONFIG MENTIONED BELOW --> 

<ClaimConfig> 
       <LocalClaimDialect>true</LocalClaimDialect> 
</ClaimConfig> 
<PermissionAndRoleConfig></PermissionAndRoleConfig> 
</ServiceProvider>

After adding this restart the identity server. You would be able to see the NameID without the @carbon.super post-fix.

References :

[1] https://docs.wso2.com/display/IS500/Adding+a+Service+Provider+and+Identity+Provider+Using+Configuration+Files
Labels:

Comments

Post a Comment

Popular posts from this blog

WSO2 Cloud

Introduction WSO2 Cloud consists of three commercial cloud offerings namely the API cloud, Integration Cloud and the Identity Cloud. WSO2 Integration Cloud WSO2 Integration Cloud is a public hosted version of the powerful, 100% open-source WSO2 Enterprise Integrator. It allows you to host your cloud-to-cloud, cloud-to-on-premise integrations and API backends on a scalable cloud platform WSO2 API Cloud WSO2 API Cloud is an enterprise-ready, self-service platform that enables you to expose business capabilities as managed APIs and leverage off-the-shelf potential for advertising and selling business APIs. The API Cloud supports all aspects of an API’s lifecycle, from its creation to publication and retirement. The API Cloud is based on WSO2 API Manager , WSO2’s complete solution for designing and publishing APIs and managing a developer community. [2] WSO2 Identity Cloud WSO2 Identity Cloud leverages the functionality of WSO2 Identity Server’s identity and ac...
1 comment
Read more

Exposing a SOAP service as a REST API

In this post i will be explaining how we can transform a SOAP based backend to receive requests in a restful manner through the WSO2 API Cloud. Steps. First log into the WSO2 Cloud and navigate to the API Cloud. In the API cloud select the option to add a new API. We will be creating an API to demonstrate an invocation to the backend soap service ws.cdyne.com/phoneverify/phoneverify.asmx?wsdl Give a name, context and version to the API and add a resource name with a GET Method. The resource name can be anything which you like since we will invoke the actual service usiing a custom sequence. Mention the URI template as indicated in the below screenshot. Next go to the implement tab. And select the endpoint type as HTTP/SOAP Endpoint and specify the endpoint as http://ws.cdyne.com/phoneverify/phoneverify.asmx. There is an important step we need to do here. We need to set the SOAP version for this request. In order to do that we need to select the advanced option ...
2 comments
Read more

Adding error sequence to a custom sequence

In my previous posi i explained how to call an endpoint using the call mediator. Usually when errors are thrown from the call mediator we can handle them using a custom sequence. When call mediators fails the execution stops hence handling errors is very essential. For this post I will be modifying the same sequence which i created in the blog post [1] The change which we need to do is we need to modify the sequence definition to map with the error sequence as shown below. You can find the modified sequence here . <sequence xmlns="http://ws.apache.org/ns/synapse" name="countrySequenceWithError" onError="countryErrorSequence"> <property name="uri.var.countryCode" expression="$url:countryCode"/> <property name="REST_URL_POSTFIX" scope="axis2" action="remove"/>     <call blocking="true">         <endpoint>             <http method="get" uri-temp...
2 comments
Read more