Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Add Subject ID attribute support #454

Merged
merged 1 commit into from Jan 12, 2023
Merged

feat: Add Subject ID attribute support #454

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
26 changes: 24 additions & 2 deletions identity_provider.go
View file
Open in desktop
Expand Up @@ -36,7 +36,10 @@ type Session struct {
ExpireTime time.Time
Index string

NameID string
NameID string
NameIDFormat string
SubjectID string

Groups []string
UserName string
UserEmail string
Expand Down Expand Up @@ -734,6 +737,19 @@ func (DefaultAssertionMaker) MakeAssertion(req *IdpAuthnRequest, session *Sessio
})
}

if session.SubjectID != "" {
attributes = append(attributes, Attribute{
Name: "urn:oasis:names:tc:SAML:attribute:subject-id",
NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
Values: []AttributeValue{
{
Type: "xs:string",
Value: session.SubjectID,
},
},
})
}

// allow for some clock skew in the validity period using the
// issuer's apparent clock.
notBefore := req.Now.Add(-1 * MaxClockSkew)
Expand All @@ -743,6 +759,12 @@ func (DefaultAssertionMaker) MakeAssertion(req *IdpAuthnRequest, session *Sessio
notOnOrAfterAfter = notBefore.Add(MaxIssueDelay)
}

nameIDFormat := "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

if session.NameIDFormat != "" {
nameIDFormat = session.NameIDFormat
}

req.Assertion = &Assertion{
ID: fmt.Sprintf("id-%x", randomBytes(20)),
IssueInstant: TimeNow(),
Expand All @@ -753,7 +775,7 @@ func (DefaultAssertionMaker) MakeAssertion(req *IdpAuthnRequest, session *Sessio
},
Subject: &Subject{
NameID: &NameID{
Format: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
Format: nameIDFormat,
NameQualifier: req.IDP.Metadata().EntityID,
SPNameQualifier: req.ServiceProviderMetadata.EntityID,
Value: session.NameID,
Expand Down