Some Identity Providers for eHerkenning and eIDAS require the following attributes to be set in the SAML 2.0 SP Metadata, which are not added by default:
The isDefault attribute on the AssertionConsumerService element:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://[yourdomain]/profiles/dvg/libraries/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/eidas_low" index="0" isDefault="true"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://[yourdomain]/profiles/dvg/libraries/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/eidas_low" index="1" isDefault="false"/>
The isRequired-attribute with value false, for example on the optional "Initials" attribute for eIDAS:
<md:RequestedAttribute Name="urn:etoegang:1.9:attribute:Initials" isRequired="false"/>
Patch the simplesamlphp library so the SAML 2.0 SP Metadata is exported with all required attributes.
Make a patch for simplesamlphp to add the missing attributes, make a patch for DvG to add the changes.
none.
none.
none.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | dvg-simplesamlphp_missing_metadata_attributes-3004091-4.patch | 2.71 KB | ralphvdhoudt |
Comments
Comment #2
tvoesenek commentedThis patch adds the Simplesaml patch to fix the problem.
Comment #3
tvoesenek commentedComment #4
ralphvdhoudt commentedRerolled against latest dev
Comment #5
bskibinskiPatch has been running on production without problems.
Has been reviewed and tested.
Comment #7
paulvandenburg commentedI hope Drupal.org accepts the local patch when building a new release. But we'll find out soon.