Audience Child Element of SAML2SSOProfile

[Ian MacDonald]

Hi,

I have a requirement to add the <saml2:Audience> restriction to my IDP's
SAML2SSOProfile configuration.

From
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2SSOProfileConfig
it
looks to me like I should be able to simply add a child element to the
Relying Party configuration.

I took my working RelyingParty configuration below:

<rp:RelyingParty id="https://service.providerlogin.com" provider="
https://my.idp.com/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">

<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never"/>

</rp:RelyingParty>



And added the Audience Child Element similar to below:

<rp:RelyingParty id="https://service.providerlogin.com" provider="
https://my.idp.com/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">

<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never">

<rp:Audience>https://saml2.providerlogin.com</rp:Audience>

</rp:ProfileConfiguration>

</rp:RelyingParty>

What I end up with is a SAXParseException error on the relying-party.xml
file that is confusing because it states that the element is incorrect, and
then lists it as potentially acceptable elements.

I can't seem to find any good examples using the Audience child element.
Any help appreciated. I'm expecting it's some simple attribute or
namespace error not obvious to me.

cheers,
Ian

[Cantor, Scott]

Post by Ian MacDonald
<rp:RelyingParty id="https://service.providerlogin.com
<https://service.providerlogin.com/>"
provider="https://my.idp.com/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never">
<rp:Audience>https://saml2.providerlogin.com
<https://saml2.providerlogin.com/></rp:Audience>

I'd have to look, but I would imagine the element is supposted to be in
the normal SAML namespace, not ours.

Post by Ian MacDonald
What I end up with is a SAXParseException error on the relying-party.xml
file that is confusing because it states that the element is incorrect,
and then lists it as potentially acceptable elements.

Look closer at the message and you'll see that's not true. It notes the
namespaces of the content it will look for.

-- Scott

[Ian MacDonald]

Thanks Scott,

Post by Cantor, Scott
Look closer at the message and you'll see that's not true. It notes the
namespaces of the content it will look for.

I had missed the subtle difference between the two clearly defined
namespaces shown at the top of relying-party.xml.

xmlns:*rp*="urn:mace:shibboleth:2.0:relying-party" xmlns:*saml*
="urn:mace:shibboleth:2.0:relying-party:saml"

For others, here is the Error message I glossed over quickly.

The root cause of this error was: org.xml.sax.SAXParseException:
cvc-complex-type.2.4.a: Invalid content was found starting with element
'rp:AudienceRestriction'. One of
'{"urn:mace:shibboleth:2.0:relying-party:saml":Audience,
"urn:mace:shibboleth:2.0:relying-party:saml":ProxyAudience}' is expected.

I am now testing the following which I believe should work

<rp:RelyingParty id="https://service.providerlogin.com" provider="
https://my.idp.com/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never">
<*saml*:Audience>https://saml2.providerlogin.com</*saml*
:Audience>
</rp:ProfileConfiguration>
</rp:RelyingParty>

[Cantor, Scott]

Post by Ian MacDonald
I had missed the subtle difference between the two clearly defined
namespaces shown at the top of relying-party.xml.
xmlns:rp="urn:mace:shibboleth:2.0:relying-party"
xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml"

I had assumed we just reused the SAML namespace, apparently the Audience
element there was redefined for whatever reason.

-- Scott