Saml2: Adding NameId in the generated metadata

[rpmansion]

Hi there,

I'm using your SAML2 via Owin middleware. How to add the NameId in the generated metadata as shown below?

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_eca2f940-359b-4548-9411-f0c46deb8395" entityID="https://localhost:44300/saml2/sp" cacheDuration="PT1H">
   <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
      <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:44300/saml2/sp/metadata/Acs" index="0" isDefault="true" />
      <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://localhost:44300/saml2/sp/metadata/Acs" index="1" isDefault="false" />
      <AttributeConsumingService index="0" isDefault="false">
         <ServiceName xml:lang="en">saml2p</ServiceName>
         <RequestedAttribute Name="urn:oid:1.2.840.113549.1.9.1" isRequired="true" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="email" />
      </AttributeConsumingService>
   </SPSSODescriptor>
   <Organization>
      <OrganizationName xml:lang="en-GB">My Organization</OrganizationName>
      <OrganizationDisplayName xml:lang="en-GB">My Organisation Cor.</OrganizationDisplayName>
      <OrganizationURL xml:lang="en-GB">https://www.my-organisation.com/</OrganizationURL>
   </Organization>
   <ContactPerson contactType="support">
      <EmailAddress>[email protected]</EmailAddress>
   </ContactPerson>
</EntityDescriptor>

I would like to add this as part of the requirement as it is needed by our clients.

[AndersAbel]

You mean NameIdFormat? Set SpOptions.NameIdPolicy to something.

[rpmansion]

@AndersAbel Yes, I have added this. However, it is not showing in the generated metadata only in AuthnRequest.

[AndersAbel]

Yes, you're right, the policy doesn't affect the metadata, my bad.

There's currently no support to handle this from the web.config. You can handle it from code by hooking the MetadataCreated notification and alter the metadata before it's serialized.

If you want it possible to do from web.config, it must be implemented. Either do it yourself and send a PR or mail me at [email protected] for a discussion about sponsoring the feature.

[rpmansion]

@AndersAbel So I cloned your repository and made some changes to show the NameIdFormat in the generated metadata. It looks like this, please see the below.

In the SPOptionsExtensions class, I added the below.

if (spOptions.NameIdPolicy != null)
{
    spsso.NameIdentifierFormats.Add(spOptions.NameIdPolicy.Format.GetUri());
}

[rpmansion]

@AndersAbel #903 done sending PR

[AndersAbel]

Thanks. Will review eventually, but I'm lagging behind with the PR queue.

[rpmansion]

@AndersAbel correct me if I'm wrong, should the SPOptions.NameIdPolicy a list so we can define multiple NameIdFormat in the metadata?

[AndersAbel]

The SPOptions.NameIdPolicy is not used for exposure in metadata, it is used to set a value in generated AuthnRequests. And there only one value is allowed. So to allow multiple NameIdFormat in metadata we have to consider the current usage of setting it in AuthnRequests. So I think there should be two different configurations for this - one to generate the NameIdFormat in the metadata and one for the policy in AuthnRequests.

[4nd3r5]

I would welcome this as well.