New API’s for SAML Attributes SAML 2.0 Basic Attribute Profile Required Passing Multiple Attributes to SAML Credential Mappers

9-16 Programming Security for Oracle WebLogic Server ■ The SAML credential mapper on the SAML Identity Provider site determines how to package the attributes based on the existence of this custom attribute mapper. ■ The SAML identity asserter on the SAML Service Provider site determines how to get the attributes based on the configuration of the custom name mapper. ■ The Java Subject is used to make the attributes extracted from assertions available to applications. This requires that the SAML Authentication provider be configured and the virtual user be enabled on a SAML partner.

9.4.2 New API’s for SAML Attributes

This release includes the following new SAML attribute API’s for SAML 2.0: ■ SAML2AttributeInfo ■ SAML2AttributeStatementInfo ■ SAML2CredentialAttributeMapper ■ SAML2IdentityAsserterAttributeMapper For SAML 1.1 you can instead use the following existing SAML attribute API’s: ■ SAMLAttributeInfo ■ SAMLAttributeStatementInfo ■ SAMLCredentialNameMapper SAMLCredentialAttributeMapper ■ SAMLIdentityAssertionAttributeMapper Subsequent sections describe the use of these SAML attribute API’s.

9.4.3 SAML 2.0 Basic Attribute Profile Required

SAML 1.1 does not prescribe the name format of the SAML attribute. However, only the SAML 2.0 Basic Attribute Profile is supported for SAML 2.0. Only attributes with the urn:oasis:names:tc:SAML:2.0:attrname-format:basic name format in SAML2AttributeInfo are written into a SAML 2.0 assertion. The urn:oasis:names:tc:SAML:2.0:attrname-format:basic name format is the default, so you need not set it. If you do set the name format, you must specify urn:oasis:names:tc:SAML:2.0:attrname-format:basic in the SAML2.AttributeInfo.setAttributeNameFormat method, as follows: SAML2AttributeInfo attrInfo = new SAML2AttributeInfo AttributeWithSingleValue, ValueOfAttributeWithSingleValue; attrInfo.setAttributeNameFormaturn:oasis:names:tc:SAML:2.0:attrname-format:basic ; attrs.addattrInfo;

9.4.4 Passing Multiple Attributes to SAML Credential Mappers

When the configured attribute mapper is called, it returns CollectionSAML2AttributeStatementInfo. You can specify multiple attribute statements, each containing multiple attributes, each possibly having multiple attribute values. SAML APIs 9-17 An example of doing this is as follows: private CollectionSAML2AttributeStatementInfo getAttributeStatementInfo Subject subject, ContextHandler handlers { CollectionSAML2AttributeInfo attrs = new ArrayListSAML2AttributeInfo; SAML2AttributeInfo attrInfo = new SAML2AttributeInfo AttributeWithSingleValue, ValueOfAttributeWithSingleValue; attrInfo.setAttributeNameFormaturn:oasis:names:tc:SAML:2.0:attrname-format:basic ; attrs.addattrInfo; ArrayListString v = new ArrayListString; v.addValue1OfAttributeWithMultipleValue; v.addValue2OfAttributeWithMultipleValue;