Compatibility problem with Microsoft's ADFS, possible solutions? about pysaml2

[rohe]

8 okt 2014 kl. 12:43 skrev Patrick Brosi [email protected]:

we are still working on an implemenation of a Pyramid-based SAML SP via pysaml2. Our IdP uses MS-ADFS. Apparantly, ADFS is not entirely faithful to the SAML specification.

An old well known pattern when it comes to MS.

The attribute values specified in the token are missing the nameFormat XML-attribute. Example:

testtest

pysaml2 won't parse attributes without a specified nameFormat. We fixed the problem by falling back to urn:oasis:names:tc:SAML:2.0:attrname-format:uri if the nameFormat is missing. This is done by initializing the member name_format in the class AttributeType_ with NAME_FORMAT_URI by default (see commit geops/pysaml2@1fce6d1).

Is this a legitimate way to handle the problem of ADFS compatibility or do you think it could cause problems? If so, what do you think would be the preferred way to provide an ADFS compatibility mode?

I think it’s a very reasonable way of handling this.
I will add it to the main branch.

— Roland

”Being able to think like a child is an important attribute of being an adult” - Eddie Izzard

[patrickbr]

Perfect. I issued a pull request for this: #148

Thank you very much for your quick answer.