GluuFederation/oxShibboleth

Remove SAML 1.1, Shib 1.0 and Artifact Resolution Profile from SAML metadata features

Closed this issue · 3 comments

I was going through the IDP metadata, and I wanted to remove unused stuff to keep the metadata as short and simple as possible!

  1. Disable the AttributeAuthority Service. The firewall blocks the SOAP endpoints anyway. I believe this XML should not even show up in the metadata
  2. In the <IDPSSODescriptor>... section of the metadata, remove support for SAML 1.1 and Shibboleth 1.0 endpoints and <ArtifactResolutionService>, but add the urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress NameIDFormat
dmogn commented

Which solution is best for XML configs:

  • Comment SAML1 / SAML2 AttributeService related points
  • Comment with warnings
  • Remove at all
    ?

Remove.

dmogn commented

Done.