How to add custom data in the SAML AuthnRequest

UAA
1

Hey,
in the SAML AuthnRequest I need to add additional data for specifying some things for the login. What I want in the end should look something like this:

<saml2p:AuthnRequest [...]>
    [...]
    <saml2p:Extensions>
        <akdb:AuthenticationRequest xmlns:akdb="https://www.akdb.de/request/2018/09" Version="2">
            <akdb:AuthnMethods>
                <akdb:Benutzername>
                    <akdb:Enabled>true</akdb:Enabled>
                </akdb:Benutzername>
            </akdb:AuthnMethods>
            <akdb:RequestedAttributes>
                <akdb:RequestedAttribute Name="urn:oid:1.1" RequiredAttribute="false" />
                <akdb:RequestedAttribute Name="urn:oid:1.2" RequiredAttribute="true" />
                <akdb:RequestedAttribute Name="urn:oid:1.3"/>
            </akdb:RequestedAttributes>
        </akdb:AuthenticationRequest>
    </saml2p:Extensions>
    <saml2p:RequestedAuthnContext Comparison="exact">
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
            STORK-QAA-Level-4
        </saml:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

I am facing two problems:

  1. In getA12 there it is only described how to add extensions, but not with additional named attributes (like Version="2" or RequiredAttribute="true")

  2. Also I found no description on how to add other elements (like <saml2p:RequestedAuthnContext Comparison="exact">) outside of <saml2p:Extensions>.

Are those to things somehow possible? And how could I do this?

2

hi can you use this extension point: com.mgmtp.a12.uaa.authentication.saml.RequestExtensionsDataGenerator
You can implement your logic like:

public List<RequestExtension> generateExtensionData() {
		RequestExtension extensionRoot = new RequestExtension.Builder("AdHocCertificateChain", "ekona", null).build();
		RequestExtension extensionChild = new RequestExtension.Builder("AdHocCertificateChain_Child", "ekona", "#####").build();
		extensionRoot.setChild(extensionChild);
		RequestExtension extensionRoot2 = new RequestExtension.Builder("AdHocCertificateChain_2", "ekona", "@@@@@@@@").build();
		return Arrays.asList(extensionRoot, extensionRoot2);
	}
3

I hope in the future the is an official UAA support for those configurations, but for now I found a (hacky) solution, to at least test the feautures of the BundID-IDP. In case you are facing a similar problem, use my solution at your own risk:

  1. The logic to add my needed elements to a SAML-Request I wrote into a class inhereting from Consumer<OpenSaml4AuthenticationRequestResolver.AuthnRequestContext> using UAAAuthnRequestConsumer as a reference.
  2. To apply this during the login I implemented my own UAASecurityConfigurer, wich only set the authenticationRequestResolver. Again I used an A12 class SamlSecurityConfigurer as reference.
  3. The last problem was, that I could not pre-determine the order of the loaded list UAASecurityConfigurer in UAAGlobalSecurityConfiguration, which resulted in my changes always being overwritten by SamlSecurityConfigurer. So I duplicated the class UAAGlobalSecurityConfiguration so I can modify the SecurityFilterChain bean and set it as primary (so that it is used instad of UAA ones). So before the list uaaSecurityConfigurers was used, I ordered it in such a way, that my own implementation will be executed last.