element-hq / element-hq/synapse
SAML: last RequestedAttribute is always set to isRequired="false"
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#8720](https://github.com/matrix-org/synapse/issues/8720).
---
### Description
In the SAML metadata generated under URL `/_matrix/saml2/metadata.xml` for the last `requestedAttribut` `isRequired` is always set to `false`. If `isRequired` is evaluated by the IDP, this results in the attribute not being passed from the IDP to the SP.
```
Matrix
Matrix
```
### Steps to reproduce
- configure `saml2_config` in homeserver.yaml
```
saml2_config:
[...]
service:
sp:
required_attributes: ["uid", "email", "displayName"]
```
- configure `saml2-attribute-maps/map.py`:
```
MAP = {
"identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
"fro": {
'urn:oid:0.9.2342.19200300.100.1.1': 'uid',
'urn:oid:0.9.2342.19200300.100.1.3': 'email',
'urn:oid:2.16.840.1.113730.3.1.241': 'displayName',
},
"to": {
'uid': 'urn:oid:0.9.2342.19200300.100.1.1',
'email': 'urn:oid:0.9.2342.19200300.100.1.3',
'displayName': 'urn:oid:2.16.840.1.113730.3.1.241',
},
}
```
- check your metadata URL `/_matrix/saml2/metadata.xml`. The last `RequestedAttribute`, in this example `displayName`, is set to `isRequired="false"`. I would expect `isRequired="true"` for all `required_attributes`.
```
```
### Workaround
As a workaround I have added an optional attribute in the homeserver.yaml. This means that the optional attribute is the last attribute and this one is set to false. I'm not really sure if this is a bug or if my configuration is incorrect.
```
required_attributes: ["uid", "email", "displayName"]
optional_attributes: ["eduPersonPrincipalName"]
```
generated metadata URL `/_matrix/saml2/metadata.xml`:
```
Matrix
Matrix
```
### Version information
- synapse 1.22.1 on Ubuntu 18.04 LTS, deb pakage from `https://packages.matrix.org/debian/ bionic main`
Contributor guide
Research direction
Start at the `/_matrix/saml2/metadata.xml` entry point and trace how `required_attributes` and `optional_attributes` from `homeserver.yaml` are converted into SAML RequestedAttribute elements. Use the provided `saml2-attribute-maps/map.py` mapping as the reproduction setup. Done means every required attribute is emitted with `isRequired="true"` and optional attributes with `isRequired="false"`.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100