In pysaml2, how does one include attributes in the initial AuthNResponse?

Question

I have the example IdP/SP working ok. I can hook up my app to the example IdP and the handshake works ok. However, the initial AuthNResponse includes only the eduPersonTargetedID and I want it to include other attibutes, like sn, email, etc. I know the response includes a link to the attribute service but I need the attributes in the AuthNResponse.

Any suggestions/pointers on how to accomplish that?

Thanks, Shawn

Any suggestions/pointers on how to accomplish that?

Thanks, Shawn

user_4392800 · Answer

You pass a dict that maps keys of your to-be attributes to their values:

IDENTITY = {"surName": ["Jeter"], "givenName": ["Derek"],"title": ["shortstop"]}
server.create_authn_response(IDENTITY,...); # other arguments are omitted for this example

Doing so yields this in the emitted response:

As you can see, FriendlyName of the element is set to the name of the key in IDENTITY dict. The value of element is set to the value of the corresponding dict entry based on the key. Each element also has Name and NameFormat attributes. Values of these come from a configuration map you also have to set up.

Configuration maps are files that are loaded from a directory pointed to by attribute_map_dir in the identity provider config file:

CONFIG = {
    "entityid": "http://saml.example.com:saml/idp.xml",
    ...
    "attribute_map_dir": "attributemaps"
}

In the attributemaps directory, multiple files could exist. Each file is Python source with a MAP dict that has the SAML identifier (name) of the attribute format that your identity provider will support and to and fro nested maps. The to map is used by the identity provider to translate from the name of the (incoming) key in the IDENTITY dict to the value of (outgoing) Name attribute in element.

X500ATTR_OID = "urn:oid:2.5.4."

MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
    "fro": {
        ...
    },
    "to": {
        'surName': X500ATTR_OID+'4',
        'givenName': X500ATTR_OID+'42',
         ...
        'title': X500ATTR_OID+'12'
    }
}

You can copy the maps from pysaml2 source and modify them as needed. The keys/values in to nested map and the value of identifier will be determined by what your SAML service provider expects/supports. FriendlyName doesn't matter, it's used for readability but the spec doesn't rely on it.

In pysaml2, how does one include attributes in the initial AuthNResponse?

1 Answers