Fedlet: How to remove SPNameQualifier attribute from Authnrequest message

Question

Hi all,
Hopefully someone on this forum is able to give me some hints how to proceed.
I'm trying to understand how SAML2 works, and how (if I get it working with sample application) I can integrate it with our existing application.
SP: Fedlet (Running on Weblogic 10.3)
IDP: Shibboleth (Running on Weblogic 10.3)
Both are running on the same server, but in different domains (and obviously with different ports).
Fedlet is installed, and has the IDP meta data file loaded. When I go to the fedletsample application, I get the 3 hyperlinks (Of which "Run Identity Provider initiated Single Sign-On" is a broken link). Clicking on the "Run Fedlet (SP) initiated Single Sign-On using HTTP POST binding" brings me to the IDP login page.
My IDP is using the embedded LDAP server from Weblogic. I enter the UID and Password, and (if details are entered correct), I'm redirected to the SP site again. Unfortunately at the SP site (The fedlet app) the message states "Single Sign On failed.".
From reading the log file at the IDP, I understand that my user is successfully authenticated, however IDP (Shibboleth) is unable to process "SPNameQualifer"
The log states a lot but I think the issue is related to an unknown attribute in the NameIDPolicy element:
My NameIDPolicy in the AuthnRequest looks like this
=====
     <samlp:NameIDPolicy
          AllowCreate="true"
          Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
          SPNameQualifier="fedletsp"
          xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"/>
=====
If I look up the details in the IDP log I see this
======
- Starting to unmarshall DOM element {urn:oasis:names:tc:SAML:2.0:protocol}NameIDPolicy
- Targeted QName checking is not available for this unmarshaller, DOM Element {urn:oasis:names:tc:SAML:2.0:protocol}NameIDPolicy was not verified
- Building XMLObject for {urn:oasis:names:tc:SAML:2.0:protocol}NameIDPolicy
- Unmarshalling attributes of DOM Element {urn:oasis:names:tc:SAML:2.0:protocol}NameIDPolicy
- Pre-processing attribute AllowCreate
- Attribute AllowCreate is neither a schema type nor namespace, calling processAttribute()
- Pre-processing attribute Format
- Attribute Format is neither a schema type nor namespace, calling processAttribute()
- Pre-processing attribute SPNameQualifier
- Attribute SPNameQualifier is neither a schema type nor namespace, calling processAttribute()
- Pre-processing attribute {http://www.w3.org/2000/xmlns/}samlp
- {http://www.w3.org/2000/xmlns/}samlp is a namespace declaration, adding it to the list of namespaces on the XMLObject
- Unmarshalling other child nodes of DOM Element {urn:oasis:names:tc:SAML:2.0:protocol}NameIDPolicy
- Unmarshalling child elements of XMLObject {urn:oasis:names:tc:SAML:2.0:protocol}AuthnRequest
- Unmarshalling child element {urn:oasis:names:tc:SAML:2.0:protocol}RequestedAuthnContextwith unmarshaller org.opensaml.saml2.core.impl.RequestedAuthnContextUnmarshaller
======
From topics I found using google, I understood that this attribute is not required, and that I should "suppres" it from the request.
Now here come my question, how do you suppress this? I assume I would need to add some information to the idp-extended.xml file that indicates to exclude this attribute (SPNameQualifer) from the authrequest. But unfortunately I'm unable to find this infomation.
Any help, tips are appreciated. I'm sure somewhere this information is stored, but I'm unable to find it.
Many thanks
Peter Daalder
Edited by: user11240309 on 13-apr-2011 1:29

Answer 1

I would like to perform similar action too.
Anyone know how to remove the "standalone" attribute?
Thanks.