[CXF-3940] A SAML Token requested OnBehalfOf should hide the actual requestor and should only contain the OnBehalfOf Identity

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5
• Fix Version/s: 2.5.1
• Component/s: Services
• Labels: SAML WS-Trust sts
• Estimated Complexity: Moderate
• Assignee: Unassigned
• Reporter: Jan Bernhardt
• Created: 29/Nov/11 13:16
• Updated: 19/Dec/11 16:15
• Resolved: 29/Nov/11 15:06

Description

As far as I know, to request an OnBehalfOf Token should not simply result in adding a related SAML Attribute (as it would be ok for ActAs). OnBehalfOf should deliver a Token where "only" the OnBehalfOf Principal is contained. Therefor the SAML Subject should match the requested OnBehalfOf Principal and not the Principal which was authenticated based on the security token sent in the WS-Security header...