[CXF-4746] STS issues invalid SAML 1.1 Assertions under certain conditions

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.8, 2.6.5, 2.7.2
• Fix Version/s: 2.5.9, 2.6.6, 2.7.3
• Component/s: Services
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 11/Jan/13 14:44
• Updated: 02/May/13 02:29
• Resolved: 11/Jan/13 15:20

Description

The STS issues invalid SAML 1.1 Assertions under certain conditions. Namely, if an AttributeStatementProvider (such as the ClaimsAttributeStatementProvider) is explicitly configured on the SAMLTokenProvider, but no AttributeStatement is actually added (for example, if the client doesn't present any claims).

In this case, a SAML 1.1 Assertion can be issued with no Statements, something which is invalid according to the schema.

Issue Links

• is depended upon by: FEDIZ-40 Can CXF Fediz IDP & RP work with SAML1.1 ?