[FEDIZ-168] Support SAML Token without Audience Restriction

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.3.0, 1.2.2
• Fix Version/s: 1.2.3, 1.3.1
• Component/s: IDP, Plugin
• Assignee: Jan Bernhardt
• Reporter: Jan Bernhardt
• Created: 01/Jun/16 09:18
• Updated: 15/May/18 10:13
• Resolved: 01/Jun/16 13:09

Description

Currently Fediz only supports SAML with an audience restriction. However the standard only requires audience restriction validation if this value is present within the SAML token. If no audience restriction is set, this token should be valid for any service.

Especially in cases when the Login SAML token should be used to login to a webpage and the same token can be used to authenticate the user against backend services, an audience restriction could be disturbing.

Fediz Plugin should accept SAML token without audience restrictions as valid (if all other security requirements are met) and the Fediz IDP should be configurable to request SAML token from the STS without audience restrictions.

Issue Links

• is related to: FEDIZ-218 Support SAML Token without Audience Restriction in plugin