Allow retrieving username from SAML Assertion Attributes

[palakova]

Expected Behavior

Username (in the sense of Principal Name) can be released by IdP AuthnRequest's Assertion in NameID element or one of the Attribute element instead. NameID, if present (as it is even optional, as also discussed in #11463), can be of different Format, holding different kind of values.

It would be nice to have a more convenient way to configure where to retrieve the username from - NameID element versus providing a Name of an Assertion Attribute that is expected to hold the username.

Current Behavior

Spring SAML considers only NameID element to hold username, and populates Saml2AuthenticatedPrincipal#name with NameID value in OpenSaml4AuthenticationProvider.

Context

Example for integration with Shibboleth: IdP releases NameID Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient (according to SAML spec, this indicates that the content of the element is an identifier with transient semantics and SHOULD be treated as an opaque and temporary value by the relying party). Username is released in one of Assertion Attribute instead.

Workaround: custom responseAuthenticationConverter to retrieve username from Attribute

[AkashB23]

@jzheaux in which version will the changes be available for adoption ?

[jzheaux]

Sorry for the delay in my response, @AkashB23.

Because an application can configure a response authentication converter already, it hasn't been as high of a priority, though I'm happy to help you with a PR if you are interested.

I think what would likely make the most sense is moving the default response authentication converter support into a separate class and then adding a setter to it like so (pseudocode):

class ResponseAuthenticationConverter implements Converter<ResponseToken, AbstractAuthenticationToken> {
    ...

    public void setPrincipalNameConverter(Converter<AssertionToken, String> principalNameConverter) {
        ...
    }
}

[AkashB23]

Hi @jzheaux
Yes, I can provide my own ResponseAuthenticationConverter to get the email from whatever attribute I want but as I mentioned in [https://github.com//issues/14199]

even before the control is passed to converter, an assertion without NameId policy from Idp will fail at https://github.com/spring-projects/spring-security/blob/515e8216b18a6b7757f69a949014ede74c9676aa/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java#L649