Re: [keycloak-dev] SAML users should not be identified by SAML:NameID

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 +1 for this, we're going to need it. On Mon, 2018-07-30 at 17:06 +0200, Hynek Mlnarik wrote: > Yes, please file a feature request JIRA > > On Mon, Jul 30, 2018 at 3:33 PM Daniel Teixeira <ddtxra(a)gmail.com&gt; > wrote: > > > Hello, > > > > Seems like Keycloak always uses the saml:NameID to identify a SAML > > user. > > In org.keycloak.broker.saml.SAMLEndpoint we see: > > > > BrokeredIdentityContext identity = new > > BrokeredIdentityContext(subjectNameID.getValue()); > > ... > > identity.setUsername(subjectNameID.getValue()); > > > > However this is not a good practice, see recommendations here: > > https://kantarainitiative.github.io/SAMLprofiles/saml2int.html > > > > *SPs MUST NOT require the presence of a <saml:NameID> element and > > MUST NOT > > rely on the content of this element for long term identification of > > subjects; <saml:Attribute> elements MUST be used for this purpose > > in > > the *manner > > detailed below. > > > > IMO, Keycloak should provide a field when configuring an iDP to > > choose the > > custom attribute to "identify" a user. This can be mail attribute > > for > > example (urn:oid:0.9.2342.19200300.100.1.3). But should not take > > this > > information from saml:NameID > > > > Is there anyway to override this in Keycloak? > > Should I create a JIRA issue? > > > > Best regards, > > Daniel Teixeira > > _______________________________________________ > > keycloak-dev mailing list > > keycloak-dev(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/keycloak-dev > > > > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev