[Feature-4637]idpAttributes Session Property

[zacht]

We're using a SAML identity provider (Azure in this case). It would be convenient to get all the information provided by the IdP in one of my Perspective projects. The user manual suggests that the idpAttributes session property gets me what I'm looking for, but I just get an empty object.

This post seems to indicate that idpAttributes isn't supported by SAML IdP's:

Added Support for OIDC User Info and Token Endpoint Response

The 7/25/2020 nightly release of Ignition 8.0.16 introduces first-class support for OIDC IdPs to call the User Info API. Additionally, the token endpoint response object is now exposed to user attribute mappers, security level rules, and Perspective sessions. User Info The OIDC spec defines an HTTP endpoint which may be optionally exposed by IdPs. Relying party applications (such as Ignition) may optionally call this endpoint to retrieve additional claims about the authenticated user which may…

Is there a way to get the whole SAML object in a perspective project? If idpAttributes doesn't support SAML IdP's, can the documentation be updated to reflect this?

[stat]

The user manual suggests that the idpAttributes session property gets me what I’m looking for, but I just get an empty object.

Are you viewing the idpAttributes property within the Designer?

From the manual for the idpAttributes property:

Note: The Designer does not authenticate against identity providers in Ignition 8.0, so this object will
always appear empty in the designer. Use the Test Login page to determine the shape of this property, or use a simple binding to something visual (i.e. a label) display and parse the results while developing your project.

Is the property empty if you attempt to print its value or display its value through a property binding on a label component within a session in the browser?

[zacht]

Here is the binding I’m using.

Viewing in the browser

[stat]

Thank you for testing that out. As you mentioned, currently the idpAttributes property does not support the ability to display SAML Response Document. It does support the OpenID Connect(OIDC) response, which is explained in that forum post you shared. We have a feature request in our queue to include the SAML response document, but there is no timeline for when this will be completed. When the feature is completed it will show up in the nightly change logs with the number 4637.

If idpAttributes doesn’t support SAML IdP’s, can the documentation be updated to reflect this?

I can reach out to our IA manual team to ask them to update this.

[zacht]

Thanks for the confirmation. I’ll keep an eye out for 4637.

[jspecht]

The SAML Response XML is now available as a Perspective session prop starting with version 8.1.41-SNAPSHOT-b20240514

See: Nightly 8.1 Changelogs - 2024 - #82 by system

[cross]

This has been resolved with Ignition 8.1.42, released today

[diamond]

Hello,

Just tested with Azure SAML, working fine.

How is the best way to extract an specific attribute from this idpAttributes thing?

In the gateway I use:

/saml2p:Response/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute[@Name="emailaddress"]/saml2:AttributeValue/text()

How can I extract other attributes with this in a binding?

Thanks!