0

Is there a way to change SAML issuer URI in OpenLiberty configuration? i cannot find any documentation about it.

IdP expects svil.environment while i'm sending https://svil.environment/ibm/saml20/defaultSP so it reject SAML assertion

i'm using the following stuff: OpenLiberty ver. 22.0.0.9

feature: appSecurity-2.0 samlWeb-2.0

Blaster
  • 1

1 Answers1

0

I may be mis-understanding the question.

The issuer is sent from the IdP in the SAML assertion (SAMLResponse) to identify the IdP. So, the Open Liberty SP only needs to trust the issuer within the SAML assertian.

For Open Liberty to trust an issuer, we would set 'trustedIssuers'

<samlWebSso20 id="libertysp"
  ...
  <pkixTrustEngine trustAnchor="serverStore" trustedIssuers="xyz" />
</samlWebSso20>

SAML Web SSO

Helpful SAML Glossary (including issuer definition)

Logan Haas
  • 1
  • 1