SAML Response contains DN | Community
Skip to main content
A
amitabhd6294229
New Member
May 18, 2020
Solved

SAML Response contains DN

  • May 18, 2020
  • 1 reply
  • 6459 views

Hello,

   We have configured the OOTB SAML Auth Handler successfully to use the Forgerock IDP and the authentication and communication between AEM 6.5 and the IDP is working fine. However, the groups are being returned as a DN instead of just the group name. Is this supported by the handler or do we need to create a custom handler to extract just the group name? The user is being placed in the default group so my assumption is that the DN is not supported. The IDP is authenticating the user against an AD, if that matters.

Anyone experience this before and how was it handled?

 

Thank you

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by akhoury

You must configure the IDP to send the value you want.  This isn't handled by AEM.  In the AEM SAML Handler OSGi configuration, you would just set the "Group Membership" property with the name of the SAML attribute containing the list of the user's memberships (containing the group CNs instead of DNs).

 

Based on my findings, I suspect you are using OpenAM IDP from Forgerock, is that correct?  If so, I guess you would need to implement a custom attribute mapper:

https://backstage.forgerock.com/knowledge/kb/article/a67576704

1 reply

akhoury
Adobe Employee
akhouryAdobe EmployeeAccepted solution
Adobe Employee
May 18, 2020

You must configure the IDP to send the value you want.  This isn't handled by AEM.  In the AEM SAML Handler OSGi configuration, you would just set the "Group Membership" property with the name of the SAML attribute containing the list of the user's memberships (containing the group CNs instead of DNs).

 

Based on my findings, I suspect you are using OpenAM IDP from Forgerock, is that correct?  If so, I guess you would need to implement a custom attribute mapper:

https://backstage.forgerock.com/knowledge/kb/article/a67576704

    akhoury
    Adobe Employee
    akhouryAdobe Employee
    Adobe Employee
    May 18, 2020
    AEM's SAML handler doesn't parse out the CN from the DN. However, you can just use the DN in AEM and it doesn't have to be visible to users. You can create the groups in AEM with the DN as the id, for example, "CN=APP-CRM-BUILD-PROFILE-CSR,OU=Resources,OU=_Groups,DC=lan,DC=xxxx,DC=org", then just give the group a friendly name in the group title. Why the need for it to be the CN? DN isn't a bad thing, it avoids naming conflicts.
    Terms & ConditionsAccessibility statement

    Loading footer...