All,

I have a situation where I need to stop/break the SAML SSO (SP init) based on some condition.. I use below code snippet on mapping rule, to do that. It errors on mapping rule as expected, but still SAML flow continues and a invalid SAML response is sent to SP. I want to stop the flow and stay on IdP side.. Is this possible.

if(condition){

    Continue and Do something

}else{
    stsuu.clearAttributeList();
    IDMappingExtUtils.throwSTSException("Condition check Is not performed, Breaking the SSO. Please try again.");
}

If I use above code snippet, I see this on trace log..

[2/27/23 12:37:28:471 CST] 000014cf id=00000000 com.tivoli.am.fim.saml.types.ValidationFailureType           E logError FBTSML225E Token exchange failed.

It errors as expected but it resumes the SAML flow. I want to stop and go to the error page on IdP. It would be appreciable for a response, if anyone has gone through this usecase.

Thanks, Chandra.

Hello Chandra,

Have you doing this in the access policy as opposed to the mapping rule?

https://www.ibm.com/docs/en/sva/10.0.5?topic=settings-access-policies

Hi Chandra,

As Jack mentioned, you would need to invoke a Deny decision in the Access Policy based on certain condition, else Allow. I have attached a sample here. I hope this helps.

importClass(Packages.com.ibm.security.access.policy.decision.Decision);
importClass(Packages.com.ibm.security.access.policy.decision.HtmlPageDenyDecisionHandler);
importClass(Packages.com.ibm.security.access.policy.decision.RedirectDenyDecisionHandler);
importClass(Packages.com.ibm.security.access.policy.decision.HtmlPageChallengeDecisionHandler);
importClass(Packages.com.ibm.security.access.policy.decision.RedirectChallengeDecisionHandler);
importPackage(Packages.com.tivoli.am.fim.trustserver.sts.utilities); 


//Retrieve user context.
var user = context.getUser();
//Retrieve username from the user context.
var username = user.getUsername();
if(username == "testuser"){
	var decision = Decision.allow();
	context.setDecision(decision);
}
else{
	/*
		//If username is not testuser, the single sign on flow is aborted, in this case we use HTMLPageDenyDecision, there is also RedirectDenyDecision.
	
		//For HtmlPageDenyDecisionHandler there are a few API's available to use the default OOTB HTML Deny page, which is located at /access_policy/deny_decision.html or a custom page can be displayed using setPageId().

		var handler = new HtmlPageDenyDecisionHandler();
		handler.setPageId("/access_policy/custom_deny_decision.html");
		handler.setMacro("@MESSAGE@","This is a custom deny page");

		//Make sure that the following page exists /access_policy/custom_deny_decision.html, a macro can be set to so that it can be retrieved from the template page.

		//In the above example a @MESSAGE@ macro is set, this can be retrieved in the /access_policy/custom_deny_decision.html page using the following code snippet.

		<%var message = templateContext.macros["@MESSAGE"]%>
		//Use <%=message%> to print the retrieved macro in the page

	*/
	var handler = new HtmlPageDenyDecisionHandler();
	handler.setMacro("@MESSAGE@","User "+username+" is not allowed to perform a Single Sign On");
	context.setDecision(Decision.deny(handler));
}