IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SubjectConfirmationMethod

    Posted 06/04/18 05:17 AM
    Hi,

    I'm setting up a new sts chain (9.0.4) which are used for enabling "",
    for some reason i'm missing the SubjectConfirmationMethod in the saml. 

    If i check the chain configuration (https://{appliance_hostname}/iam/access/v8/sts/chains/{sts_chain_instance_id}) i'm missing this one. Does anyone now how to set this one?

    {
    "name" : "uuidf3b951e6-34db-406c-b58d-7d07d4a35217.com.tivoli.am.fim.sts.saml.2.0.assertion.SubjectConfirmationMethod",
    "value" : [
    "urn:oasis:names:tc:SAML:2.0:cm:bearer"
    ]
    }

    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.4/com.ibm.isam.doc/config/reference/ModuleSAML2properties.html
    Ibm remove preview
    View this on Ibm >
    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.4/com.ibm.isam.doc/config/reference/ModuleSAML2properties.html





    ------------------------------
    Regards Mikael
    ------------------------------


  • 2.  RE: SubjectConfirmationMethod

    Posted 06/21/18 10:42 PM
    Hi Mikael,

    I have tried with latest ISAM on configuring SAML2 STS chain, there seems to have a condition to be able to set 'SubjectConfirmationMethod' field for SAML2 issue chain: at least one of the 3 types of encryption is selected, i.e. 'Encrypt assertions',  'Encrypt assertion attribute elements', 'Encrypt nameid element'; otherwise the 'SubjectConfirmationMethod' will be ignored.

    This condition exists to set 'SubjectConfirmationMethod' is a defect, user should be able to configure 'SubjectConfirmationMethod' without the need to encrypt anything. We'll try to fix this in the next release.

    ------------------------------
    Yongming Chen
    ------------------------------



Related Content