diff --git a/docbook/reference/en/en-US/modules/saml.xml b/docbook/reference/en/en-US/modules/saml.xml
index 1de1dc6d7b..912fc63b14 100755
--- a/docbook/reference/en/en-US/modules/saml.xml
+++ b/docbook/reference/en/en-US/modules/saml.xml
@@ -96,12 +96,78 @@
+
+ Force Name ID Format
+
+
+ If the request has a name ID policy, ignore it and used the value configured in the admin console
+ under Name ID Format
+
+
+
+
+ Name ID Format
+
+
+ Name ID Format for the subject. If no name ID policy is specified in the request or if the
+ Force Name ID Format attribute is true, this value is used.
+
+
+
+
+ Master SAML Processing URL
+
+
+ This URL will be used for all SAML requests and responsed directed to the SP. It will be used
+ as the Assertion Consumer Service URL and the Single Logout Service URL. If a login request
+ contains the Assertion Consumer Service URL, that will take precedence, but this URL must be valided
+ by a registered Valid Redirect URI pattern
+
+
+
+
+ Assertion Consumer Service POST Binding URL
+
+
+ POST Binding URL for the Assertion Consumer Service.
+
+
+
+
+ Assertion Consumer Service Redirect Binding URL
+
+
+ Redirect Binding URL for the Assertion Consumer Service.
+
+
+
+
+ Logout Service POST Binding URL
+
+
+ POST Binding URL for the Logout Service.
+
+
+
+
+ Logout Service Redirect Binding URL
+
+
+ Redirect Binding URL for the Logout Service.
+
+
+
- You have to specify an admin URL if you want logout to work. This should be a URL that will except single logout
- requests from the Keycloak server. You should also specify a default redirect url. Keycloak will redirect to this
- url after single logout is complete.
+ For login to work, Keycloak needs to be able to resolve the URL for the Assertion Consumer Service of the SP. If
+ you are relying on the SP to provide this URL in the login request, then you must register valid redirect uri patterns
+ so that this URL can be validated. You can set the Master SAML Processing URL as well, or alternatively, you can
+ specify the Assertion Consumer Service URL per binding.
+
+
+ For logout to work, you must specify a Master SAML Processing URL, or the Loging Service URL for the binding
+ you want Keycloak to use.
One thing to note is that roles are not treated as a hierarchy. So, any role mappings will just be added
diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
index 8e9adf50a0..617d5abbd1 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
@@ -553,6 +553,12 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
"RSA_SHA512",
"DSA_SHA1"
];
+ $scope.nameIdFormats = [
+ "username",
+ "email",
+ "transient",
+ "persistent"
+ ];
$scope.realm = realm;
$scope.create = !application.name;
@@ -563,6 +569,7 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.samlClientSignature = false;
$scope.samlEncrypt = false;
$scope.samlForcePostBinding = false;
+ $scope.samlForceNameIdFormat = false;
if (!$scope.create) {
if (!application.attributes) {
application.attributes = {};
@@ -588,13 +595,25 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
} else if (application.attributes['saml.signature.algorithm'] == 'DSA_SHA1') {
$scope.signatureAlgorithm = $scope.signatureAlgorithms[3];
}
+ if (application.attributes['saml_name_id_format'] == 'unspecified') {
+ $scope.nameIdFormat = $scope.nameIdFormats[0];
+ } else if (application.attributes['saml_name_id_format'] == 'email') {
+ $scope.nameIdFormat = $scope.nameIdFormats[1];
+ } else if (application.attributes['saml_name_id_format'] == 'transient') {
+ $scope.nameIdFormat = $scope.nameIdFormats[2];
+ } else if (application.attributes['saml_name_id_format'] == 'persistent') {
+ $scope.nameIdFormat = $scope.nameIdFormats[3];
+ }
+
} else {
$scope.application = { enabled: true, attributes: {}};
$scope.application.redirectUris = [];
$scope.accessType = $scope.accessTypes[0];
$scope.protocol = $scope.protocols[0];
$scope.signatureAlgorithm = $scope.signatureAlgorithms[1];
+ $scope.nameIdFormat = $scope.nameIdFormats[0];
$scope.samlAuthnStatement = true;
+ $scope.samlForceNameIdFormat = false;
}
if ($scope.application.attributes["saml.server.signature"]) {
@@ -633,6 +652,13 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.samlAuthnStatement = false;
}
}
+ if ($scope.application.attributes["saml_force_name_id_format"]) {
+ if ($scope.application.attributes["saml_force_name_id_format"] == "true") {
+ $scope.samlForceNameIdFormat = true;
+ } else {
+ $scope.samlForceNameIdFormat = false;
+ }
+ }
if ($scope.application.attributes["saml.multivalued.roles"]) {
if ($scope.application.attributes["saml.multivalued.roles"] == "true") {
$scope.samlMultiValuedRoles = true;
@@ -677,6 +703,10 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.application.attributes['saml.signature.algorithm'] = $scope.signatureAlgorithm;
};
+ $scope.changeNameIdFormat = function() {
+ $scope.application.attributes['saml_name_id_format'] = $scope.nameIdFormat;
+ };
+
$scope.$watch(function() {
return $location.path();
}, function() {
@@ -733,6 +763,12 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
} else {
$scope.application.attributes["saml.authnstatement"] = "false";
+ }
+ if ($scope.samlForceNameIdFormat == true) {
+ $scope.application.attributes["saml_force_name_id_format"] = "true";
+ } else {
+ $scope.application.attributes["saml_force_name_id_format"] = "false";
+
}
if ($scope.samlMultiValuedRoles == true) {
$scope.application.attributes["saml.multivalued.roles"] = "true";
@@ -749,6 +785,7 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.application.protocol = $scope.protocol;
$scope.application.attributes['saml.signature.algorithm'] = $scope.signatureAlgorithm;
+ $scope.application.attributes['saml_name_id_format'] = $scope.nameIdFormat;
if ($scope.application.protocol != 'saml' && !$scope.application.bearerOnly && (!$scope.application.redirectUris || $scope.application.redirectUris.length == 0)) {
Notifications.error("You must specify at least one redirect uri");
diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
index 2271ef74b7..1ce6d80c64 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
@@ -56,20 +56,6 @@
-