Bug ID 485760: Tag <NameIDFormat> in SAML metadata may contain wrong attributes

Last Modified: Oct 06, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3

Fixed In:
12.0.0, 11.6.0 HF4

Opened: Oct 21, 2014
Severity: 3-Major

Symptoms

When Big-IP is used as SAML IdP, SAML metadata could contain invalid NameIDFormat, e.g.: <NameIDFormat Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" index="0" isDefault="true">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

Impact

Metadata could fail to be imported to external Service Providers.

Conditions

BIG-IP is used as IdP. SAML Artifact Resolution Service is not configured.

Workaround

Manually correct metadata. E.g. replace this: "<NameIDFormat Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" index="0" isDefault="true">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>" with this: "<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>"

Fix Information

Issue where SAML metadata Tag NameIDFormat would contain invalid information under certain conditions is now fixed.

Behavior Change