Federation Security Services Guide › Identify Consumers at a SAML 1.x Producer › Configure Attributes to Include in SAML 1.x Assertions (Optional)

Configure Attributes to Include in SAML 1.x Assertions (Optional)

Attributes can be included in assertions for use by servlets, web, or custom applications to display customized content for a user or enable other custom features. User attributes, DN attributes, or static data can all be passed from the producer to the consumer in an assertion. When used with web applications, attributes can offer fine-grained access control by limiting what a user can do at the consumer. For example, you can send an attribute named Authorized Amount and set it to a maximum dollar amount that the user can spend at the consumer.

Attributes take the form of name/value pairs and include information, such as the user's mail address or business title, or an approved spending limit for transactions at the consumer. When the consumer receives the assertion, it takes the attributes and makes them available to applications as HTTP header variables or HTTP cookie variables.

To pass the attributes, configure a response. The responses available for this purpose are:

• Affiliate-HTTP-Header-Variable
• Affiliate-HTTP-Cookie-Variable

The HTTP headers and HTTP cookies have size restrictions that assertion attributes cannot exceed. The size restrictions are as follows:

• For HTTP headers, Federation Security Services can send an attribute in a header up to the web server size limit for a header. Only one assertion attribute per header is allowed. See the documentation for your web server to determine the header size limit.
• For HTTP cookies, Federation Security Services can send a cookie up to the size limit for a cookie. Each assertion attribute is sent as its own cookie. The cookie size limit is browser-specific, and that limit is for all attributes being passed to the application, not for each attribute. See the documentation for your web browser to determine the cookie size limit.

Configure attributes in the Attributes tab of the Affiliates dialog.