How to validate Saml token in apigee that is commi...

manchalachiranj · 03-09-2020 04:45 AM

Hi friends,

I dont have idea on validating saml tokens in apigee.can anyone pls provide steps and guide me how to validate the token that is coming in request header.

Thanks for the help.

dchiesa1

Did you try the documentation?

Did you find the ValidateSAMLAssertion policy?

Did you try it?

How did you configure it? (Show your policy configuration)

What results did you see?

manchalachiranj

Actually in the Validate saml policy I am not getting how to read the token in request header.

Should i use below line for reading the token from authorization header.

<source> request.Authorization</source>

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <ValidateSAMLAssertion ignoreContentType="false" name="Validate-SAML-Assertion-1"> <DisplayName>Validate SAML Assertion-1</DisplayName> <source> request.Authorization</source><Description/> <TrustStore/> <RemoveAssertion>false</RemoveAssertion> </ValidateSAMLAssertion>

dchiesa1

No.

request.header.Authorization

See the documentation on context variables for more information.

https://docs.apigee.com/api-platform/reference/variables-reference

manchalachiranj

Hi @Dino-at-Google

I have given the source filed with the value as request.header.Authorization but when saving the configuration or deploying the proxy it is throwing an error saying Source is not configured correctly.

I have tried below all ways but it is throwing an error:

<source>request.header.Authorization</source>

<source>request</source>

Please find below the policy configuration:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<DisplayName>Validate SAML Assertion-1</DisplayName>

<source>request.header.Authorization</source><Description/> <TrustStore>samlValidation</TrustStore> <RemoveAssertion>false</RemoveAssertion>

</ValidateSAMLAssertion>

Please correct me if anything wrong in the configurations.

Also pls provide the ValidateSAMLAssertion policy configuration for validating the incoming saml token in authorization header.

How to validate Saml token in apigee that is comming in the header