I am trying to provide compatibility between an existing SAML token system with JWT token schema. The current system generates SAML tokens with a structure as follows:

Is it even valid to have more than one in a SAML token and if yes what would be the JWT representation for the below

<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response ID="aed9fa15c020fde" InResponseTo="acd3a67cb14a1d94" IssueInstant="2015-02-18T18:58:14.262Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">......</saml:Issuer>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  <saml:Assertion ID="5d41027a4e2c2855" IssueInstant="2015-02-18T18:58:14.262Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">......</saml:Issuer>
      <saml:NameID NameQualifier="USER" SPProvidedID="1047259662">ab_idl1</saml:NameID>
    <saml:Conditions NotBefore="2015-02-18T18:48:14.262Z" NotOnOrAfter="2015-06-20T18:58:14.262Z"/>
  <saml:Assertion ID="5ea9fbba7ab940c0" IssueInstant="2015-02-18T18:58:14.262Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml:NameID NameQualifier="USER" SPProvidedID="1047259662">user_name_app_name</saml:NameID>
    <saml:Conditions NotBefore="2015-02-18T18:48:14.262Z" NotOnOrAfter="2015-06-20T18:58:14.262Z"/>
      <saml:Attribute FriendlyName="user_id1" Name="user_id">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">user_name_app_name</saml:AttributeValue>
| improve this question | | | | |
  • I don't think JWTs have a notion of multiple assertions in the current spec. – Steve Feb 19 '15 at 19:37
  • Any suggestions for creating a structure. I own both the generation and validation parts of the token, however would like to align to a standard as much as possible. – Senthilkumar Gopal Feb 19 '15 at 20:34

According to section of the spec, it's legitimate to have multiple assertions in a response.

| improve this answer | | | | |
  • Thanks for the reference. Could you please tell me what would be the JWT representation for the same structure with multiple assertions – Senthilkumar Gopal Feb 19 '15 at 17:45
  • I would if I could - it's beyond my skillset. – Andrew K. Feb 20 '15 at 12:57
  • :) Thanks Andy. We are planning to use private claim names for the second assertion as part of the JWT. – Senthilkumar Gopal Feb 20 '15 at 17:30
  • You COULD pass a JWT as an attribute in the response - there's certainly nothing saying you can't... But I'm not sure that gets you where you need to go - ultimately, I'm not sure that I understand your use case. – Andrew K. Feb 20 '15 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.