Content Comparison

Test scenarios and setup for testing SSO

Jira Legacy

server	System Jira
serverId	4f23a7bf-fe0d-390f-9b92-bdff15338913
key	DRYD-1518

using Auth0 as an IdP

...

Configuration Scenario 1

...

Scenario Description

...

Email address used for both username and sso-id, both asserted via attribute in IdP authentication response

...

CSpace User Setup

...

Create a user on CSpace with the email testconfig1@example.com

...

Relevant SAML Config on CSpace Server

...

Code Block

<assertion-username-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-sso-id-probes>

...

Basic Setup Instructions

Go to https://auth0.com/
Click the Sign up button
Create an account
In the sidebar, click Applications/Applications
Click Create Application
- Name: CollectionSpace
- Application type: Regular Web Applications
Click the Settings tab
In Allowed Callback URLs, enter https://{cspace server}/cspace-services/login/saml2/sso/{your name}-auth0 (replace {cspace server} with the server that is going to use this IdP, and {your name} with some version of your name that has no spaces)
Click the Save Changes button
Click the Addons tab
Turn on SAML2 WEB APP
Click the Settings tab in the pop-up that appears
Make note of the Identity Provider Metadata URL
Click the Enable button

Ask hosting to add the following SSO relying party configuration to the CSpace server you referenced in step 7 (replacing the stuff inside curly braces with appropriate values):

Code Block

    <relying-party id="{your name}-auth0">
        <name>{your name}'s Auth0</name>
        <icon location="https://cdn.auth0.com/manhattan/versions/1.5422.0/assets/badge.png" />
        <metadata location="{metadata url from step 12}" />
    </relying-party>

Note that the id above must be the same as the last path element of the URL you entered in step 7.

Wait for the CSpace server to be redeployed and restarted

SAML log in with your IdP should now work. To verify:

Log in to CSpace as an admin user
Create a user in CSpace, and note the username/email
Log out
Log in, selecting Continue with {your name}'s Auth0
The Auth0 log in screen appears. Click to Sign Up link to register a new Auth0 user, using the email from step 2.

You should be logged in as the user you created in step 2.

Useful for further testing:

To log out of the Auth0 account:

In the Auth0 sidebar, click on Applications/Applications
Click on the CollectionSpace application
Note the content of the Domain field
Visit https://{domain}/v2/logout to log out

To change the email of an Auth0 user:

In the Auth0 sidebar, click on User Management/Users
Click on the user to edit
Click on the Actions button, then Change email
Enter the new email
Click the Save button

The test scenarios below specify additional configuration settings for the Auth0 IdP.

Configuration Scenario 1

Scenario Description

Email address used for both username and sso-id, both asserted via attribute in IdP authentication response

CSpace User Setup

Create a user on CSpace with the email testconfig1@example.com

Relevant SAML Config on CSpace Server

Code Block

<assertion-username-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-sso-id-probes>

Relevant Auth0 IDP Metadata excerpt

<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">testconfig1@example.com</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

Expected behavior after changing email address on Auth0 IdP

User is not found and login fails

Configuration Scenario 2

Scenario Description

Email address used for both username and sso-id, with username asserted via attribute and sso-id via name-id in IdP authentication response

Preconditions

Create a user on CSpace with the email testconfig2@example.com

Auth0 Mappings

Code Block
{ "mappings": { "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" } }

Relevant SAML Config on CSpace Server

(Note the use of the name attribute for the username because Auth0 will drop the emailaddress attribute in this configuration since email is being used as the nameidentifier.)

Code Block
<assertion-username-probes> . <attribute name="http://schemas.auth0.com/name" /> </assertion-username-probes> <assertion-sso-id-probes> . <name-id/> </assertion-sso-id-probes>

Relevant Auth0 IDP Metadata excerpt

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testconfig2@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:29:08.526Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

<saml:Attribute Name="http://schemas.auth0.com/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">testconfig2@example.com</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

Expected behavior after changing email address on Auth0 IdP

User is not found and login fails

Configuration Scenario 3

Scenario Description

Email address used for both username and sso-id, with username asserted via name-id and sso-id via attribute in IdP authentication response

Precondition

Create a user on CSpace with the email testconfig3@example.com

Auth0 Mappings

Code Block
{ "mappings": { "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" } }

Relevant SAML Config on CSpace Server

(Note the use of the name attribute for the sso-id because Auth0 will drop the emailaddress attribute in this configuration since email is being used as the nameidentifier.)

Code Block
<assertion-username-probes> . <name-id/> </assertion-username-probes> <assertion-sso-id-probes> . <attribute name="http://schemas.auth0.com/name" /> </assertion-sso-id-probes>

Relevant Auth0 IDP Metadata excerpt

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testconfig3@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:29:08.526Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

<saml:Attribute Name="http://schemas.

xmlsoap

auth0.

org/ws/2005/05/identity/claims/emailaddress

com/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig1@example

`>testconfig3@example.com</saml:AttributeValue> </saml:Attribute>`
Expected behavior upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP	User is not found and login fails

Configuration Scenario

2

4
Scenario Description	Email address used for both `username` and `sso-id`, with

username

both asserted via

attribute and sso-id via

name-id in IdP authentication response

Preconditions

Precondition

Create a user on CSpace with the email

testconfig2@example

testconfig4@example.com

Auth0 Mappings

Code Block
{ "mappings": { "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" } }

Relevant SAML Config on CSpace Server

(Note the use of the name attribute for the username because Auth0 will drop the emailaddress attribute in this configuration since email is being used as the nameidentifier.)

Code Block
<assertion-username-probes>

. <attribute

name="http://schemas

auth0.com/name"

 <name-id/>
</assertion-username-probes>
<assertion-sso-id-probes>

. <name-id/>
</assertion-sso-id-probes>

Relevant

Auth0

IDP Metadata excerpt

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

>testconfig2@example

>testconfig4@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:29:08.526Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

<saml:Attribute Name="http://schemas.auth0.com/name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig2@example

`>testconfig4@example.com</saml:AttributeValue> </saml:Attribute>`
Expected behavior upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP	User is not found and login fails

Configuration Scenario

3

5
Scenario Description	Email address

used for both username and

asserted as username, other id asserted as sso-id

,

with

username asserted via name-id and sso-id via attribute in IdP authentication response

each being asserted in a different attribute
Precondition	Create a user on CSpace with the email

testconfig3@example

testconfig5@example.com

Auth0 Mappings

Code Block


{ "mappings": { "

mappings

user_id":

{

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
    "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

nameidentifier

emailaddress"
  }
}

Relevant

SAML Config on CSpace Server(Note the use of the name attribute for the sso-id because Auth0 will drop the emailaddress attribute in this configuration since email is being used as the nameidentifier.)

SAML Config on CSpace Server

Code Block
<assertion-username-probes> .<attribute name="http://schemas.

<name-id

xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>


. <attribute name="http://schemas.auth0.com/

name

identifier" />
</assertion-sso-id-probes>

Relevant

Auth0

IDP Metadata excerpt

<saml:

Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testconfig3@example.com</saml:NameID> <saml:SubjectConfirmation Method

Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:

cm

attrname-format:

bearer

uri"> <saml:

SubjectConfirmationData NotOnOrAfter="2024-11-05T01:29:08.526Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation>

AttributeValue xsi:type="xs:string">testconfig5@example.com</saml:AttributeValue> </saml:

Subject>

Attribute>

<saml:Attribute Name="http://schemas.auth0.com/

name

identifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig3@example.com<

`>auth0\|6729603aba7c0c3e1bdf28d5</saml:AttributeValue> </saml:Attribute>`
Expected behavior upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP	User is

not

found and login

fails

succeeds (because attribute that is used for sso-id hasn’t changed)

Configuration Scenario

4

6	THIS IS THE MOST LIKELY IDP SETUP
Scenario Description	Email address

used for both username

asserted as username, other id asserted as sso-id with username being asserted an attribute and sso-id

, with both asserted via

in the name-id

in IdP authentication response


Precondition	Create a user on CSpace with the email

testconfig4@example

testconfig6@example.com

Auth0 Mappings

Code Block
{ "mappings": { "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

nameidentifier

emailaddress"
  }
}

Relevant SAML Config on CSpace Server

Code Block
<assertion-username-probes>

. <name-id


.<attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>
. <name-id/>
</assertion-sso-id-probes>

Relevant IDP Metadata

excerpt

excerpts

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

>testconfig4@example.com<

>auth0|6729603aba7c0c3e1bdf28d5</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:

29

50:

08

42.

526Z

934Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

<saml:Attribute Name="http://schemas.

auth0.com/name

xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig4@example

>testconfig6@example.com</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

Expected behavior after changing email address on Auth0 IdP

User is not found and login fails

User is found and login succeeds (because name identifier in the subject that is being used for sso-id hasn’t changed)

Configuration Scenario

5

7
Scenario Description	Email address asserted as `username`, other id asserted as `sso-id` with

each

username being asserted in

a different

the name-id and sso-id in an attribute
Precondition	Create a user on CSpace with the email

testconfig5@example

testconfig7@example.com

Auth0 Mappings

Code Block{ "mappings": { "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",

Code Block
{ "mappings": { "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

emailaddress

nameidentifier"
  }
}

Relevant SAML Config on CSpace Server

(Note the use of the identifier attribute for sso-id )

Code Block
<assertion-username-probes> .

 
. <name-id/> 
</assertion-username-probes> 
<assertion-sso-id-probes>  . 
. <attribute name="http://schemas.auth0.com/identifier" /> 
</assertion-sso-id-probes>

Relevant IDP Metadata

excerpt

excerpts

<saml:

Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat

Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">testconfig7@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:

attrname-format

cm:

uri

bearer"> <saml:

AttributeValue xsi:type="xs:string">testconfig5@example.com</saml:AttributeValue>

SubjectConfirmationData NotOnOrAfter="2024-11-05T02:06:46.509Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:

Attribute>

Subject>

<saml:Attribute Name="http://schemas.auth0.com/identifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">auth0|6729603aba7c0c3e1bdf28d5</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

Expected behavior after changing email address on Auth0 IdP

User is found and login succeeds (because the value for identifier attribute

that is

used for sso-id hasn’t changed)

Configuration Scenario

6THIS IS THE MOST LIKELY IDP SETUP

8	Mimics 8.0 functionality in 8.1
Scenario Description	Email address asserted as `username`,

other id

null value asserted as sso-id , with

username

each being asserted

an attribute and sso-id in the name-id

as a different attribute
Precondition	Create a user on CSpace with the email

testconfig6@example

testconfig8@example.com

Auth0 Mappings

Code Block
{ "mappings": { "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "email":

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" } }

Relevant SAML Config on CSpace Server

Code Block<assertion-username-probes> .<attribute

name=

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

/>

</assertion-username-probes> <assertion-sso-id-probes> . <name-id/> </assertion-sso-id-probes>

Relevant IDP Metadata excerpts

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">auth0|6729603aba7c0c3e1bdf28d5</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:50:42.934Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

}
}

Relevant SAML Config on CSpace Server

Code Block

<assertion-username-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>  . 
. <attribute name="http://schemas.auth0.com/nonexistent" /> 
</assertion-sso-id-probes>

Relevant IDP Metadata excerpts

<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig6@example

`>testconfig8@example.com</saml:AttributeValue> </saml:Attribute>`
Expected behavior upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP	User is found and login

succeeds (because name identifier in the subject that is being used for sso-id hasn’t changed)

fails

Configuration Scenario

7

9	Mimics 8.0 functionality in 8.1
Scenario Description	Email address asserted as `username`,

other id

null value asserted as sso-id , with username being asserted in

the

name-id and sso-id in an attribute
Precondition	Create a user on CSpace with the email

testconfig7@example

testconfig9@example.com

Auth0 Mappings

Code Block
{ "mappings": { "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" } }

Relevant SAML Config on CSpace Server

(Note the use of the identifier attribute for sso-id )

Code Block
<assertion-username-probes>

.

. <name-id/>


</assertion-username-probes>


<assertion-sso-id-probes>  . 
. <attribute name="http://schemas.auth0.com/

identifier

nonexistent" /> 
</assertion-sso-id-probes>

Relevant IDP Metadata excerpts

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

>testconfig7@example

>testconfig9@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T02:06:46.509Z" Recipient="https://manage.auth0.com/tester

/samlp"/> </saml:SubjectConfirmation> </saml:Subject><saml:Attribute Name="http://schemas.auth0.com/identifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">auth0|6729603aba7c0c3e1bdf28d5</saml:AttributeValue>

/samlp"/> </saml:SubjectConfirmation> </saml:

Attribute>

`Subject>`
Expected behavior upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP	User is found and login

succeeds (because the value for identifier attribute used for sso-id hasn’t changed)

fails

Configuration Scenario

8

10	Mimics 8.0 functionality in 8.1 - SUCCESS SEQUENCE
Scenario Description	Email address asserted as `username`, null value asserted as `sso-id` , with

each being asserted as a different attribute

subsequent specification of a valid sso-id to enable subsequent login after email change.
Precondition	Create a user on CSpace with the email

testconfig8@example

testconfig10@example.com

Auth0 Mappings

Code Block
{ "mappings": { "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" } }

Relevant SAML Config on CSpace Server (Step 1)

Code Block

<assertion-username-probes>
. <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>  . 
. <attribute name="http://schemas.auth0.com/nonexistent" /> 
</assertion-sso-id-probes>

Relevant IDP Metadata excerpts (Step 1)

<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">testconfig8@example.com</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

Expected behavior after changing email address on Auth0 IdP

User is found and login fails

Configuration Scenario 9

Mimics 8.0 functionality in 8.1

Scenario Description

Email address asserted as username, null value asserted as sso-id , with username being asserted in name-id and sso-id in an attribute

Precondition

Create a user on CSpace with the email testconfig9@example.com

Auth0 Mappings

Code Block{ "mappings": { "email": "

Relevant SAML Config on CSpace Server (Step 2)

Code Block
<assertion-username-probes> . <attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

nameidentifier" } }

Relevant SAML Config on CSpace Server

Code Block<assertion-username-probes> . <name-id

emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>  . 
.

<attribute name="http://schemas.auth0.com/nonexistent" /

<name-id/> 
</assertion-sso-id-probes>

Relevant IDP Metadata excerpts

<saml:Subject> <saml:NameID Format

Relevant IDP Metadata excerpts (Step 2)

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">auth0|6729603aba7c0c3e1bdf28d5</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML

:1.1:nameid-format:unspecified">testconfig9@example.com</saml:NameID> <saml:SubjectConfirmation Method

:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2024-11-05T01:50:42.934Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:

cm

attrname-format:

bearer

uri"> <saml:

SubjectConfirmationData NotOnOrAfter="2024-11-05T02:06:46.509Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation>

AttributeValue xsi:type="xs:string">testconfig10@example.com</saml:AttributeValue> </saml:

Subject>

Attribute>

Expected behavior

upon initial login

after SAML config change	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP after SAML config change	User is found and login

fails

succeeds

Configuration Scenario

10Mimics 8.0 functionality in 8.1 - SUCCESS SEQUENCE

11
Scenario Description	Using untyped Attributes. Email address asserted as `username`,

null value asserted as sso-id , with subsequent specification of a valid sso-id to enable subsequent login after email change.

other id asserted as `sso-id` with each being asserted in a different attribute
Precondition	Create a user on CSpace with the email

testconfig10@example.com

Auth0 Mappings

Code Block{ "mappings": { "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",

testconfig5@example.com

Auth0 Mappings

Code Block
{ "

email

mappings":

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

}

Relevant SAML Config on CSpace Server (Step 1)

Code Block<assertion-username-probes>

. <attribute name=

 "user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/

emailaddress" /> </assertion-username-probes> <assertion-sso-id-probes> . . <attribute name="http://schemas.auth0.com/nonexistent" /> </assertion-sso-id-probes>

Relevant IDP Metadata excerpts (Step 1)

<saml:Attribute Name=

nameidentifier",
    "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string">testconfig8@example.com</saml:AttributeValue> </saml:Attribute>

Expected behavior upon initial login

User is found and login succeeds

}
}

Auth0 Additional Settings

typedAttributes: false

Relevant SAML Config on CSpace Server

(Step 2)

Code Block
<assertion-username-probes> .

<attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
</assertion-username-probes>
<assertion-sso-id-probes>

. <attribute name="http://schemas.auth0.

<name-id

com/identifier" />


</assertion-sso-id-probes>

Relevant IDP Metadata

excerpts (Step 2)<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">auth0|6729603aba7c0c3e1bdf28d5</saml:NameID> <saml:SubjectConfirmation Method

excerpt

<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:

cm

attrname-format:

bearer

uri"> <saml:

SubjectConfirmationData NotOnOrAfter="2024-11-05T01:50:42.934Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation>

AttributeValue xsi:type="xs:string">testconfig5@example.com</saml:AttributeValue> </saml:

Subject>

Attribute>

<saml:Attribute Name="http://schemas.

xmlsoap

auth0.

org/ws/2005/05/identity/claims/emailaddress

com/identifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xsi:type="xs:string"

>testconfig10@example.com<

>auth0|6729603aba7c0c3e1bdf28d5</saml:AttributeValue> </saml:Attribute>

Expected behavior

after SAML config change

upon initial login	User is found and login succeeds
Expected behavior after changing email address on Auth0 IdP

after SAML config change

User is found and login succeeds (because attribute that is used for sso-id hasn’t changed)

Version	Old Version 4	New Version 5
Changes made by	Bridget Almas	Bridget Almas
Saved on	Nov 05, 2024	Feb 19, 2025

Versions Compared

Key