Jiandong Guo

Handling Claims with Metro STS

In WS-SecurityPolicy, an IssuedToken policy assertion may carry an optional wst:Claims element,
to specify the actual claims required to access the service. Here is an example of IssuedToken policy assertions with Claims:

    <sp:IssuedToken sp:IncludeToken="...">

        <Issuer xmlns="...">

            <Address xmlns="http://www.w3.org/2005/08/addressing">...</Address>

        </Issuer>

        <sp:RequestSecurityTokenTemplate

                xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">

            <t:TokenType>urn:oasis:names:tc:SAML:2.0:assertion</t:TokenType>

            <t:KeyType>http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey</t:KeyType>

            <t:KeySize>256</t:KeySize>

            <t:Claims Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity" 

                      xmlns:ic="http://schemas.xmlsoap.org/ws/2005/05/identity">

                  <ic:ClaimType Uri="http://.../ws/2005/05/identity/claims/givenname"/>

                  <ic:ClaimType Uri="http://.../ws/2005/05/identity/claims/surname" Optional="true" />

            </wst:Claims>

        </sp:RequestSecurityTokenTemplate>

    </sp:IssuedToken>

On the client side, the Claims, together with all the other elements in the RequestSecurityTokenTemplate,
is copied into the request message RST to the STS.

With Metro based STS, the Claims will then be available in the STSAttributeProvider, for use to build
the user attributes to be included in the issued SAML assertion.

In your implementation of the method,
getClaimedAttributes(Subject subject, String appliesTo, String tokenType, Claims claims),
one may parse the Claims to obtain the ClaimTypes with the following codes:

    String dialect = cliams.getDialect();

    List