diff --git a/docs/simplesamlphp-changelog.md b/docs/simplesamlphp-changelog.md index de68e28078909049770e37cdea40f44a17252869..c29ee86400a604f3cbbba3812f64e9fe41dc99a7 100644 --- a/docs/simplesamlphp-changelog.md +++ b/docs/simplesamlphp-changelog.md @@ -316,6 +316,9 @@ Released 2017-11-20 refuse to parse an assertion with an eduPersonTargetedID in 'string' format. * Receiving an eduPersonTargetedID in string form will no longer break parsing of the assertion. + * Can disable the Scoping element in SP and remote IdP configuration with the + `disable_scoping` option, for compatibility with ADFS which does not accept + the element. ### `smartattributes` * Fix SmartName authproc that failed to load. diff --git a/modules/saml/docs/sp.md b/modules/saml/docs/sp.md index 9ee03c584d827514ec4b4c0014a8ba8c0b9bf5f9..96f8fd510a4506773ab78184f1e19d443c33227c 100644 --- a/modules/saml/docs/sp.md +++ b/modules/saml/docs/sp.md @@ -196,6 +196,15 @@ Options : *Note*: For this to be added to the metadata, you must also specify the `attributes` and `name` options. +`disable_scoping` +: Whether sending of samlp:Scoping elements in authentication requests should be suppressed. The default value is `FALSE`. + When set to `TRUE`, no scoping elements will be sent. This does not comply with the SAML2 specification, but allows + interoperability with ADFS which [does not support Scoping elements](https://docs.microsoft.com/en-za/azure/active-directory/develop/active-directory-single-sign-on-protocol-reference#scoping). + +: Note that this option also exists in the IdP remote configuration. An + entry in the the IdP-remote metadata overrides this the option in the + SP configuration. + `discoURL` : Set which IdP discovery service this SP should use. If this is unset, the IdP discovery service specified in the global option `idpdisco.url.{saml20|shib13}` in `config/config.php` will be used.