WSO2 external IdP registration: manage several AttributeConsumingService - wso2

Question

I'm using WSO2 Identity Server version 5.8.0 and 5.9.0
I'm facing this problem: I have external IdPs and I want to allow SAML integration with these IdPs. I can register them in WSO2 and all works pretty good.
The isssue is related to the AttributeConsumingService In the external IdP I registered this WSO2 ServiceMetadata:
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_3574ad74-ba7a-4ea5-b3e8-dbb2dafb55df" entityID="http://wso2_590_ai">
<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate><!--Certificate info--></ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:9443/samlsso" />
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:9443/commonauth" index="0" isDefault="true" />
<md:AttributeConsumingService index="0">
<md:ServiceName xml:lang="it">set0</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field A" Name="fielda" />
<md:RequestedAttribute FriendlyName="Field B" Name="fieldb" />
</md:AttributeConsumingService>
<md:AttributeConsumingService index="1">
<md:ServiceName xml:lang="it">set1</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field A" Name="fielda" />
<md:RequestedAttribute FriendlyName="Field B" Name="fieldb" />
<md:RequestedAttribute FriendlyName="Field C" Name="fieldc" />
<md:RequestedAttribute FriendlyName="Field D" Name="fieldd" />
</md:AttributeConsumingService>
<md:AttributeConsumingService index="2">
<md:ServiceName xml:lang="it">set2</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field A" Name="fielda" />
<md:RequestedAttribute FriendlyName="Field C" Name="fieldc" />
</md:AttributeConsumingService>
<md:AttributeConsumingService index="3">
<md:ServiceName xml:lang="it">set3</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field A" Name="fielda" />
<md:RequestedAttribute FriendlyName="Field D" Name="fieldd" />
</md:AttributeConsumingService>
<md:AttributeConsumingService index="4">
<md:ServiceName xml:lang="it">set4</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field B" Name="fieldb" />
<md:RequestedAttribute FriendlyName="Field D" Name="fieldd" />
</md:AttributeConsumingService>
<md:AttributeConsumingService index="5">
<md:ServiceName xml:lang="it">set5</md:ServiceName>
<md:RequestedAttribute FriendlyName="Field B" Name="fieldb" />
<md:RequestedAttribute FriendlyName="Field C" Name="fieldc" />
</md:AttributeConsumingService>
</md:SPSSODescriptor>
<md:Organization>
<md:OrganizationName xml:lang="it">Service provider WSO2 590</md:OrganizationName>
<md:OrganizationDisplayName xml:lang="it">WSO2 590</md:OrganizationDisplayName>
<md:OrganizationURL xml:lang="it">https://localhost:9443/</md:OrganizationURL>
</md:Organization>
</md:EntityDescriptor>
As you can see in my metadata I can handle several AttributeConsumingService. How can I tell WSO2 that a ServiceProvider wants to use the AttributeConsumingService number 1, another the AttributeConsumingService number 2 and so on?
The only point where I can set AttributeConsumingService is during the external IdP registration but it is little bit weierd because I should register several time the same IdP with related entityId issues....
Thank you
Angelo

Answer 1

I think I was able in solving this.
I modified the org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.buildAuthnRequest(HttpServletRequest, boolean, String, AuthenticationContext) method. Just after the instruction
//Get the inbound SAMLRequest
AuthnRequest inboundAuthnRequest = getAuthnRequest(context);
I added the following piece of code:
Integer attrConsServiceIndex = inboundAuthnRequest.getAttributeConsumingServiceIndex();
if( attrConsServiceIndex != null && attrConsServiceIndex > 0 ) {
if( log.isInfoEnabled() ) {
log.info("Inbound SAML Request AttributeConsumingServiceIndex "+ attrConsServiceIndex+" Settato nella auth request SAML");
}
authRequest.setAttributeConsumingServiceIndex(attrConsServiceIndex);
}
In this way if the Application handled by a Service Provider sends an AttributeConsumingServiceIndex different from 0, this is set in the AuthnRequest that WSO2 IS builds for the external IdP.
I don't know if there is a different way to solve it but as far as I investigated this is the only solution I found
I hope this is useful
Angelo