v26.4.16

v26.4.16

Restrict which SAML fields can supply the subject

You can now list which sources Ory Polis may use as the subject (sub) of a SAML login: a named attribute, the NameID (optionally limited to a format such as persistent), or a hash of the email. Set SAML_SUBJECT_SOURCES for the deployment or subjectSources on a connection. A login whose assertion carries none of the listed sources fails instead of falling back to another identifier.

The setting limits where the subject comes from. It does not make a source unique. If you list a source that your identity provider sends with the same value for every user, such as nameid when the NameID is shared, those users still get one subject. List only sources that are unique for each user.

Without the setting, the subject is resolved as before. Changing the sources of an existing connection can change the subject of existing users. A user whose subject came from a source you removed can no longer log in when the assertion carries no other listed source, and gets a different subject when it does.