I've recently done some work migrating my STS implementation from using CXF 
2.7.14 up to 3.1.4. In testing the upleveled STS, I noticed that a change crept 
in somewhere along the way when requesting a bearer token - in CXF 3, the 
returned token has an additional AttributeStatement:

<saml2:AttributeStatement>
                <saml2:Attribute Name="token-requestor" 
NameFormat="http://cxf.apache.org/sts";>
                                <saml2:AttributeValue 
xsi:type="xsd:string">authenticated</saml2:AttributeValue>
                </saml2:Attribute>
</saml2:AttributeStatement>

I don't think this is a problem for me necessarily, but it was unexpected. Is 
there a way to suppress the inclusion of this attribute in the token? Or, some 
rationale for why I maybe shouldn't?

Thanx,

Stephen W. Chappell

Reply via email to