[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties conf/subject-config.xml co...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Feb 26 14:53:10 2014
New Revision: 5482

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5482&view=rev
Log:
Improve c14n config layout, splitting into authn and saml flow sets.

Added:
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-authn-beans.xml
      - copied, changed from r5481, trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-authn-flow.xml
      - copied, changed from r5481, trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-beans.xml   (with props)
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-flow.xml   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/conf/subject-config.xml
    trunk/idp-conf/src/main/resources/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-flow.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=5482&r1=5481&r2=5482&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Wed Feb 26 14:53:10 2014
@@ -74,7 +74,7 @@
 idp.authn.ldap.subtreeSearch = false
 idp.authn.ldap.userFilter = (uid={user})
 
-# Regular expression expressing subject c14n flows to enable
+# Regular expression expressing post-login subject c14n flows to enable
 idp.c14n.flows = Simple
 
 # Reload "failfast" (stop the IdP if a configuration is bad)

Modified: trunk/idp-conf/src/main/resources/conf/subject-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/subject-config.xml?rev=5482&r1=5481&r2=5482&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/subject-config.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/subject-config.xml Wed Feb 26 14:53:10 2014
@@ -19,84 +19,69 @@
     -->
 
     <!--
-    This is a list of Subject Canonicalization flows that turn arbitrary Subject data into a string-based
+    These are lists of Subject Canonicalization flows that turn arbitrary Subject data into a string-based
     principal name that the rest of the IdP can operate on. They're used both after authentication and
     during operations like SAML attribute queries, to map the SAML Subject name into a principal name. 
     
     Flows are described with an ID that corresponds to a Spring Web Flow subflow name, and an optional
     activation function that tells the IdP whether the flow can be run or not on a particular Subject
     for a particular profile request. The default functions do simple checking for compatible syntax
-    and data to operate on, to avoid wasted effort. 
+    and data to operate on, to avoid wasted effort.
     -->
-    <util:list id="shibboleth.AvailableSubjectCanonicalizationFlows">
-        
+
+    <!-- Flows used after authentication to produce canonical principal name. -->
+    <util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows">
+        <!--
+        This is the standard post-login step that returns a username derived from the login process. If you
+        have more complex needs such as mapping a certificate DN into a principal name, an alternative may
+        be required.
+        -->
         <bean id="SubjectC14NFlow/Simple" class="net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor">
             <property name="activationCondition">
                 <bean class="net.shibboleth.idp.authn.impl.SimpleSubjectCanonicalization.ActivationCondition" />
             </property>
         </bean>
+    </util:list>
+    
+    <!-- Flows used during SAML queries and related cases to reverse SAML NameIdentifier/NameIDs. -->
+
+    <bean id="shibboleth.AbstractSAML1C14NFlowBean" abstract="true"
+            class="net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor">
+        <property name="activationCondition">
+            <bean class="net.shibboleth.idp.saml.impl.nameid.NameIdentifierCanonicalization.ActivationCondition" />
+        </property>
+    </bean>
+
+    <bean id="shibboleth.AbstractSAML2C14NFlowBean" abstract="true"
+            class="net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor">
+        <property name="activationCondition">
+            <bean class="net.shibboleth.idp.saml.impl.nameid.NameIDCanonicalization.ActivationCondition" />
+        </property>
+    </bean>
+    
+    <util:list id="shibboleth.SAMLSubjectCanonicalizationFlows">
         
-       

[... 149 lines stripped ...]