[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/authn/general-authn-config.xml conf/authn...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Jun 10 14:44:04 2014
New Revision: 6074

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6074&view=rev
Log:
Refactor authn config.

Added:
    trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml
      - copied, changed from r6073, trunk/idp-conf/src/main/resources/conf/authn/general-authn-config.xml
    trunk/idp-conf/src/main/resources/system/conf/general-authn-system.xml   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/authn/general-authn-config.xml
    trunk/idp-conf/src/main/resources/conf/global.xml
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml

Copied: trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml (from r6073, trunk/idp-conf/src/main/resources/conf/authn/general-authn-config.xml)
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml?p2=trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml&p1=trunk/idp-conf/src/main/resources/conf/authn/general-authn-config.xml&r1=6073&r2=6074&rev=6074&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/authn/general-authn-config.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/authn/general-authn.xml Tue Jun 10 14:44:04 2014
@@ -19,119 +19,42 @@
     
     You can turn on and off individual mechanisms by adding and remove them here. Nothing left out will
     be used, regardless any other files loaded by the Spring container.
+    
+    Flow defaults include: no support for IsPassive/ForceAuthn, support for non-browser clients enabled,
+    and default timeout and lifetime values set via properties. We also default to supporting the SAML 1/2
+    expressions for password-based authentication over a secure channel, so anything more exotic requires
+    customization, as the example below for IP address authentication illustrates.
     -->
 
-    <!-- First we define a parent bean to default some of the boilerplate. -->
-    <bean id="shibboleth.AbstractAuthenticationFlowBean" abstract="true"
-            class="net.shibboleth.idp.authn.AuthenticationFlowDescriptor"
-            p:resultSerializer-ref="shibboleth.DefaultAuthenticationResultSerializer"
-            p:passiveAuthenticationSupported="false"
-            p:forcedAuthenticationSupported="false"
-            p:nonBrowserSupported="true"
-            p:lifetime="${idp.authn.defaultLifetime}" p:inactivityTimeout="${idp.authn.defaultTimeout}">
-        <property name="supportedPrincipals">
-            <list>
-                <bean class="net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal"
-                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
-                <bean class="net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal"
-                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
-                <bean class="net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal"
-                    c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
-            </list>
-        </property>
-    </bean>
-
-
-    <!-- Now the actual list. -->
     <util:list id="shibboleth.AvailableAuthenticationFlows">
         
-        <bean id="authn/IPAddress" parent="shibboleth.AbstractAuthenticationFlowBean"
+        <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"
                 p:passiveAuthenticationSupported="true"
                 p:lifetime="PT60S" p:inactivityTimeout="PT60S">
             <property name="supportedPrincipals">
-                <list>
-                    <bean class="net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal"
+                <util:list>
+                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
-                </list>
+                </util:list>
             </property>
         </bean>
         
-        <bean id="authn/RemoteUserInternal" parent="shibboleth.AbstractAuthenticationFlowBean" />
+        <bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" />
 
-        <bean id="authn/RemoteUser" parent="shibboleth.AbstractAuthenticationFlowBean"
+        <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
             p:nonBrowserSupported="false" />
 
-        <bean id="authn/External" parent="shibboleth.AbstractAuthenticationFlowBean"
+        <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
             p:nonBrowserSupported="false" />
 
-        <bean id="authn/JAAS" parent="shibboleth.AbstractAuthenticationFlowBean"
+        <bean id="authn/JAAS" parent="shibboleth.AuthenticationFlow"
                 p:passiveAuthenticationSupported="true"
                 p:forcedAuthenticationSupported="true" />
 
-        <bean id="authn/LDAP" parent="shibboleth.AbstractAuthenticationFlowBean"

[... 101 lines stripped ...]