[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties conf/subject-config.xml co...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Mar 27 15:39:47 2014
New Revision: 5654

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5654&view=rev
Log:
Provisional support for persistentID handling.

Added:
    trunk/idp-conf/src/main/resources/system/flows/c14n/saml2-persistent-subject-c14n-beans.xml   (with props)
    trunk/idp-conf/src/main/resources/system/flows/c14n/saml2-persistent-subject-c14n-flow.xml   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/conf/subject-config.xml
    trunk/idp-conf/src/main/resources/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/conf/subject-config-system.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=5654&r1=5653&r2=5654&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Thu Mar 27 15:39:47 2014
@@ -37,6 +37,13 @@
 
 # Set to shibboleth.StoredTransientIdGenerator for server-side storage
 idp.transientId.generator = shibboleth.CryptoTransientIdGenerator
+
+# Set to shibboleth.StoredPersistentIdGenerator for server-side storage
+idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator
+idp.persistentId.sourceAttribute = changethistosomethingreal
+idp.persistentId.salt = changethistosomethingrandom
+idp.persistentId.algorithm = SHA
+idp.persistentId.store = PersistentIdStore
 
 # Size of session IDs
 idp.session.idSize = 32

Modified: trunk/idp-conf/src/main/resources/conf/subject-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/subject-config.xml?rev=5654&r1=5653&r2=5654&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/subject-config.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/subject-config.xml Thu Mar 27 15:39:47 2014
@@ -21,7 +21,44 @@
     <!-- ========================= SAML NameID Generation ========================= -->
 
     <!--
-    These beans enable legacy support for NameID generation in the Attribute Resolver.
+    These generator lists handle NameID/Nameidentifier generation going forward. By default,
+    transient IDs for both SAML versions are enabled. The other examples are for persistent IDs
+    and generating more one-off formats based on resolved attributes. A suggested approach is to
+    control their use via release of the underlying source attribute in the filter policy rather
+    than here, but you can set a property on any generator called "activationCondition" to limit
+    use. 
+    -->
+    
+    <!-- SAML 2 NameID Generation -->
+    <util:list id="shibboleth.SAML2NameIDGenerators">
+    
+        <bean id="transient" class="net.shibboleth.idp.saml.impl.nameid.TransientSAML2NameIDGenerator"
+            p:transientIdGenerator-ref="${idp.transientId.generator}" />
+            
+        <bean id="persistent" class="net.shibboleth.idp.saml.impl.nameid.PersistentSAML2NameIDGenerator"
+            p:attributeSourceIds="#{ {'${idp.persistentId.sourceAttribute}'} }"
+            p:persistentIdGenerator-ref="${idp.persistentId.generator}" />
+
+        <bean id="email" class="net.shibboleth.idp.saml.impl.nameid.AttributeSourcedSAML2NameIDGenerator"
+            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+            p:attributeSourceIds="#{ {'email'} }" />
+                
+    </util:list>
+
+    <!-- SAML 1 NameIdentifier Generation -->
+    <util:list id="shibboleth.SAML1NameIdentifierGenerators">
+    
+        <bean id="transient" class="net.shibboleth.idp.saml.impl.nameid.TransientSAML1NameIdentifierGenerator"
+            p:transientIdGenerator-ref="${idp.transientId.generator}" />
+
+        <bean id="email" class="net.shibboleth.idp.saml.impl.nameid.AttributeSourcedSAML1NameIdentifierGenerator"
+            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+            p:attributeSourceIds="#{ {'email'} }" />
+                
+    </util:list>
+    
+    <!--
+    These two beans enable legacy support for NameID generation in the Attribute Resolver.
     If you don't need that (or this is a new install) you can remove them.
     -->
     <bean id="shibboleth.LegacySAML1NameIdentifierGenerator"
@@ -29,33 +66,6 @@
     <bean id="shibboleth.LegacySAML2NameIDGenerator"
         class="net.shibboleth.idp.saml.impl.nameid.LegacySAML2NameIDGenerator" />
     
-    <!-- SAML 2 NameID Generation -->
-    <util:list id="shibboleth.SAML2NameIDGenerators">
-    
-        <bean id="transient" class="net.shibboleth.idp.saml.impl.nameid.TransientSAML2NameIDGenerator"
-            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
-            p:transientIdGenerator-ref="${idp.transientId.generator}" />
-    

[... 92 lines stripped ...]