[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/errors.xml conf/idp.properties system/con...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Nov 20 21:25:00 2014
New Revision: 6978

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6978&view=rev
Log:
- Revamp error handling in flows to allow per-event audit decision
- Improve some Spring expression syntaxes
- Add a parent admin flow to inherit error handling

Added:
    trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml   (with props)
    trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-flow.xml   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/errors.xml
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/resolvertest-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/status-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/status-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/remoteuser-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/x509-authn-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-default-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/logout/logout-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/logout/logout-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-flow.xml

Modified: trunk/idp-conf/src/main/resources/conf/errors.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/errors.xml?rev=6978&r1=6977&r2=6978&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/errors.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/errors.xml Thu Nov 20 21:25:00 2014
@@ -17,17 +17,20 @@
         <entry key="LogoutResponse" value="logout-response" />
     </util:map>
 
-    <!-- List of events to trap and handle with local views, without returning to SPs. -->
-    <util:list id="shibboleth.LocalEvents">
-        <value>ContextCheckDenied</value>
-        <value>AttributeReleaseRejected</value>
-        <value>TermsRejected</value>
-        <value>RuntimeException</value>
+    <!--
+    Map of events to trap and handle with local views, without returning to SPs.
+    The map values are flags indicating whether to write an audit log record.
+    -->
+    <util:map id="shibboleth.LocalEventMap">
+        <entry key="ContextCheckDenied" value="true" />
+        <entry key="AttributeReleaseRejected" value="true" />
+        <entry key="TermsRejected" value="true" />
+        <entry key="RuntimeException" value="false" />
         <!--
-        <value>IdentitySwitch</value>
-        <value>NoPotentialFlow</value>
+        <entry key="IdentitySwitch" value="false" />
+        <entry key="NoPotentialFlow" value="false" />
         -->
-    </util:list>
+    </util:map>
     
     <!-- Mappings of error events during requests to SAML status codes and SOAP fault codes. -->
 

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6978&r1=6977&r2=6978&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Thu Nov 20 21:25:00 2014
@@ -131,9 +131,6 @@
 # May differ to direct SAML 2 artifact lookups to specific server nodes
 #idp.artifact.endpointIndex = 1
 
-#Set true to generate audit log entries for errors trapped locally
-#idp.logging.auditLocalErrors=false
-
 # Name of access control policy for various admin flows
 idp.status.accessPolicy = AccessByIPAddress
 idp.resolvertest.accessPolicy = AccessByIPAddress

Modified: trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml?rev=6978&r1=6977&r2=6978&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/webflow-config.xml Thu Nov 20 21:25:00 2014
@@ -17,6 +17,9 @@
     -->
     <webflow:flow-registry id="flowRegistry" base-path="%{idp.home}/flows" flow-builder-services="flowBuilderServices">
         <webflow:flow-location-pattern value="/**/*-flow.xml" />
+

[... 408 lines stripped ...]