[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties conf/intercept/consent-int...

[noreply at shibboleth.net]

Author: scantor
Date: Sun Nov 23 17:18:48 2014
New Revision: 6996

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6996&view=rev
Log:
Hide consent storage key config, and expose properties to control it.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml
    trunk/idp-conf/src/main/resources/system/flows/intercept/attribute-release-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/intercept/terms-of-use-beans.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6996&r1=6995&r2=6996&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Sun Nov 23 17:18:48 2014
@@ -117,6 +117,11 @@
 # Set to "shibboleth.StorageService" for server-side storage of user consent
 #idp.consent.StorageService = shibboleth.ClientPersistentStorageService
 
+# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute
+# to key user consent storage records (and set the attribute name)
+#idp.consent.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey
+#idp.consent.userStorageKeyAttribute = uid
+
 # Whether to lookup metadata, etc. for every SP involved in a logout
 # for use by user interface logic; adds overhead so off by default.
 #idp.logout.elaboration = false

Modified: trunk/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml?rev=6996&r1=6995&r2=6996&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml Sun Nov 23 17:18:48 2014
@@ -12,18 +12,15 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <!-- The ID of the attribute to be used as the user identifier when storing consent records. -->
-    <!-- TODO add property to properties file -->
-    <!-- TODO doc -->
-    <bean id="shibboleth.consent.UserIdentifierAttributeId" class="java.lang.String"
-        c:_0="%{idp.consent.userIdentifierAttributeId:email}" />
-
     <!-- TODO: make this a map? -->
     <bean id="shibboleth.consent.terms-of-use.ConsentID" class="java.lang.String" c:_0="idp.terms-of-use.id" />
     <bean id="shibboleth.consent.terms-of-use.ConsentValue" class="java.lang.String" c:_0="idp.terms-of-use.text" />
 
-    <!-- Attribute release whitelist, blacklist, and match expression to determine 
-        whether consent should be obtained for an attribute based on the attribute ID. -->
+    <!--
+    Attribute release whitelist, blacklist, and match expressions to determine 
+    whether consent should be obtained for an attribute based on the attribute ID.
+    -->
+    
     <util:list id="shibboleth.attribute-release.WhitelistedAttributeIDs">
         <!--
         <value>email</value>
@@ -39,6 +36,6 @@
     <!-- 
     <bean id="shibboleth.attribute-release.MatchExpression" class="java.util.regex.Pattern" factory-method="compile" 
         c:regex="^exampleAttribute.*$" />
-     -->
+    -->
 
 </beans>

Modified: trunk/idp-conf/src/main/resources/system/flows/intercept/attribute-release-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/intercept/attribute-release-beans.xml?rev=6996&r1=6995&r2=6996&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/intercept/attribute-release-beans.xml (original)
+++ trunk/idp-conf/src/main/resources/system/flows/intercept/attribute-release-beans.xml Sun Nov 23 17:18:48 2014
@@ -36,13 +36,24 @@
         p:blacklistedAttributeIds-ref="shibboleth.attribute-release.BlacklistedAttributeIDs"
         p:attributeIdMatchExpression="#{getObject('shibboleth.attribute-release.MatchExpression')}" />
 
-    <!-- Function to return the user identifier from an IdP attribute. -->
-    <bean id="shibboleth.consent.UserStorageKey"
+    <!-- Functions to return a storage key consisting of the user identifier. -->
+    
+    <bean id="shibboleth.consent.PrincipalConsentStorageKey"
+        class="com.google.common.base.Functions" factory-method="compose"
+        c:g-ref="shibboleth.PrincipalNameLookup.Subject"
+        c:f-ref="shibboleth.ChildLookup.SubjectContext" />
+        
+    <bean id="shibboleth.consent.AttributeConsentStorageKey"
         class="net.shibboleth.idp.consent.logic.AttributeValueLookupFunction"
-        c:userAttributeId-ref="shibboleth.consent.UserIdentifierAttributeId" />
+        c:userAttributeId="%{idp.consent.userStorageKeyAttribute:uid}" />

[... 43 lines stripped ...]