[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties system/conf/saml-binding-c...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Nov  9 20:41:57 2015
New Revision: 7976

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7976&view=rev
Log:
IDP-854 - We don't have a supported way to disable artifact binding usage outbound.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=7976&r1=7975&r2=7976&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties	(original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties	Mon Nov  9 20:41:57 2015
@@ -156,12 +156,12 @@
 # Set to custom bean for alternate storage of replay cache
 #idp.replayCache.StorageService = shibboleth.StorageService
 
+# Toggles whether to allow outbound messages via SAML artifact
+#idp.artifact.enabled = true
 # Suppresses typical signing/encryption when artifact binding used
 #idp.artifact.secureChannel = true
-
 # May differ to direct SAML 2 artifact lookups to specific server nodes
 #idp.artifact.endpointIndex = 2
-
 # Set to custom bean for alternate storage of artifact map state
 #idp.artifact.StorageService = shibboleth.StorageService
 

Modified: trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml?rev=7976&r1=7975&r2=7976&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml	Mon Nov  9 20:41:57 2015
@@ -14,12 +14,10 @@
 
     <!--
     This file configures the IdP with the set of SAML bindings to support for sending messages back through
-    a browser to SPs. Separate binding lists are provided for SAML 1, SAML 2 SSO, and SAML 2 SLO.
+    a browser to SPs. Separate binding lists are provided for the various SAML versions and profiles.
     
     For advanced use cases, it's possible to configure an activationCondition property that can evaluate the
     profile request context to determine whether a binding applies, for example based on the SP identity.
-    
-    In most cases, simply leaving this alone, or reordering the bindings to fit your preferences, is enough.
     
     Note: the p:id syntax MUST be used to specify the binding URI. Using id alone will cause problems due to
     duplicate bean IDs. 
@@ -31,7 +29,8 @@
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
             p:encoderBeanId="shibboleth.Encoders.SAML1PostEncoder" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
-            p:encoderBeanId="shibboleth.Encoders.SAML1ArtifactEncoder" p:artifact="true" />
+            p:encoderBeanId="shibboleth.Encoders.SAML1ArtifactEncoder" p:artifact="true"
+            p:activationCondition="%{idp.artifact.enabled:true}" />
     </util:list>
 
     <util:list id="shibboleth.OutgoingSAML2SSOBindings">
@@ -40,7 +39,8 @@
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
             p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" p:signatureCapable="true" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
-            p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true" />
+            p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true"
+            p:activationCondition="%{idp.artifact.enabled:true}" />
     </util:list>
 
     <util:list id="shibboleth.OutgoingSAML2SLOBindings">
@@ -51,7 +51,8 @@
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
             p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" p:signatureCapable="true" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
-            p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true" />
+            p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true"
+            p:activationCondition="%{idp.artifact.enabled:true}" />
     </util:list>
 
     <util:list id="shibboleth.OutgoingSOAPBindings">