[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/access-control.xml system/conf/utilities.xml

[noreply at shibboleth.net]

Author: scantor
Date: Wed Aug 24 08:33:04 2016
New Revision: 8348

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8348&view=rev
Log:
Add examples on user/attribute access control.

Modified:
    trunk/idp-conf/src/main/resources/conf/access-control.xml
    trunk/idp-conf/src/main/resources/system/conf/utilities.xml

Modified: trunk/idp-conf/src/main/resources/conf/access-control.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/access-control.xml?rev=8348&r1=8347&r2=8348&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/access-control.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/access-control.xml	Wed Aug 24 08:33:04 2016
@@ -12,20 +12,56 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <!-- Map of access control policies used to limit access to administrative functions. -->
+    <!--
+    Map of access control policies used to limit access to administrative functions.
+    The purpose of the map is to label policies with a key/name so they can be reused.
+    -->
 
     <!--
-    The only built-in implementation of the AccessControl interface is IP-based, as below.
+    Use the "shibboleth.IPRangeAccessControl" parent bean for IP-based access control.
     The ranges provided MUST be CIDR network expressions. To specify a single address,
     add "/32" or "/128" for IPv4 or IPv6 respectively.
+
+    The additional examples below demonstrate how to control access by username
+    and by attribute(s), in the case of authenticated access to admin functions.
     -->
 
     <util:map id="shibboleth.AccessControlPolicies">
     
         <entry key="AccessByIPAddress">
-            <bean parent="shibboleth.IPRangeAccessControl"
+            <bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
                 p:allowedRanges="#{ {'127.0.0.1/32', '::1/128'} }" />
         </entry>
+        
+        <!--
+        <entry key="AccessByUser">
+            <bean parent="shibboleth.PredicateAccessControl">
+                <constructor-arg>
+                    <bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'jdoe'}" />
+                </constructor-arg>
+            </bean>
+        </entry>
+        -->
+        
+        <!--
+        <entry key="AccessByAttribute">
+            <bean parent="shibboleth.PredicateAccessControl">
+                <constructor-arg>
+                    <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
+                        <property name="attributeValueMap">
+                            <map>
+                                <entry key="eduPersonEntitlement">
+                                    <list>
+                                        <value>https://example.org/entitlement/idpadmin</value>
+                                    </list>
+                                </entry>
+                            </map>
+                        </property>
+                    </bean>
+                </constructor-arg>
+            </bean>
+        </entry>
+        -->
     
     </util:map>
 

Modified: trunk/idp-conf/src/main/resources/system/conf/utilities.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/utilities.xml?rev=8348&r1=8347&r2=8348&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/utilities.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/utilities.xml	Wed Aug 24 08:33:04 2016
@@ -50,6 +50,17 @@
             </bean>
         </constructor-arg>
     </bean>
+
+    <!-- Parent bean for building custom predicates that act on the principal name of the Subject. -->
+    <bean id="shibboleth.Conditions.SubjectName" abstract="true"
+            class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
+        <constructor-arg name="objectStrategy">
+            <bean class="com.google.common.base.Functions" factory-method="compose"
+                c:g-ref="shibboleth.PrincipalNameLookup.Subject"
+                c:f-ref="shibboleth.ChildLookup.SubjectContext" />
+        </constructor-arg>
+    </bean>
+    
     
     <bean id="shibboleth.Conditions.IssuingDelegatedAssertion"
         class="net.shibboleth.idp.saml.saml2.profile.delegation.IssuingDelegatedAssertionPredicate" />