[cpp-sp] branch master updated: Update default attribute rules.
Scott Cantor
cantor.2 at osu.edu
Fri Jun 8 11:16:16 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=2f10dfb3e1553b8a4284b42f67d3faf56b6a1f05
The following commit(s) were added to refs/heads/master by this push:
new 2f10dfb Update default attribute rules.
2f10dfb is described below
commit 2f10dfb3e1553b8a4284b42f67d3faf56b6a1f05
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jun 8 11:16:09 2018 -0400
Update default attribute rules.
---
configs/attribute-map.xml | 59 +++++++++++++++++++++--------------------
configs/example-shibboleth2.xml | 2 +-
configs/shibboleth2.xml | 2 +-
configs/win-shibboleth2.xml | 2 +-
4 files changed, 33 insertions(+), 32 deletions(-)
diff --git a/configs/attribute-map.xml b/configs/attribute-map.xml
index febaf90..84bdd88 100644
--- a/configs/attribute-map.xml
+++ b/configs/attribute-map.xml
@@ -6,8 +6,18 @@
few exceptions for newer attributes where the name is the same for both versions. You will
usually want to uncomment or map the names for both SAML versions as a unit.
-->
-
- <!-- First some useful eduPerson attributes that many sites might use. -->
+
+ <!-- New standard identifier attributes for SAML. -->
+
+ <Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id">
+ <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+ </Attribute>
+
+ <Attribute name="urn:oasis:names:tc:SAML:attribute:pairwise-id" id="pairwise-id">
+ <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+ </Attribute>
+
+ <!-- The most typical eduPerson attributes. -->
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
@@ -23,50 +33,38 @@
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
-
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>
- <!-- A persistent id attribute that supports personalized anonymous access. -->
-
- <!-- First, the deprecated/incorrect version, decoded as a scoped string: -->
- <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID" id="targeted-id">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
- <!-- <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/> -->
- </Attribute>
-
- <!-- Second, an alternate decoder that will decode the incorrect form into the newer form. -->
<!--
- <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID" id="persistent-id">
- <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
- </Attribute>
+ Legacy pairwise identifier attribute / NameID format, intended to be replaced by the
+ simpler pairwise-id attribute (see top of file).
-->
- <!-- Third, the new version (note the OID-style name): -->
+ <!-- The eduPerson attribute version (note the OID-style name): -->
+ <!--
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>
+ -->
- <!-- Fourth, the SAML 2.0 NameID Format: -->
+ <!-- The SAML 2.0 NameID Format: -->
+ <!--
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>
+ -->
- <!-- Some more eduPerson attributes, uncomment these to use them... -->
+ <!-- Other eduPerson attributes (SAML 2 names followed by SAML 1 names)... -->
<!--
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
-
+ <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
-
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
+ <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
+ <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+ </Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" id="primary-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
@@ -75,6 +73,9 @@
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
+ <Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
+ <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+ </Attribute>
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" id="primary-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
@@ -84,12 +85,12 @@
<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN" id="org-dn"/>
-->
- <!-- SCHAC attributes, uncomment to use... -->
+ <!-- SCHAC attributes... -->
<!--
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.9" id="schacHomeOrganization"/>
-->
- <!-- Examples of LDAP-based attributes, uncomment to use these... -->
+ <!-- Older LDAP-defined attributes (SAML 2.0 names followed by SAML 1 names)... -->
<!--
<Attribute name="urn:oid:2.5.4.3" id="cn"/>
<Attribute name="urn:oid:2.5.4.4" id="sn"/>
diff --git a/configs/example-shibboleth2.xml b/configs/example-shibboleth2.xml
index a4ceeae..aeb61c4 100644
--- a/configs/example-shibboleth2.xml
+++ b/configs/example-shibboleth2.xml
@@ -86,7 +86,7 @@
points into to this section (or to the defaults here).
-->
<ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn persistent-id targeted-id"
+ REMOTE_USER="eppn subject-id pairwise-id persistent-id"
metadataAttributePrefix="Meta-"
sessionHook="/Shibboleth.sso/AttrChecker"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index e111d12..6162e02 100644
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -11,7 +11,7 @@
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn persistent-id targeted-id"
+ REMOTE_USER="eppn subject-id pairwise-id persistent-id"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<!--
diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index 199d18c..2c2801c 100644
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -60,7 +60,7 @@
points into to this section (or to the defaults here).
-->
<ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn persistent-id targeted-id"
+ REMOTE_USER="eppn subject-id pairwise-id persistent-id"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
<!--
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list