[java-identity-provider] branch master updated: Example policy honoring subject-id:req tag.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f3cf6bc3a13c7ae070bfa483b5163b75c8d9a209

The following commit(s) were added to refs/heads/master by this push:
       new  f3cf6bc   Example policy honoring subject-id:req tag.
f3cf6bc is described below

commit f3cf6bc3a13c7ae070bfa483b5163b75c8d9a209
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 10 13:56:09 2018 -0400

    Example policy honoring subject-id:req tag.
---
 .../src/main/resources/conf/attribute-filter.xml   | 30 +++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/idp-conf/src/main/resources/conf/attribute-filter.xml b/idp-conf/src/main/resources/conf/attribute-filter.xml
index f8c41ba..888a8a7 100644
--- a/idp-conf/src/main/resources/conf/attribute-filter.xml
+++ b/idp-conf/src/main/resources/conf/attribute-filter.xml
@@ -13,6 +13,34 @@
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
 
+    <!--
+    Example rule for honoring Subject ID requirement tag in metadata.
+    The example supplies pairwise-id if subject-id isn't explicitly required.
+    -->
+    <AttributeFilterPolicy id="subject-identifiers">
+        <PolicyRequirementRule xsi:type="ANY" />
+
+        <AttributeRule attributeID="pairwise-id">
+            <PermitValueRule xsi:type="OR">
+                <Rule xsi:type="EntityAttributeExactMatch"
+                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+                    attributeValue="pairwise-id" />
+                <Rule xsi:type="EntityAttributeExactMatch"
+                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+                    attributeValue="any" />
+            </PermitValueRule>
+        </AttributeRule>
+
+        <AttributeRule attributeID="subject-id">
+            <PermitValueRule xsi:type="EntityAttributeExactMatch"
+                attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
+                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+                attributeValue="subject-id" />
+        </AttributeRule>
+    </AttributeFilterPolicy>
+
     <!-- Release some attributes to an SP. -->
     <AttributeFilterPolicy id="example1">
         <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.org" />
@@ -41,5 +69,5 @@
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>
-
+    
 </AttributeFilterPolicyGroup>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.