[java-identity-provider] branch master updated: IDP-1335 - Add example attribute filter rules for tag-based release
Scott Cantor
cantor.2 at osu.edu
Fri Sep 21 14:07:26 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6882b017eceb3f0c2d0362acd2919c05c81c470c
The following commit(s) were added to refs/heads/master by this push:
new 6882b01 IDP-1335 - Add example attribute filter rules for tag-based release
6882b01 is described below
commit 6882b017eceb3f0c2d0362acd2919c05c81c470c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Sep 21 14:07:22 2018 -0400
IDP-1335 - Add example attribute filter rules for tag-based release
https://issues.shibboleth.net/jira/browse/IDP-1335
Also supplemented testbed metadata.
---
.../src/main/resources/conf/attribute-filter.xml | 61 +++++++++++++++-------
.../test/resources/metadata/example-metadata.xml | 9 ++++
2 files changed, 51 insertions(+), 19 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/attribute-filter.xml b/idp-conf/src/main/resources/conf/attribute-filter.xml
index 92195b1..7787d0c 100644
--- a/idp-conf/src/main/resources/conf/attribute-filter.xml
+++ b/idp-conf/src/main/resources/conf/attribute-filter.xml
@@ -4,9 +4,10 @@
example file is illustrative of some simple cases, it relies on the names of
non-existent example services and the example attributes demonstrated in the
default attribute-resolver.xml file.
-
- Deployers should refer to the documentation for a complete list of components
- and their options.
+
+ This example does contain some usable "general purpose" policies that may be
+ useful in conjunction with specific deployment choices, but those policies may
+ not be applicable to your specific needs or constraints.
-->
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
xmlns="urn:mace:shibboleth:2.0:afp"
@@ -14,6 +15,40 @@
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
<!--
+ Example rule relying on a locally applied tag in metadata to trigger attribute
+ release of some specific attributes. Add additional attributes as desired.
+ -->
+ <AttributeFilterPolicy id="Per-Attribute-singleValued">
+ <PolicyRequirementRule xsi:type="ANY" />
+
+ <AttributeRule attributeID="eduPersonPrincipalName">
+ <PermitValueRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="eduPersonPrincipalName" />
+ </AttributeRule>
+
+ <AttributeRule attributeID="mail">
+ <PermitValueRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="mail" />
+ </AttributeRule>
+ </AttributeFilterPolicy>
+
+ <!--
+ Same as above but more efficient form for an attribute with multiple values.
+ -->
+ <AttributeFilterPolicy id="Per-Attribute-Affiliation">
+ <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
+ attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
+ attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
+ attributeValue="eduPersonScopedAffiliation" />
+
+ <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
+ </AttributeFilterPolicy>
+
+ <!--
Example rule for honoring Subject ID requirement tag in metadata.
The example supplies pairwise-id if subject-id isn't explicitly required.
-->
@@ -41,33 +76,21 @@
</AttributeRule>
</AttributeFilterPolicy>
- <!-- Release some attributes to an SP. -->
+ <!-- Release an additional attribute to an SP. -->
<AttributeFilterPolicy id="example1">
<PolicyRequirementRule xsi:type="Requester" value="https://sp.example.org" />
- <AttributeRule attributeID="eduPersonPrincipalName">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
-
- <AttributeRule attributeID="uid">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
-
- <AttributeRule attributeID="mail">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
+ <AttributeRule attributeID="uid" permitAny="true" />
</AttributeFilterPolicy>
- <!-- Release eduPersonAffiliation to two specific SPs. -->
+ <!-- Release eduPersonScopedAffiliation to two specific SPs. -->
<AttributeFilterPolicy id="example2">
<PolicyRequirementRule xsi:type="OR">
<Rule xsi:type="Requester" value="https://sp.example.org" />
<Rule xsi:type="Requester" value="https://another.example.org/shibboleth" />
</PolicyRequirementRule>
- <AttributeRule attributeID="eduPersonScopedAffiliation">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
+ <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
</AttributeFilterPolicy>
</AttributeFilterPolicyGroup>
diff --git a/idp-conf/src/test/resources/metadata/example-metadata.xml b/idp-conf/src/test/resources/metadata/example-metadata.xml
index 99c275c..19f6524 100644
--- a/idp-conf/src/test/resources/metadata/example-metadata.xml
+++ b/idp-conf/src/test/resources/metadata/example-metadata.xml
@@ -21,6 +21,15 @@
<saml:AttributeValue>attribute-release</saml:AttributeValue>
</saml:Attribute>
-->
+ <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/sso/browser/encryptAssertions"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>true</saml:AttributeValue>
+ </saml:Attribute>
+ <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>eduPersonPrincipalName</saml:AttributeValue>
+ <saml:AttributeValue>mail</saml:AttributeValue>
+ </saml:Attribute>
</mdattr:EntityAttributes>
</Extensions>
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol" AuthnRequestsSigned="false">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list