[java-identity-provider] branch master updated: Default off addition of Principals in SAML flow.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=023a12bf298070a4eb2f54feeb6b1c9ca5409e35

The following commit(s) were added to refs/heads/master by this push:
       new  023a12b   Default off addition of Principals in SAML flow.
023a12b is described below

commit 023a12bf298070a4eb2f54feeb6b1c9ca5409e35
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 26 08:40:28 2019 -0500

    Default off addition of Principals in SAML flow.
---
 idp-conf/src/main/resources/conf/authn/saml-authn-config.xml        | 6 +++---
 idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml b/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
index 23c6992..4ff55f9 100644
--- a/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
@@ -24,12 +24,12 @@
     <!--
     Add authentication flow descriptor's supportedPrincipals collection to the
     resulting Subject? This may be problematic if it happens without regard for
-    the information returned in the assertion from the IdP, so the default is
+    the information returned in the assertion from the IdP, so changing this is
     likely to lead to violations of intent.
     
-    Usually this should be FALSE, and appropriate bidirectional mappings defined
+    Usually this should be left FALSE, and appropriate bidirectional mappings defined
     via conf/authn/authn-comparison.xml to translate across the proxy boundary.
     -->
-    <util:constant id="shibboleth.authn.SAML.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE"/>
+    <util:constant id="shibboleth.authn.SAML.addDefaultPrincipals" static-field="java.lang.Boolean.FALSE"/>
 
 </beans>
diff --git a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
index e4835e6..a2e77d1 100644
--- a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
@@ -278,7 +278,7 @@
         p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
         p:attributeFilter-ref="shibboleth.AttributeFilterService"
         p:metadataResolver-ref="shibboleth.MetadataResolver"
-        p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: true}"
+        p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: false}"
         p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"        
         p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.