[java-identity-provider] branch master updated: Add a Subject DataConnector as a passthrough mechanism.
Scott Cantor
cantor.2 at osu.edu
Mon Jun 3 17:14:25 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cd27395c42e22b7ea8352629627d77e595f89ffc
The following commit(s) were added to refs/heads/master by this push:
new cd27395 Add a Subject DataConnector as a passthrough mechanism.
cd27395 is described below
commit cd27395c42e22b7ea8352629627d77e595f89ffc
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jun 3 17:14:23 2019 -0400
Add a Subject DataConnector as a passthrough mechanism.
---
.../resolver/dc/impl/SubjectDataConnector.java | 162 +++++++++++++++++++++
.../resolver/dc/impl/SubjectDataConnectorTest.java | 124 ++++++++++++++++
.../spring/dc/impl/SubjectDataConnectorParser.java | 60 ++++++++
.../impl/AttributeResolverNamespaceHandler.java | 2 +
.../spring/dc/SubjectDataConnectorParserTest.java | 44 ++++++
.../spring/dc/resolver/subjectAttributes.xml | 6 +
.../resolver/spring/dc/staticAttributes.xml | 20 ---
.../schema/shibboleth-attribute-resolver.xsd | 40 ++++-
8 files changed, 436 insertions(+), 22 deletions(-)
diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnector.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnector.java
new file mode 100644
index 0000000..48a650f
--- /dev/null
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnector.java
@@ -0,0 +1,162 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.resolver.dc.impl;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
+import javax.security.auth.Subject;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.resolver.AbstractDataConnector;
+import net.shibboleth.idp.attribute.resolver.ResolutionException;
+import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
+import net.shibboleth.idp.attribute.resolver.context.AttributeResolverWorkContext;
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A {@link net.shibboleth.idp.attribute.resolver.DataConnector} that extracts all
+ * {@link IdPAttributePrincipal} objects from the {@link Subject} objects associated
+ * with the request.
+ */
+ at ThreadSafe
+public class SubjectDataConnector extends AbstractDataConnector {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SubjectDataConnector.class);
+
+ /** Strategy used to locate the {@link ProfileRequestContext} to use. */
+ @Nonnull private Function<AttributeResolutionContext,ProfileRequestContext> prcLookupStrategy;
+
+ /** Strategy used to locate the {@link SubjectContext} to use. */
+ @Nonnull private Function<ProfileRequestContext,SubjectContext> scLookupStrategy;
+
+ /** Controls handling of empty results. */
+ private boolean noResultIsError;
+
+ /** Constructor. */
+ public SubjectDataConnector() {
+ prcLookupStrategy = new ParentContextLookup<>();
+ scLookupStrategy = new ChildContextLookup<>(SubjectContext.class);
+ }
+
+ /**
+ * Set the strategy used to locate the {@link ProfileRequestContext} associated with a given
+ * {@link AttributeResolutionContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProfileRequestContextLookupStrategy(
+ @Nonnull final Function<AttributeResolutionContext,ProfileRequestContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ prcLookupStrategy = Constraint.isNotNull(strategy, "ProfileRequestContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Sets the strategy used to locate the {@link SubjectContext} associated with a given
+ * {@link AttributeResolutionContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSubjectContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SubjectContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ scLookupStrategy = Constraint.isNotNull(strategy, "SubjectContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Gets whether obtaining no results should be treated as an error.
+ *
+ * @return whether obtaining no results should be treated as an error
+ */
+ public boolean isNoResultIsError() {
+ return noResultIsError;
+ }
+
+ /**
+ * Sets whether obtaining no results should be treated as an error.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param flag flag to set
+ */
+ public void setNoResultIsError(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ noResultIsError = flag;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull protected Map<String,IdPAttribute> doDataConnectorResolve(
+ @Nonnull final AttributeResolutionContext resolutionContext,
+ @Nonnull final AttributeResolverWorkContext workContext) throws ResolutionException {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ final SubjectContext sc = scLookupStrategy.compose(prcLookupStrategy).apply(resolutionContext);
+ if (sc == null || sc.getSubjects().isEmpty()) {
+ if (noResultIsError) {
+ throw new ResolutionException("No Subjects available to obtain attributes");
+ } else {
+ log.debug("{} Obtained no attributes from Subjects for principal '{}'", getLogPrefix(),
+ resolutionContext.getPrincipal());
+ return Collections.emptyMap();
+ }
+ }
+
+ final Map<String,IdPAttribute> results = new HashMap<>();
+
+ for (final Subject subject : sc.getSubjects()) {
+ for (final IdPAttributePrincipal principal : subject.getPrincipals(IdPAttributePrincipal.class)) {
+ results.put(principal.getName(), principal.getAttribute());
+ }
+ }
+
+ if (results.isEmpty()) {
+ if (noResultIsError) {
+ throw new ResolutionException("No IdPAttributePrincipal objects found");
+ } else {
+ log.debug("{} Obtained no attributes from Subjects for principal '{}'", getLogPrefix(),
+ resolutionContext.getPrincipal());
+ return Collections.emptyMap();
+ }
+ }
+
+ log.debug("{} Extracted {} IdPAttribute(s)", getLogPrefix(), results.size());
+ log.trace("{} Extracted atttribute IDs: {}", getLogPrefix(), results.keySet());
+
+ return results;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnectorTest.java b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnectorTest.java
new file mode 100644
index 0000000..b2c18d9
--- /dev/null
+++ b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/impl/SubjectDataConnectorTest.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.resolver.dc.impl;
+
+import static org.testng.Assert.*;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import javax.security.auth.Subject;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
+import net.shibboleth.idp.attribute.StringAttributeValue;
+import net.shibboleth.idp.attribute.resolver.ResolutionException;
+import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
+import net.shibboleth.idp.authn.AuthenticationResult;
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
+import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
+import net.shibboleth.idp.saml.impl.TestSources;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/** Test for {@link SubjectDataConnector}. */
+public class SubjectDataConnectorTest {
+
+ /** Simple result. */
+ private static final String SIMPLE_VALUE = "simple";
+
+
+ @Test public void simpleValue() throws ComponentInitializationException, ResolutionException {
+ final List<IdPAttributeValue> list = new ArrayList<>(2);
+ list.add(new StringAttributeValue(SIMPLE_VALUE));
+ list.add(new StringAttributeValue(SIMPLE_VALUE + "2"));
+
+ final IdPAttribute attr = new IdPAttribute("wibble");
+ attr.setValues(list);
+
+ final SubjectDataConnector defn = new SubjectDataConnector();
+ defn.setId("pDAD");
+ defn.initialize();
+
+ final AttributeResolutionContext ctx =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ final SubjectContext sc = ctx.getParent().getSubcontext(SubjectContext.class, true);
+ final Map<String, AuthenticationResult> authnResults = sc.getAuthenticationResults();
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new IdPAttributePrincipal(attr));
+ subject.getPrincipals().add(new AuthenticationMethodPrincipal(SIMPLE_VALUE + "2"));
+ authnResults.put("one", new AuthenticationResult("1", subject));
+
+
+ final Map<String,IdPAttribute> results = defn.resolve(ctx);
+
+ assertEquals(1, results.size());
+
+ final IdPAttribute copy = results.get("wibble");
+
+ assertEquals(copy.getValues().size(), 2);
+ assertTrue(copy.getValues().contains(new StringAttributeValue(SIMPLE_VALUE)));
+ assertTrue(copy.getValues().contains(new StringAttributeValue(SIMPLE_VALUE + "2")));
+ }
+
+ @Test public void emptyOk() throws ComponentInitializationException, ResolutionException {
+
+ final SubjectDataConnector defn = new SubjectDataConnector();
+ defn.setExportAllAttributes(true);
+ defn.setId("pDAD");
+ defn.initialize();
+
+ final AttributeResolutionContext ctx =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ final SubjectContext sc = ctx.getParent().getSubcontext(SubjectContext.class, true);
+ final Map<String, AuthenticationResult> authnResults = sc.getAuthenticationResults();
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new AuthenticationMethodPrincipal(SIMPLE_VALUE + "2"));
+ authnResults.put("one", new AuthenticationResult("1", subject));
+
+ final Map<String,IdPAttribute> results = defn.resolve(ctx);
+ assertTrue(results.isEmpty());
+ }
+
+ @Test(expectedExceptions=ResolutionException.class)
+ public void emptyError() throws ComponentInitializationException, ResolutionException {
+
+ final SubjectDataConnector defn = new SubjectDataConnector();
+ defn.setExportAllAttributes(true);
+ defn.setNoResultIsError(true);
+ defn.setId("pDAD");
+ defn.initialize();
+
+ final AttributeResolutionContext ctx =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ final SubjectContext sc = ctx.getParent().getSubcontext(SubjectContext.class, true);
+ final Map<String, AuthenticationResult> authnResults = sc.getAuthenticationResults();
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new AuthenticationMethodPrincipal(SIMPLE_VALUE + "2"));
+ authnResults.put("one", new AuthenticationResult("1", subject));
+
+ defn.resolve(ctx);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/impl/SubjectDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/impl/SubjectDataConnectorParser.java
new file mode 100644
index 0000000..64eae8a
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/impl/SubjectDataConnectorParser.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.resolver.spring.dc.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.resolver.dc.impl.SubjectDataConnector;
+import net.shibboleth.idp.attribute.resolver.spring.dc.AbstractDataConnectorParser;
+import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
+import net.shibboleth.utilities.java.support.xml.AttributeSupport;
+
+/** Bean definition Parser for a {@link SubjectDataConnector}. */
+public class SubjectDataConnectorParser extends AbstractDataConnectorParser {
+
+ /** Schema type - resolver. */
+ @Nonnull public static final QName TYPE_NAME_RESOLVER =
+ new QName(AttributeResolverNamespaceHandler.NAMESPACE, "Subject");
+
+ /** {@inheritDoc} */
+ @Override protected Class<SubjectDataConnector> getNativeBeanClass() {
+ return SubjectDataConnector.class;
+ }
+
+ /** {@inheritDoc} */
+ @Override protected void doV2Parse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
+ @Nonnull final BeanDefinitionBuilder builder) {
+
+ final String noResultIsError =
+ AttributeSupport.getAttributeValue(config, new QName("noResultIsError"));
+ if (noResultIsError != null) {
+ builder.addPropertyValue("noResultIsError", noResultIsError);
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override protected boolean warnOnDependencies() {
+ return true;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverNamespaceHandler.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverNamespaceHandler.java
index 42e2c37..a5eeeb7 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverNamespaceHandler.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverNamespaceHandler.java
@@ -42,6 +42,7 @@ import net.shibboleth.idp.attribute.resolver.spring.dc.impl.PairwiseIdDataConnec
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.ScriptDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.StaticDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.StoredIdDataConnectorParser;
+import net.shibboleth.idp.attribute.resolver.spring.dc.impl.SubjectDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.ldap.impl.LDAPDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.rdbms.impl.RDBMSDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.enc.impl.SAML1Base64AttributeEncoderParser;
@@ -110,6 +111,7 @@ public class AttributeResolverNamespaceHandler extends BaseSpringNamespaceHandle
registerBeanDefinitionParser(ScriptDataConnectorParser.TYPE_NAME_RESOLVER, new ScriptDataConnectorParser());
registerBeanDefinitionParser(StaticDataConnectorParser.TYPE_NAME_RESOLVER, new StaticDataConnectorParser());
registerBeanDefinitionParser(StoredIdDataConnectorParser.TYPE_NAME_RESOLVER, new StoredIdDataConnectorParser());
+ registerBeanDefinitionParser(SubjectDataConnectorParser.TYPE_NAME_RESOLVER, new SubjectDataConnectorParser());
// Encoders
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/SubjectDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/SubjectDataConnectorParserTest.java
new file mode 100644
index 0000000..acfdc2c
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/SubjectDataConnectorParserTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.resolver.spring.dc;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.resolver.dc.impl.SubjectDataConnector;
+import net.shibboleth.idp.attribute.resolver.spring.BaseAttributeDefinitionParserTest;
+
+/**
+ * test for {@link SubjectDataConnectorParser}
+ */
+public class SubjectDataConnectorParserTest extends BaseAttributeDefinitionParserTest {
+
+ @Test public void simple() {
+ final SubjectDataConnector connector = getDataConnector("resolver/subjectAttributes.xml", SubjectDataConnector.class);
+
+ assertFalse(connector.isExportAllAttributes());
+ assertEquals(connector.getExportAttributes().size(), 2);
+ assertTrue(connector.getExportAttributes().contains("foo"));
+ assertTrue(connector.getExportAttributes().contains("bar"));
+ assertTrue(connector.isNoResultIsError());
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/resolver/subjectAttributes.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/resolver/subjectAttributes.xml
new file mode 100644
index 0000000..0877943
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/resolver/subjectAttributes.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<DataConnector id="subjectAttributes" xsi:type="Subject"
+ xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ exportAttributes="foo bar"
+ noResultIsError="true"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd" />
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/staticAttributes.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/staticAttributes.xml
deleted file mode 100644
index dcaa031..0000000
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/staticAttributes.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<resolver:DataConnector id="staticAttributes"
- xsi:type="dc:Static" xmlns:resolver="urn:mace:shibboleth:2.0:resolver"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad" xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc"
- xmlns:enc="urn:mace:shibboleth:2.0:attribute:encoder" xmlns:sec="urn:mace:shibboleth:2.0:security"
-
- xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
- urn:mace:shibboleth:2.0:resolver:ad http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-ad.xsd
- urn:mace:shibboleth:2.0:resolver:dc http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-dc.xsd
- urn:mace:shibboleth:2.0:attribute:encoder http://shibboleth.net/schema/idp/shibboleth-attribute-encoder.xsd
- urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
- <dc:Attribute id="staticEpA">
- <dc:Value>member</dc:Value>
- </dc:Attribute>
- <dc:Attribute id="eduPersonEntitlement">
- <dc:Value>urn:example.org:entitlement:entitlement1</dc:Value>
- <dc:Value>urn:mace:dir:entitlement:common-lib-terms</dc:Value>
- </dc:Attribute>
-</resolver:DataConnector>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index dc2fde6..9c7ba37 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -618,13 +618,19 @@
</choice>
<attribute name="attributeValuesFunctionRef" type="string">
<annotation>
- <documentation>Provides a plug in point to allow general extraction of values from Principals. Incompatible with idpAttributeName</documentation>
+ <documentation>
+ Provides a plug in point to allow general extraction of values from Principals.
+ Mutually exclusive with principalAttributeName.
+ </documentation>
</annotation>
</attribute>
<attribute name="principalAttributeName" type="string">
<annotation>
- <documentation>The id of the IdPAttribute contained within a IdPAttributePrincipal to look for. Incompatible with attributeValueEngineRef.</documentation>
+ <documentation>
+ The id of the IdPAttribute contained within a IdPAttributePrincipal to look for.
+ Mutually exclusive with attributeValueEngineRef.
+ </documentation>
</annotation>
</attribute>
</extension>
@@ -1440,6 +1446,36 @@
</extension>
</complexContent>
</complexType>
+
+ <complexType name="Subject">
+ <annotation>
+ <documentation>
+ A data connector that constructs attributes by extracting all IdPAttributePrincipal objects
+ found within the Subject(s) associated with the requests.
+
+ This is a streamlined approach to extracting them one by one with the SubjectDerivedAttribute
+ plugin provided encoding and other attribute metadata can be obtained from the system's
+ generalized transcoding facility.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <sequence>
+ <element ref="resolver:FailoverDataConnector" minOccurs="0" maxOccurs="1"/>
+ </sequence>
+ <attribute name="noResultIsError" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether an absence of any results will cause an error. If an error
+ is raised and a failover dependency is defined for this connector the failover will be invoked.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
<!-- Support types for DataConnectors -->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list