[java-idp-plugin-duo] branch main updated: IDP-1652 - Redesign how various lists of descriptors and configurations are built

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=c67d9e44394ee9d634470fd2b2869a4bf7ca4764

The following commit(s) were added to refs/heads/main by this push:
       new  c67d9e4   IDP-1652 - Redesign how various lists of descriptors and configurations are built
c67d9e4 is described below

commit c67d9e44394ee9d634470fd2b2869a4bf7ca4764
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Aug 26 15:37:56 2020 +0100

    IDP-1652 - Redesign how various lists of descriptors and configurations
    are built
    
     - Add the new style AFD to the postconfig XML. Properties can now be
    overridden by specifying them in the authn.properties
    
    https://issues.shibboleth.net/jira/browse/IDP-1652
---
 .../META-INF/net.shibboleth.idp/postconfig.xml     | 25 +++++++++++++---------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 8cc6002..c7a1c73 100644
--- a/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-duo-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -12,16 +12,21 @@
     <!-- System beans needed for extension to function, loaded after global.xml -->
 
     <!-- Authentication Flow Descriptor -->
-
-    <bean p:id="authn/DuoOIDC" parent="shibboleth.AuthenticationFlow" p:forcedAuthenticationSupported="true"
-        p:passiveAuthenticationSupported="false" p:nonBrowserSupported="false"> <!-- no nonbrowser, passive? -->
-        <!-- The list below should be changed to reflect whatever locally- or community-defined values are appropriate to 
-            represent MFA. It is strongly advised that the value not be specific to Duo or any particular technology. -->
-        <property name="supportedPrincipals">
-            <list>
-                <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="http://example.org/ac/classes/mfa" />
-                <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="http://example.org/ac/classes/mfa" />
-            </list>
+   <bean id="authn/DuoOIDC" parent="shibboleth.AuthenticationFlow"
+            p:order="%{idp.authn.Duo.OIDC.order:1000}"
+            p:nonBrowserSupported="%{idp.authn.Duo.OIDC.nonBrowserSupported:false}"
+            p:passiveAuthenticationSupported="%{idp.authn.Duo.OIDC.passiveAuthenticationSupported:false}"
+            p:forcedAuthenticationSupported="%{idp.authn.Duo.OIDC.forcedAuthenticationSupported:true}"
+            p:proxyRestrictionsEnforced="%{idp.authn.Duo.OIDC.proxyRestrictionsEnforced:%{idp.authn.enforceProxyRestrictions:true}}"
+            p:proxyScopingEnforced="%{idp.authn.Duo.OIDC.proxyScopingEnforced:false}"
+            p:discoveryRequired="%{idp.authn.Duo.OIDC.discoveryRequired:false}"
+            p:lifetime="%{idp.authn.Duo.OIDC.lifetime:%{idp.authn.defaultLifetime:PT1H}}"
+            p:inactivityTimeout="%{idp.authn.Duo.OIDC.inactivityTimeout:%{idp.authn.defaultTimeout:PT30M}}"
+            p:reuseCondition-ref="#{'%{idp.authn.Duo.OIDC.reuseCondition:shibboleth.Conditions.TRUE}'.trim()}"
+            p:activationCondition-ref="#{'%{idp.authn.Duo.OIDC.activationCondition:shibboleth.Conditions.TRUE}'.trim()}">
+        <property name="supportedPrincipalsByString">
+            <bean parent="shibboleth.CommaDelimStringArray"
+                c:_0="#{'%{idp.authn.Duo.OIDC.supportedPrincipals:}'.trim()}" />
         </property>
     </bean>
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.