[java-idp-oidc] branch main updated: Add a bunch of standard claim rules and streamline resolver example.
Scott Cantor
cantor.2 at osu.edu
Tue Dec 22 16:00:15 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=eacfb96195f70d1b931e30d9d07fa0b7de60d39a
The following commit(s) were added to refs/heads/main by this push:
new eacfb961 Add a bunch of standard claim rules and streamline resolver example.
eacfb961 is described below
commit eacfb96195f70d1b931e30d9d07fa0b7de60d39a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 22 11:00:12 2020 -0500
Add a bunch of standard claim rules and streamline resolver example.
---
.../resources/conf/attribute-resolver-oidc.xml | 223 +++--------
.../oidc/op/conf/attributes/oidc-claim-rules.xml | 428 +++++++++++++++++++++
2 files changed, 477 insertions(+), 174 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
index f3ada7da..ecf103a9 100644
--- a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
+++ b/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
@@ -1,44 +1,38 @@
<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file is an EXAMPLE configuration file. While the configuration presented in this example file is semi-functional,
- it isn't very interesting. It is here only as a starting point for your deployment process. Very few attribute definitions
- and data connectors are demonstrated, and the data is derived statically from the logged-in username and a static example
- connector. Attribute-resolver-full.xml contains more examples of attributes, encoders, and data connectors. Deployers should
- refer to the Shibboleth documentation for a complete list of components and their options. -->
<AttributeResolver xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:oidcext="org.geant.idpextension.oidc.attribute.encoder"
- xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd org.geant.idpextension.oidc.attribute.encoder classpath:/schema/idp-oidc-extension-attribute-encoder.xsd">
- <!-- ========================================== -->
- <!-- Attribute Definitions -->
- <!-- ========================================== -->
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
+ org.geant.idpextension.oidc.attribute.encoder classpath:/schema/idp-oidc-extension-attribute-encoder.xsd">
-
- <!-- Subject Identifier is a attribute that must always be resolved.
- There has to be exactly one resolved and filtered attribute that would be encoded as 'sub'.
- This example attribute (the data connector actually ) will generate public or pairwise 'sub' depending on client registration data. -->
+ <!--
+ Exactly one attribute needs to supply the "sub" claim, but this is impossible to fully standardize.
+ There are suggested approaches below. Using the scoped encoder is recommended to ensure uniqueness.
+ -->
+ <!--
+ This example (the data connector in particular) will generate public or pairwise values depending on client registration.
+ The public values will depend on, but not expose, an underlying managed value.
+ -->
<AttributeDefinition id="subject" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.SubjectRequired">
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
+ <AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
</AttributeDefinition>
<!--
- Subject Identifier is a attribute that must always be resolved.
- There has to be exactly one resolved and filtered attribute that would be encoded as 'sub'.
-
- Use activation conditions and filters to ensure the requirement is met if you have need for several different kind of formats for 'sub'.
-
+ These examples use activation conditions and filter rules elsewhere to allow for different formats for public and pairwise.
+ -->
+ <!--
<AttributeDefinition id="subject-public" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
<InputAttributeDefinition ref="uid" />
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
+ <AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
</AttributeDefinition>
<AttributeDefinition id="subject-pairwise" xsi:type="Simple" activationConditionRef="shibboleth.oidc.Conditions.PairwiseRequired">
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="sub" />
+ <AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
</AttributeDefinition>
-->
-
<!-- The EPPN is the "standard" federated username in higher ed. For guidelines on the implementation of this attribute,
refer to the Shibboleth and eduPerson documentation. Above all, do not expose a value for this attribute without considering
the long term implications. This demonstrates use of OIDCScopedString encoder. -->
@@ -47,61 +41,32 @@
<AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="eppn" />
</AttributeDefinition>
- <!-- The uid is the closest thing to a "standard" LDAP attribute representing a local username, but you should generally
- *never* expose uid to federated services, as it is rarely globally unique. -->
+ <!--
+ The uid is the closest thing to a "standard" LDAP attribute representing a local username,
+ but you should generally *never* expose uid to federated services, as it is rarely globally unique.
+ The default mapping for OIDC is to preferred_username, which seems suitably meaningless.
+ -->
<AttributeDefinition id="uid" xsi:type="PrincipalName" />
- <!-- examples of claim splitting by defining two different email claim definitions -->
-
- <!-- In the rest of the world, the email address is the standard identifier, despite the problems with that practice.
- Consider making the EPPN value the same as your official email addresses whenever possible. This demonstrates use of OIDCString
- encoder. -->
- <AttributeDefinition id="email" xsi:type="Template">
+ <!-- This is just for illustrative purposes given that the connector is static. -->
+ <AttributeDefinition id="mail" xsi:type="Template">
<InputAttributeDefinition ref="uid" />
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="email" />
<Template><![CDATA[
- ${uid}@example.org
+ ${uid}@%{idp.scope}
]]></Template>
</AttributeDefinition>
- <!-- This demonstrates a claim that is placed always to id token -->
- <AttributeDefinition id="email_idtoken" xsi:type="Simple">
- <InputAttributeDefinition ref="email" />
- <AttributeEncoder xsi:type="oidcext:OIDCString" placeToIDToken="true" denyUserinfo="true" name="email" />
- </AttributeDefinition>
-
- <!-- examples of claim splitting by defining two different name claim definitions -->
-
- <!-- standard claim name fetched from static connector -->
- <AttributeDefinition id="name" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="name"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="name" />
- </AttributeDefinition>
-
- <!-- This demonstrates a claim that is placed always to id token -->
- <AttributeDefinition id="name_idtoken" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="name"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" placeToIDToken="true" denyUserinfo="true" name="name" />
- </AttributeDefinition>
-
<!-- Start of static attributes. In actual deployment you would use something else than static attributes for most of
these attributes/claims -->
-
- <!-- This demonstrates use of OIDCString as array encoder. -->
-
- <AttributeDefinition id="eduPersonAffiliation" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="affiliation"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asArray="true" name="affiliation" />
- </AttributeDefinition>
-
- <!-- This demonstrates use of OIDCString as int encoder. -->
- <AttributeDefinition id="age" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="age"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asInt="true" name="age" />
+ <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped" scope="%{idp.scope}">
+ <InputDataConnector ref="staticAttributes" attributeNames="affiliation" />
</AttributeDefinition>
- <!-- This demonstrates complex claim constructed by forming JSON String and declaring it to be encoded as JSON Object -->
+ <!--
+ This demonstrates a complex claim constructed by forming a JSON String.
+ The default transcoding rule for the address claim expects the object.
+ -->
<AttributeDefinition id="address" xsi:type="ScriptedAttribute">
<InputDataConnector ref="staticAttributes" attributeNames="street_address locality region postal_code country"/>
<Script><![CDATA[address.addValue("{\"street_address\":\""+street_address.getValues().get(0) + "\","
@@ -109,120 +74,33 @@
+"\"region\":\""+region.getValues().get(0) + "\","
+"\"postal_code\":\""+postal_code.getValues().get(0) + "\","
+"\"country\":\""+country.getValues().get(0) + "\"}");]]></Script>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asObject="true" name="address" />
- </AttributeDefinition>
-
- <!-- rest of the claims needed to have full set of standard claims -->
-
- <AttributeDefinition id="phone_number" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="phone_number"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="phone_number" />
- </AttributeDefinition>
-
- <AttributeDefinition id="phone_number_verified" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="phone_number_verified"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asBoolean="true" name="phone_number_verified" />
- </AttributeDefinition>
-
- <AttributeDefinition id="email_verified" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="email_verified"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asBoolean="true" name="email_verified" />
- </AttributeDefinition>
-
- <AttributeDefinition id="family_name" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="family_name"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="family_name" />
</AttributeDefinition>
- <AttributeDefinition id="given_name" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="given_name"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="given_name" />
- </AttributeDefinition>
-
- <AttributeDefinition id="middle_name" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="middle_name"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="middle_name" />
- </AttributeDefinition>
-
- <AttributeDefinition id="nickname" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="nickname"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="nickname" />
- </AttributeDefinition>
-
- <AttributeDefinition id="preferred_username" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="preferred_username"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="preferred_username" />
- </AttributeDefinition>
-
- <AttributeDefinition id="profile" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="profile"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="profile" />
- </AttributeDefinition>
-
- <AttributeDefinition id="website" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="website"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="website" />
- </AttributeDefinition>
-
- <AttributeDefinition id="picture" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="picture"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="picture" />
- </AttributeDefinition>
-
- <AttributeDefinition id="web_site" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="web_site"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="web_site" />
- </AttributeDefinition>
-
- <AttributeDefinition id="gender" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="gender"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="gender" />
- </AttributeDefinition>
- <AttributeDefinition id="birthdate" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="birthdate"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="birthdate" />
- </AttributeDefinition>
-
- <AttributeDefinition id="zoneinfo" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="zoneinfo"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="zoneinfo" />
- </AttributeDefinition>
-
- <AttributeDefinition id="locale" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="locale"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" name="locale" />
- </AttributeDefinition>
-
- <AttributeDefinition id="updated_at" xsi:type="Simple">
- <InputDataConnector ref="staticAttributes" attributeNames="updated_at"/>
- <AttributeEncoder xsi:type="oidcext:OIDCString" asInt="true" name="updated_at" />
- </AttributeDefinition>
-
- <!-- ========================================== -->
- <!-- Data Connectors -->
- <!-- ========================================== -->
-
- <!-- Data Connector for generating 'sub' claim.
- The connector may be used to generate both public and pairwise subject values -->
+ <!--
+ Data Connector for generating 'sub' claim. It may be used to generate both public
+ and pairwise subject values because it recognizes the OIDC sector_id if used.
+ -->
<DataConnector id="computedSubjectId" xsi:type="ComputedId"
generatedAttributeID="subjectId"
salt="%{idp.oidc.subject.salt}"
algorithm="%{idp.oidc.subject.algorithm:SHA}"
encoding="BASE32">
- <InputAttributeDefinition ref="%{idp.oidc.subject.sourceAttribute}"/>
+ <InputAttributeDefinition ref="%{idp.oidc.subject.sourceAttribute}"/>
</DataConnector>
+
+ <!--
+ Static example to populate default claims. Most of these are directly exposed and
+ handled by the default set of transcoding rules supplied by the plugin.
+ -->
- <DataConnector id="staticAttributes" xsi:type="Static">
+ <DataConnector id="staticAttributes" xsi:type="Static"
+ exportAttributes="telephoneNumber phone_number_verified email_verified displayName sn givenName middle_name eduPersonNickname profile picture website gender birthdate zoneinfo preferredLanguage updated_at">
<Attribute id="affiliation">
<Value>member</Value>
<Value>staff</Value>
</Attribute>
- <Attribute id="age">
- <Value>Fiftyfive</Value>
- <Value>55</Value>
- </Attribute>
- <Attribute id="phone_number">
+ <Attribute id="telephoneNumber">
<Value>+1 (604) 555-1234;ext=5678</Value>
</Attribute>
<Attribute id="phone_number_verified">
@@ -231,24 +109,21 @@
<Attribute id="email_verified">
<Value>false</Value>
</Attribute>
- <Attribute id="name">
+ <Attribute id="displayName">
<Value>Mr.Teppo Matias Testaaja</Value>
</Attribute>
- <Attribute id="family_name">
+ <Attribute id="sn">
<Value>Testaaja</Value>
</Attribute>
- <Attribute id="given_name">
+ <Attribute id="givenName">
<Value>Teppo Matias</Value>
</Attribute>
<Attribute id="middle_name">
<Value>Matias</Value>
</Attribute>
- <Attribute id="nickname">
+ <Attribute id="eduPersonNickname">
<Value>TT</Value>
</Attribute>
- <Attribute id="preferred_username">
- <Value>ttester</Value>
- </Attribute>
<Attribute id="profile">
<Value>https://fi.wikipedia.org/wiki/Tom_Cruise</Value>
</Attribute>
@@ -262,12 +137,12 @@
<Value>male</Value>
</Attribute>
<Attribute id="birthdate">
- <Value>1962</Value>
+ <Value>1969-07-20</Value>
</Attribute>
<Attribute id="zoneinfo">
<Value>America/Los_Angeles</Value>
</Attribute>
- <Attribute id="locale">
+ <Attribute id="preferredLanguage">
<Value>en-US</Value>
</Attribute>
<Attribute id="updated_at">
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/attributes/oidc-claim-rules.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/attributes/oidc-claim-rules.xml
new file mode 100644
index 00000000..921a78ef
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/attributes/oidc-claim-rules.xml
@@ -0,0 +1,428 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims -->
+
+ <bean parent="shibboleth.TranscodingRuleLoader">
+ <constructor-arg>
+ <list>
+
+ <!-- Typical inetOrgPerson attributes that map to standard claims. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">displayName</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">name</prop>
+ <prop key="displayName.en">Display name</prop>
+ <prop key="displayName.de">Anzeigename</prop>
+ <prop key="displayName.fr">Nom</prop>
+ <prop key="displayName.it">Nome</prop>
+ <prop key="displayName.ja">表示名</prop>
+ <prop key="description.en">The name that should appear in white-pages-like applications for this person.</prop>
+ <prop key="description.de">Anzeigename</prop>
+ <prop key="description.fr">Nom complet d'affichage</prop>
+ <prop key="description.it">Nome</prop>
+ <prop key="description.ja">アプリケーションでの表示に用いられる英字氏名</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">givenName</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">given_name</prop>
+ <prop key="displayName.en">Given name</prop>
+ <prop key="displayName.de">Vorname</prop>
+ <prop key="displayName.fr">Prénom</prop>
+ <prop key="displayName.it">Nome</prop>
+ <prop key="displayName.ja">名</prop>
+ <prop key="description.en">Given name of a person</prop>
+ <prop key="description.de">Vorname</prop>
+ <prop key="description.fr">Prénom de l'utilisateur</prop>
+ <prop key="description.it">Nome</prop>
+ <prop key="description.ja">氏名(名)の英語表記</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">homePhone</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number</prop>
+ <prop key="displayName.en">Private phone number</prop>
+ <prop key="displayName.de">Telefon Privat</prop>
+ <prop key="displayName.fr">Teléphone personnel</prop>
+ <prop key="displayName.it">Numero di telefono privato</prop>
+ <prop key="displayName.ja">自宅電話番号</prop>
+ <prop key="description.en">Private phone number</prop>
+ <prop key="description.de">Private Telefonnummer</prop>
+ <prop key="description.fr">Numéro de téléphone de domicile de la personne</prop>
+ <prop key="description.it">Numero di telefono privato</prop>
+ <prop key="description.ja">自宅の電話番号</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">mail</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">email</prop>
+ <prop key="displayName.en">E-mail</prop>
+ <prop key="displayName.de">E-Mail</prop>
+ <prop key="displayName.fr">Email</prop>
+ <prop key="displayName.it">E-mail</prop>
+ <prop key="displayName.ja">メールアドレス</prop>
+ <prop key="description.en">E-Mail: Preferred address for e-mail to be sent to this person</prop>
+ <prop key="description.de">E-Mail-Adresse</prop>
+ <prop key="description.de-ch">E-Mail Adresse</prop>
+ <prop key="description.fr">Adresse de courrier électronique</prop>
+ <prop key="description.it">E-Mail: l'indirizzo e-mail preferito dall'utente</prop>
+ <prop key="description.ja">メールアドレス</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">preferredLanguage</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">locale</prop>
+ <prop key="displayName.en">Preferred Language</prop>
+ <prop key="displayName.de">Bevorzugte Sprache</prop>
+ <prop key="displayName.fr">Langue préférée</prop>
+ <prop key="displayName.it">Lingua preferita</prop>
+ <prop key="displayName.ja">希望言語</prop>
+ <prop key="description.en">Preferred language: Users preferred language (see RFC1766)</prop>
+ <prop key="description.de">Bevorzugte Sprache (siehe RFC1766)</prop>
+ <prop key="description.fr">Exemple: fr, de, it, en, ... (voir RFC1766)</prop>
+ <prop key="description.it">Lingua preferita: la lingua preferita dall'utente (cfr. RFC1766)</prop>
+ <prop key="description.ja">利用者が希望する言語(RFC1766 を参照)</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">sn</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">family_name</prop>
+ <prop key="displayName.en">Surname</prop>
+ <prop key="displayName.de">Nachname</prop>
+ <prop key="displayName.fr">Nom de famille</prop>
+ <prop key="displayName.it">Cognome</prop>
+ <prop key="displayName.ja">姓</prop>
+ <prop key="description.en">Surname or family name</prop>
+ <prop key="description.de">Familienname</prop>
+ <prop key="description.fr">Nom de famille de l'utilisateur.</prop>
+ <prop key="description.it">Cognome dell'utilizzatore</prop>
+ <prop key="description.ja">氏名(姓)の英語表記</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">telephoneNumber</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number</prop>
+ <prop key="displayName.en">Business phone number</prop>
+ <prop key="displayName.de">Telefon Geschäft</prop>
+ <prop key="displayName.fr">Teléphone professionnel</prop>
+ <prop key="displayName.it">Numero di telefono dell'ufficio</prop>
+ <prop key="displayName.ja">所属機関内電話番号</prop>
+ <prop key="description.en">Business phone number: Office or campus phone number</prop>
+ <prop key="description.de">Telefonnummer am Arbeitsplatz</prop>
+ <prop key="description.fr">Teléphone de l'institut, de l'université</prop>
+ <prop key="description.it">Numero di telefono dell'ufficio</prop>
+ <prop key="description.ja">所属機関での利用者の電話番号</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">uid</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">preferred_username</prop>
+ <prop key="displayName.en">User ID</prop>
+ <prop key="displayName.de">Benutzer-ID</prop>
+ <prop key="displayName.fr">ID utilisateur</prop>
+ <prop key="displayName.it">ID dell'utente</prop>
+ <prop key="displayName.ja">ユーザID</prop>
+ <prop key="description.en">A unique identifier for a person, mainly used for user identification within the user's home organization.</prop>
+ <prop key="description.de">Eine eindeutige Nummer für eine Person, welche hauptsächlich zur Identifikation innerhalb der Organisation benutzt wird.</prop>
+ <prop key="description.fr">Identifiant de connexion d'une personnes sur les systèmes informatiques.</prop>
+ <prop key="description.it">Identificativo unico della persona, usato per l'identificazione dell'utente all'interno della organizzazione di appartenenza.</prop>
+ <prop key="description.ja">所属機関内で一意の利用者識別子</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- eduPerson attributes that map to standard claims. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonNickname</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">nickname</prop>
+ <prop key="displayName.en">Nickname</prop>
+ <prop key="displayName.de">Kurzname</prop>
+ <prop key="displayName.de-ch">Übername</prop>
+ <prop key="displayName.fr">Surnom</prop>
+ <prop key="displayName.it">Diminutivo</prop>
+ <prop key="displayName.ja">ニックネーム</prop>
+ <prop key="description.en">Person's nickname, or the informal name by which they are accustomed to be hailed.</prop>
+ <prop key="description.de">Kurzname einer Person, oder üblicher Rufname zur Begrüßung.</prop>
+ <prop key="description.de-ch">Übername einer Person, oder üblicher Rufname zur Begrüssung.</prop>
+ <prop key="description.fr">Nom personnalisable pour un usage informel.</prop>
+ <prop key="description.it">Diminutivo della persona, o soprannome.</prop>
+ <prop key="description.ja">利用者のニックネームもしくは通称</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- A subset of the major eduPerson attributes that have no standard claim mapping. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonAssurance</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonAssurance</prop>
+ <prop key="displayName.en">Assurance level</prop>
+ <prop key="displayName.de">Vertrauensgrad</prop>
+ <prop key="displayName.fr">Niveau de confiance</prop>
+ <prop key="displayName.it">Livello di sicurezza</prop>
+ <prop key="displayName.ja">保証レベル</prop>
+ <prop key="description.en">Set of URIs that assert compliance with specific standards for identity assurance.</prop>
+ <prop key="description.de">URIs die eine gewisse Zusicherung für spezifische Standards des Vertrauens beinhalten</prop>
+ <prop key="description.fr">Un ensemble d'URI qui attestent la conformité selon un standard pour les niveaux d'assurance d'identités</prop>
+ <prop key="description.it">Un insieme di URI che asseriscono l'osservanza dei livelli di sicurezza richiesti</prop>
+ <prop key="description.ja">IDの保証レベルに関して特定の基準に準拠していることを示すURI</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonEntitlement</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonEntitlement</prop>
+ <prop key="displayName.en">Entitlement</prop>
+ <prop key="displayName.de">Berechtigung</prop>
+ <prop key="displayName.fr">Entitlement</prop>
+ <prop key="displayName.it">Prerogativa</prop>
+ <prop key="displayName.ja">資格情報</prop>
+ <prop key="description.en">Member of: URI (either URL or URN) that indicates a set of rights to specific resources based on an agreement across the releavant community</prop>
+ <prop key="description.de">Zeichenkette, die Rechte für spezifische Ressourcen beschreibt</prop>
+ <prop key="description.fr">Membre de: URI (soit une URL ou une URN) décrivant un droit spécific d'accès.</prop>
+ <prop key="description.it">Membro delle seguenti URI (sia URL o URN) che rappresentano diritti specifici d'accesso validi in tutta la communità</prop>
+ <prop key="description.ja">特定のアプリケーションもしくはコミュニティ内の複数リソースへのアクセス権限を持つことを示すURI(URLもしくはURN)</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonPrincipalName</prop>
+ <prop key="transcoder">OIDCScopedStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonPrincipalName</prop>
+ <prop key="displayName.en">Principal name</prop>
+ <prop key="displayName.de">Persönliche ID</prop>
+ <prop key="displayName.fr">Principal Name</prop>
+ <prop key="displayName.it">Principal Name</prop>
+ <prop key="displayName.ja">プリンシパルID</prop>
+ <prop key="description.en">A unique identifier for a person, mainly for inter-institutional user identification.</prop>
+ <prop key="description.de">Eindeutige Benutzeridentifikation</prop>
+ <prop key="description.de-ch">Eindeutige Benützeridentifikation</prop>
+ <prop key="description.fr">L'identifiant unique de l'utilisateur</prop>
+ <prop key="description.it">Un ID personale che identifica chiaramente l'utente in seno alla sua organizzazione</prop>
+ <prop key="description.ja">フェデレーション内で一意かつ永続的な利用者識別子</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">eduPersonScopedAffiliation</prop>
+ <prop key="transcoder">OIDCScopedStringTranscoder</prop>
+ <prop key="oidc.name">eduPersonScopedAffiliation</prop>
+ <prop key="displayName.en">Scoped affiliation</prop>
+ <prop key="displayName.de">Zugehörigkeit</prop>
+ <prop key="displayName.fr">Affiliation</prop>
+ <prop key="displayName.it">Tipo di membro</prop>
+ <prop key="displayName.ja">スコープ付き職位</prop>
+ <prop key="description.en">Specifies the person's affiliation within a particular security domain</prop>
+ <prop key="description.de">Art der Zugehörigkeit zur Heimatorganisation</prop>
+ <prop key="description.de-ch">Art der Zugehörigkeit zur Heimorganisation</prop>
+ <prop key="description.fr">Type d'affiliation dans l'organisation</prop>
+ <prop key="description.it">Tipo di membro: Tipo di lavoro svolto per l'organizzazione</prop>
+ <prop key="description.ja">セキュリティドメインのスコープが付いた所属機関における職位</prop>
+ </props>
+ </property>
+ </bean>
+
+ <!-- The remainder are standard OIDC claims, which we map based on the actual claim name. -->
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">address</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.asObject">true</prop>
+ <prop key="oidc.name">address</prop>
+ <prop key="displayName.en">Postal address</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">birthdate</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">birthdate</prop>
+ <prop key="displayName.en">Date of birth</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">email_verified</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">email_verified</prop>
+ <prop key="oidc.asBoolean">true</prop>
+ <prop key="displayName.en">E-mail verification status</prop>
+ <prop key="description.en">Indicates whether e-mail address has been verified by the issuer</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">gender</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">gender</prop>
+ <prop key="displayName.en">Gender</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">middle_name</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">middle_name</prop>
+ <prop key="displayName.en">Middle name</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">phone_number_verified</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">phone_number_verified</prop>
+ <prop key="oidc.asBoolean">true</prop>
+ <prop key="displayName.en">Phone number verification status</prop>
+ <prop key="description.en">Indicates whether phone number has been verified by the issuer</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">picture</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">picture</prop>
+ <prop key="displayName.en">Picture</prop>
+ <prop key="description.en">URL of personal photo</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">profile</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">profile</prop>
+ <prop key="displayName.en">Profile page</prop>
+ <prop key="description.en">URL of personal profile page</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">website</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">website</prop>
+ <prop key="displayName.en">Web site</prop>
+ <prop key="description.en">URL to personal web site</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">updated_at</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">updated_at</prop>
+ <prop key="oidc.asInt">true</prop>
+ <prop key="displayName.en">Last update of information</prop>
+ </props>
+ </property>
+ </bean>
+
+ <bean parent="shibboleth.TranscodingProperties">
+ <property name="properties">
+ <props merge="true">
+ <prop key="id">zoneinfo</prop>
+ <prop key="transcoder">OIDCStringTranscoder</prop>
+ <prop key="oidc.name">zoneinfo</prop>
+ <prop key="displayName.en">Time zone</prop>
+ </props>
+ </property>
+ </bean>
+
+ </list>
+ </constructor-arg>
+ </bean>
+
+</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list