[java-idp-oidc] branch main updated: Move resolver example into jar, and adjust filter examples to match.
Scott Cantor
cantor.2 at osu.edu
Tue Dec 22 16:49:30 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=3d616a2bf6f4338f528203bcc71176285676c33b
The following commit(s) were added to refs/heads/main by this push:
new 3d616a2b Move resolver example into jar, and adjust filter examples to match.
3d616a2b is described below
commit 3d616a2bf6f4338f528203bcc71176285676c33b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 22 11:49:27 2020 -0500
Move resolver example into jar, and adjust filter examples to match.
---
.../oidc/op}/conf/attribute-resolver-oidc.xml | 0
.../plugin/oidc/op/conf/oidc-attribute-filter.xml | 80 ++++++++++++----------
2 files changed, 44 insertions(+), 36 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/attribute-resolver-oidc.xml
similarity index 100%
rename from idp-oidc-extension-distribution/src/main/resources/conf/attribute-resolver-oidc.xml
rename to idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/attribute-resolver-oidc.xml
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
index 79e375c0..f9f3823f 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
@@ -1,12 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file is an EXAMPLE policy file. While the policy presented in this example file is illustrative of some simple
- cases, it relies on the names of non-existent example services and the example attributes demonstrated in the default attribute-resolver.xml
- file. Deployers should refer to the documentation for a complete list of components and their options. -->
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" xmlns="urn:mace:shibboleth:2.0:afp"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oidcext="org.geant.idpextension.oidc.attribute.filter"
- xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd org.geant.idpextension.oidc.attribute.filter classpath:/schema/idp-oidc-extension-afp.xsd">
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd
+ org.geant.idpextension.oidc.attribute.filter classpath:/schema/idp-oidc-extension-afp.xsd">
+ <!--
+ The convention in the rules below is to use pre-existing attributeID defaults where appropriate
+ and to use OIDC claim names where no existing ID makes sense. You're free to adjust all this
+ as long as the resolver and/or registry rules match.
+ -->
+
<AttributeFilterPolicy id="OPENID_SCOPE">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="openid" />
<AttributeRule attributeID="subject">
@@ -14,12 +18,13 @@
</AttributeRule>
</AttributeFilterPolicy>
- <!-- This demonstrates a rule that releases email claims in response to all oidc authentication requests having scope
- email. The requester needs to have scope email as a registered scope. -->
-
+ <!--
+ This demonstrates a rule that releases email claims in response to requests having the 'email' scope.
+ The requester needs to have that as a registered scope.
+ -->
<AttributeFilterPolicy id="OPENID_SCOPE_EMAIL">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="email" />
- <AttributeRule attributeID="email">
+ <AttributeRule attributeID="mail">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="email_verified">
@@ -27,9 +32,10 @@
</AttributeRule>
</AttributeFilterPolicy>
- <!-- This demonstrates a rule that releases address claims in response to all oidc authentication requests having scope
- address. The requester needs to have scope address as a registered scope. -->
-
+ <!--
+ This demonstrates a rule that releases address claim in response to requests having the 'address' scope.
+ The requester needs to have that as a registered scope.
+ -->
<AttributeFilterPolicy id="OPENID_SCOPE_ADDRESS">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="address" />
<AttributeRule attributeID="address">
@@ -37,12 +43,13 @@
</AttributeRule>
</AttributeFilterPolicy>
- <!-- This demonstrates a rule that releases phone claims in response to all oidc authentication requests having scope
- phone. The requester needs to have scope phone as a registered scope. -->
-
+ <!--
+ This demonstrates a rule that releases phone claims in response to requests having the 'phone' scope.
+ The requester needs to have that as a registered scope.
+ -->
<AttributeFilterPolicy id="OPENID_SCOPE_PHONE">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="phone" />
- <AttributeRule attributeID="phone_number">
+ <AttributeRule attributeID="telephoneNumber">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="phone_number_verified">
@@ -50,27 +57,31 @@
</AttributeRule>
</AttributeFilterPolicy>
- <!-- This demonstrates a rule that releases profile claims in response to all oidc authentication requests having scope
- profile. The requester needs to have scope profile as a registered scope. -->
-
+ <!--
+ This demonstrates a rule that releases profile claims in response to requests having the 'profile' scope.
+ The requester needs to have that as a registered scope.
+ -->
<AttributeFilterPolicy id="OPENID_SCOPE_PROFILE">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="profile" />
- <AttributeRule attributeID="name">
+ <AttributeRule attributeID="displayName">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="family_name">
+ <AttributeRule attributeID="sn">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="given_name">
+ <AttributeRule attributeID="givenName">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="middle_name">
+ <AttributeRule attributeID="preferredLanguage">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="nickname">
+ <AttributeRule attributeID="eduPersonNickname">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="preferred_username">
+ <AttributeRule attributeID="uid">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="middle_name">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="profile">
@@ -91,36 +102,33 @@
<AttributeRule attributeID="zoneinfo">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
- <AttributeRule attributeID="locale">
- <PermitValueRule xsi:type="ANY" />
- </AttributeRule>
<AttributeRule attributeID="updated_at">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
</AttributeFilterPolicy>
- <!-- Example rules for requesting and splitting claims. -->
+ <!-- Example rules for honoring requested claims and splitting claims between ID and UserInfo tokens. -->
+
<AttributeFilterPolicy id="REQUESTED_CLAIMS">
<PolicyRequirementRule xsi:type="ANY" />
- <!-- Release picture if asked to be released -->
+ <!-- Release picture if asked. -->
<AttributeRule attributeID="picture">
<PermitValueRule xsi:type="oidcext:AttributeInOIDCRequestedClaims" />
</AttributeRule>
- <!-- Release email in id token if specifically asked to be released for id token -->
- <AttributeRule attributeID="email_idtoken">
+ <!-- Release email in ID token if specifically asked for in ID token. -->
+ <AttributeRule attributeID="mail">
<PermitValueRule xsi:type="oidcext:AttributeInOIDCRequestedClaims" matchOnlyIDToken="true" />
</AttributeRule>
- <!-- Release email if specifically asked to be released for userinfo. -->
- <AttributeRule attributeID="email">
+ <!-- Release phone_number in UserInfo token if specifically asked for in UserInfo token. -->
+ <AttributeRule attributeID="telephoneNumber">
<PermitValueRule xsi:type="oidcext:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true" />
</AttributeRule>
- <!-- Release name if specifically asked to be released for userinfo and flagged as essential -->
- <AttributeRule attributeID="name">
+ <!-- Release name if specifically asked for in UserInfo token and flagged as essential. -->
+ <AttributeRule attributeID="displayName">
<PermitValueRule xsi:type="oidcext:AttributeInOIDCRequestedClaims" matchOnlyUserInfo="true"
onlyIfEssential="true" />
</AttributeRule>
</AttributeFilterPolicy>
</AttributeFilterPolicyGroup>
-
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list