[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP

Scott Cantor cantor.2 at osu.edu
Thu Nov 5 20:04:42 UTC 2020


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=769eb285f5feba178541e751ef66e63573497b26

The following commit(s) were added to refs/heads/main by this push:
       new  769eb285  JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
769eb285 is described below

commit 769eb285f5feba178541e751ef66e63573497b26
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 5 15:04:40 2020 -0500

    JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
    
    https://issues.shibboleth.net/jira/browse/JOIDC-15
    
    Auto-wire acr comparison support and eliminate a config file.
---
 .../resources/conf/authn/authn-comparison-oidc.xml | 85 ----------------------
 .../META-INF/net.shibboleth.idp/postconfig.xml     |  7 ++
 2 files changed, 7 insertions(+), 85 deletions(-)

diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml
deleted file mode 100755
index 285bd523..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml
+++ /dev/null
@@ -1,85 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:util="http://www.springframework.org/schema/util"
-       xmlns:p="http://www.springframework.org/schema/p"
-       xmlns:c="http://www.springframework.org/schema/c"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
-                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-                           
-       default-init-method="initialize"
-       default-destroy-method="destroy">
-
-    <!-- This file is a example of authn-comparison.xml that includes oidc exact match definition -->
-
-    <!--
-    These beans can be used in the AuthnComparisonRules map below instead of the defaults to
-    support more advanced matching rules. The top example shows how to configure a matching rule,
-    in this case a rule that the two listed classes are "better" than the password class.
-    
-    To use these beans, configure the matchingRules map as desired, and then reference the bean id in the
-    desired value-ref slot in the AuthnComparisonRules map.
-    -->
-    
-    <bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory">
-        <!--
-        <property name="matchingRules">
-            <map>
-                <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password">
-                    <list>
-                        <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value>
-                        <value>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</value>
-                    </list>
-                </entry>
-            </map>
-        </property>
-        -->
-    </bean>
-
-    <bean id="shibboleth.MinimumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
-    <bean id="shibboleth.MaximumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
-    <!-- DeclRefs are rarely used in SAML, so you likely won't bother with these. -->
-    <bean id="shibboleth.BetterDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    <bean id="shibboleth.MinimumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    <bean id="shibboleth.MaximumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-    
-    
-    <!-- Registry of matching rules. -->
-
-    <!-- OIDC exact match bean definition -->
-    <bean id="shibboleth.OIDCAuthnMethodExact" class="net.shibboleth.utilities.java.support.collection.Pair"
-        p:first="#{ T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal) }" p:second="exact"/>
-    
-    <util:map id="shibboleth.AuthnComparisonRules">
-    
-        <!-- Exact matching, should be left alone to avoid tricking the IdP into behaving incorrectly. -->
-        <entry key-ref="shibboleth.SAMLAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACClassRefExact" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefExact" value-ref="shibboleth.ExactMatchFactory"/>
-        <!-- We map OIDC exact match to exact factory -->
-        <entry key-ref="shibboleth.OIDCAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Minimum matching, leave to allow degeneration into exact, or replace with custom rules. -->
-        <entry key-ref="shibboleth.SAMLACClassRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Maximum matching, leave to allow degeneration into exact, or replace with custom rules. -->
-        <entry key-ref="shibboleth.SAMLACClassRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-
-        <!-- Better matching, refers to empty ruleset that has to be populated to work. -->
-        <entry key-ref="shibboleth.SAMLACClassRefBetter" value-ref="shibboleth.BetterClassRefMatchFactory"/>
-        <entry key-ref="shibboleth.SAMLACDeclRefBetter" value-ref="shibboleth.BetterDeclRefMatchFactory"/>
-        
-    </util:map>
-    
-    <!-- List of context classes or declarations to ignore if an SP requests them. -->
-
-    <util:list id="shibboleth.IgnoredContexts">
-        <value>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</value>
-    </util:list>
-    
-</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 4c33c54a..87b3e329 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -15,6 +15,13 @@
     <bean id="shibboleth.OIDCAuthnContextClassReference" abstract="true"
         class="org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" />
 
+    <!-- OIDC exact match bean definitions -->
+    <bean id="shibboleth.OIDCAuthnMethodExact" parent="shibboleth.Pair"
+        p:first="#{ T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal) }"
+        p:second="exact"/>
+    <bean parent="shibboleth.AuthnComparisonRegistration"
+        c:key-ref="shibboleth.OIDCAuthnMethodExact" c:value-ref="shibboleth.ExactMatchFactory" />
+
     <!-- OIDC client information resolver service beans. -->
 
     <bean id="shibboleth.ClientInformationResolverService"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list