[java-idp-oidc] branch main updated: JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
Scott Cantor
cantor.2 at osu.edu
Thu Nov 5 20:04:42 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=769eb285f5feba178541e751ef66e63573497b26
The following commit(s) were added to refs/heads/main by this push:
new 769eb285 JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
769eb285 is described below
commit 769eb285f5feba178541e751ef66e63573497b26
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 5 15:04:40 2020 -0500
JOIDC-15 - Reduce manual configuration integration touchpoints with IdP
https://issues.shibboleth.net/jira/browse/JOIDC-15
Auto-wire acr comparison support and eliminate a config file.
---
.../resources/conf/authn/authn-comparison-oidc.xml | 85 ----------------------
.../META-INF/net.shibboleth.idp/postconfig.xml | 7 ++
2 files changed, 7 insertions(+), 85 deletions(-)
diff --git a/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml b/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml
deleted file mode 100755
index 285bd523..00000000
--- a/idp-oidc-extension-distribution/src/main/resources/conf/authn/authn-comparison-oidc.xml
+++ /dev/null
@@ -1,85 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- This file is a example of authn-comparison.xml that includes oidc exact match definition -->
-
- <!--
- These beans can be used in the AuthnComparisonRules map below instead of the defaults to
- support more advanced matching rules. The top example shows how to configure a matching rule,
- in this case a rule that the two listed classes are "better" than the password class.
-
- To use these beans, configure the matchingRules map as desired, and then reference the bean id in the
- desired value-ref slot in the AuthnComparisonRules map.
- -->
-
- <bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory">
- <!--
- <property name="matchingRules">
- <map>
- <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password">
- <list>
- <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value>
- <value>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</value>
- </list>
- </entry>
- </map>
- </property>
- -->
- </bean>
-
- <bean id="shibboleth.MinimumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
- <bean id="shibboleth.MaximumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
- <!-- DeclRefs are rarely used in SAML, so you likely won't bother with these. -->
- <bean id="shibboleth.BetterDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
- <bean id="shibboleth.MinimumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
- <bean id="shibboleth.MaximumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
-
- <!-- Registry of matching rules. -->
-
- <!-- OIDC exact match bean definition -->
- <bean id="shibboleth.OIDCAuthnMethodExact" class="net.shibboleth.utilities.java.support.collection.Pair"
- p:first="#{ T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal) }" p:second="exact"/>
-
- <util:map id="shibboleth.AuthnComparisonRules">
-
- <!-- Exact matching, should be left alone to avoid tricking the IdP into behaving incorrectly. -->
- <entry key-ref="shibboleth.SAMLAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACClassRefExact" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefExact" value-ref="shibboleth.ExactMatchFactory"/>
- <!-- We map OIDC exact match to exact factory -->
- <entry key-ref="shibboleth.OIDCAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Minimum matching, leave to allow degeneration into exact, or replace with custom rules. -->
- <entry key-ref="shibboleth.SAMLACClassRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Maximum matching, leave to allow degeneration into exact, or replace with custom rules. -->
- <entry key-ref="shibboleth.SAMLACClassRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Better matching, refers to empty ruleset that has to be populated to work. -->
- <entry key-ref="shibboleth.SAMLACClassRefBetter" value-ref="shibboleth.BetterClassRefMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefBetter" value-ref="shibboleth.BetterDeclRefMatchFactory"/>
-
- </util:map>
-
- <!-- List of context classes or declarations to ignore if an SP requests them. -->
-
- <util:list id="shibboleth.IgnoredContexts">
- <value>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</value>
- </util:list>
-
-</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 4c33c54a..87b3e329 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -15,6 +15,13 @@
<bean id="shibboleth.OIDCAuthnContextClassReference" abstract="true"
class="org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" />
+ <!-- OIDC exact match bean definitions -->
+ <bean id="shibboleth.OIDCAuthnMethodExact" parent="shibboleth.Pair"
+ p:first="#{ T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal) }"
+ p:second="exact"/>
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.OIDCAuthnMethodExact" c:value-ref="shibboleth.ExactMatchFactory" />
+
<!-- OIDC client information resolver service beans. -->
<bean id="shibboleth.ClientInformationResolverService"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list