[java-identity-provider] branch main updated: Move principal weight map into comparison file.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c0ac921895d303d73f12b03a1fb34b3fb395542e

The following commit(s) were added to refs/heads/main by this push:
       new  c0ac92189 Move principal weight map into comparison file.
c0ac92189 is described below

commit c0ac921895d303d73f12b03a1fb34b3fb395542e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 7 18:09:59 2020 -0400

    Move principal weight map into comparison file.
---
 .../main/resources/conf/authn/authn-comparison.xml    | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/idp-conf/src/main/resources/conf/authn/authn-comparison.xml b/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
index dcf0271ca..4aeecbc4f 100644
--- a/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
+++ b/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
@@ -11,6 +11,25 @@
        default-init-method="initialize"
        default-destroy-method="destroy">
 
+    <!--
+    This is a map used to "weight" particular methods above others if the IdP has to randomly select one
+    to insert into a SAML authentication statement. The typical use shown below is to bias the IdP in favor
+    of expressing the SAML 2 PasswordProtectedTransport class over the more vanilla Password class on the
+    assumption that the IdP doesn't accept passwords via an insecure channel. This map never causes the IdP
+    to violate its matching rules if an RP requests a particular value; it only matters when nothing specific
+    is chosen. Anything not in the map has a weight of zero.
+    -->
+    
+    <util:map id="shibboleth.AuthenticationPrincipalWeightMap">
+        <entry>
+            <key>
+                <bean parent="shibboleth.SAML2AuthnContextClassRef"
+                    c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+            </key>
+            <value>1</value>
+        </entry>
+    </util:map>
+    
     <!--
     These beans can be used in the AuthnComparisonRules map below instead of the defaults to
     support more advanced matching rules. The top example shows how to configure a matching rule,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.