[java-identity-provider] branch main updated: Migration of authn beans into properties.
Scott Cantor
cantor.2 at osu.edu
Mon Sep 14 18:08:01 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2e491e4b6b371498eac1c15db3031f140db0a34f
The following commit(s) were added to refs/heads/main by this push:
new 2e491e4b6 Migration of authn beans into properties.
2e491e4b6 is described below
commit 2e491e4b6b371498eac1c15db3031f140db0a34f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 14 14:07:45 2020 -0400
Migration of authn beans into properties.
---
.../idp/flows/authn/external-authn-beans.xml | 4 +--
.../idp/flows/authn/remoteuser-authn-beans.xml | 4 +--
.../authn/remoteuser-internal-authn-beans.xml | 34 +++++++++++++-----
.../module/conf/authn/external-authn-config.xml | 16 ++-------
.../module/conf/authn/remoteuser-authn-config.xml | 18 +++-------
.../authn/remoteuser-internal-authn-config.xml | 41 +++-------------------
.../src/main/resources/conf/authn/authn.properties | 21 ++++++++++-
7 files changed, 60 insertions(+), 78 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
index 457c04dab..f41f6d823 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
@@ -20,14 +20,14 @@
<!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.External.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
- c:target="#{getObject('shibboleth.authn.External.externalAuthnPath') ?: 'contextRelative:external.jsp'}" />
+ c:target="#{getObject('shibboleth.authn.External.externalAuthnPath') ?: '%{idp.authn.External.externalAuthnPath:contextRelative:external.jsp}'.trim()}" />
<import resource="conditional:%{idp.home}/conf/authn/external-authn-config.xml" />
<bean id="ValidateExternalAuthentication"
class="net.shibboleth.idp.authn.impl.ValidateExternalAuthentication" scope="prototype"
p:matchExpression="#{getObject('shibboleth.authn.External.matchExpression')}"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.External.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.External.addDefaultPrincipals') ?: %{idp.authn.External.addDefaultPrincipals:true}}"
p:classifiedMessages="#{getObject('shibboleth.authn.External.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.External.resultCachingPredicate')}"
c:filterService-ref="shibboleth.AttributeFilterService"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
index 69f3e96b8..27a529335 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
@@ -20,7 +20,7 @@
<!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.RemoteUser.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
- c:target="#{getObject('shibboleth.authn.RemoteUser.externalAuthnPath') ?: 'contextRelative:Authn/RemoteUser'}" />
+ c:target="#{getObject('shibboleth.authn.RemoteUser.externalAuthnPath') ?: '%{idp.authn.RemoteUser.externalAuthnPath:contextRelative:/Authn/RemoteUser}'.trim()}" />
<import resource="conditional:%{idp.home}/conf/authn/remoteuser-authn-config.xml" />
@@ -28,7 +28,7 @@
class="net.shibboleth.idp.authn.impl.ValidateExternalAuthentication" scope="prototype"
p:metricName="net.shibboleth.idp.authn.remoteuser"
p:matchExpression="#{getObject('shibboleth.authn.RemoteUser.matchExpression')}"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.RemoteUser.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.RemoteUser.addDefaultPrincipals') ?: %{idp.authn.RemoteUser.addDefaultPrincipals:true}}"
p:classifiedMessages="#{getObject('shibboleth.authn.RemoteUser.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.RemoteUser.resultCachingPredicate')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
index 18475e544..72ba468fc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-internal-authn-beans.xml
@@ -18,32 +18,48 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
+ <bean id="shibboleth.authn.RemoteUser.checkHeaders" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUserInternal.checkHeaders:}'.trim()}" />
+
+ <bean id="shibboleth.authn.RemoteUser.checkAttributes" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUserInternal.checkAttributes:}'.trim()}" />
+
<import resource="conditional:%{idp.home}/conf/authn/remoteuser-internal-authn-config.xml" />
<bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="remoteuser-internal-authn-config.xml">
<constructor-arg index="0">
<map>
- <entry key="shibboleth.authn.RemoteUser.whitelistedUsernames" value="shibboleth.authn.RemoteUser.allowedUsernames" />
- <entry key="shibboleth.authn.RemoteUser.blacklistedUsernames" value="shibboleth.authn.RemoteUser.deniedUsernames" />
+ <entry key="shibboleth.authn.RemoteUser.whitelistedUsernames">
+ <null/>
+ </entry>
+ <entry key="shibboleth.authn.RemoteUser.blacklistedUsernames">
+ <null/>
+ </entry>
</map>
</constructor-arg>
</bean>
<bean id="ExtractRemoteUser" class="net.shibboleth.idp.authn.impl.ExtractRemoteUser" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:checkRemoteUser="#{getObject('shibboleth.authn.RemoteUser.checkRemoteUser') ?: true}"
+ p:checkRemoteUser="#{getObject('shibboleth.authn.RemoteUser.checkRemoteUser') ?: %{idp.authn.RemoteUserInternal.checkRemoteUser:true}}"
p:checkHeaders="#{getObject('shibboleth.authn.RemoteUser.checkHeaders')}"
p:checkAttributes="#{getObject('shibboleth.authn.RemoteUser.checkAttributes')}"
- p:lowercase="#{getObject('shibboleth.authn.RemoteUser.Lowercase') ?: false}"
- p:uppercase="#{getObject('shibboleth.authn.RemoteUser.Uppercase') ?: false}"
- p:trim="#{getObject('shibboleth.authn.RemoteUser.Trim') ?: true}"
+ p:lowercase="#{getObject('shibboleth.authn.RemoteUser.Lowercase') ?: %{idp.authn.RemoteUserInternal.Lowercase:false}}"
+ p:uppercase="#{getObject('shibboleth.authn.RemoteUser.Uppercase') ?: %{idp.authn.RemoteUserInternal.Uppercase:false}}"
+ p:trim="#{getObject('shibboleth.authn.RemoteUser.Trim') ?: %{idp.authn.RemoteUserInternal.Trim:true}}"
p:transforms="#{getObject('shibboleth.authn.RemoteUser.Transforms')}" />
+
+ <bean id="PropertyDrivenAllowList" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUserInternal.allowedUsernames:}'.trim()}" />
+
+ <bean id="PropertyDrivenDenyList" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUserInternal.deniedUsernames:}'.trim()}" />
<bean id="ValidateRemoteUser" class="net.shibboleth.idp.authn.impl.ValidateRemoteUser" scope="prototype"
p:matchExpression="#{getObject('shibboleth.authn.RemoteUser.matchExpression')}"
- p:allowedUsernames="#{getObject('shibboleth.authn.RemoteUser.allowedUsernames') ?: getObject('shibboleth.authn.RemoteUser.whitelistedUsernames')}"
- p:deniedUsernames="#{getObject('shibboleth.authn.RemoteUser.deniedUsernames') ?: getObject('shibboleth.authn.RemoteUser.blacklistedUsernames')}"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.RemoteUser.addDefaultPrincipals') ?: true}"
+ p:allowedUsernames="#{getObject('shibboleth.authn.RemoteUser.allowedUsernames') ?: (getObject('shibboleth.authn.RemoteUser.whitelistedUsernames') ?: getObject('PropertyDrivenAllowList'))}"
+ p:deniedUsernames="#{getObject('shibboleth.authn.RemoteUser.deniedUsernames') ?: (getObject('shibboleth.authn.RemoteUser.blacklistedUsernames') ?: getObject('PropertyDrivenDenyList'))}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.RemoteUser.addDefaultPrincipals') ?: %{idp.authn.RemoteUserInternal.addDefaultPrincipals:true}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.RemoteUser.resultCachingPredicate')}" />
<bean id="PopulateSubjectCanonicalizationContext"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
index 9d6652a71..723dddeac 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
@@ -12,23 +12,13 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Servlet context-relative path to wherever your implementation lives. -->
- <bean id="shibboleth.authn.External.externalAuthnPath" class="java.lang.String"
- c:_0="contextRelative:external.jsp" />
-
<!--
- Default is to always use the path in the bean above. If you want to determine it
- dynamically, define a bean called "shibboleth.authn.External.externalAuthnPathStrategy"
+ The idp.authn.External.externalAuthnPath property controls the default location to use.
+ For advanced cases, define a bean called "shibboleth.authn.External.externalAuthnPathStrategy"
of type Function<ProfileRequestContext,String> that returns the path to use.
-->
- <!--
- Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
- You would normally only unset this if you plan to return a fully decorated Java Subject from your
- external authentication source.
- -->
- <util:constant id="shibboleth.authn.External.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-
+ <!-- Define if you want to apply a filtering expression. -->
<!--
<bean id="shibboleth.authn.External.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
c:_0="^(.+)@example\.edu]$" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
index 4b7e72252..62d759b43 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
@@ -12,26 +12,16 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Servlet context-relative path to wherever your implementation lives. -->
- <bean id="shibboleth.authn.RemoteUser.externalAuthnPath" class="java.lang.String"
- c:_0="contextRelative:Authn/RemoteUser" />
-
<!--
- Default is to always use the path in the bean above. If you want to determine it
- dynamically, define a bean called "shibboleth.authn.RemoteUser.externalAuthnPathStrategy"
+ The idp.authn.RemoteUser.externalAuthnPath property controls the default location to use.
+ For advanced cases, define a bean called "shibboleth.authn.RemoteUser.externalAuthnPathStrategy"
of type Function<ProfileRequestContext,String> that returns the path to use.
-->
- <!--
- Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
- You would normally only unset this if you plan to use the authnMethodHeader servlet parameter to
- supply authentication method string(s) from the external authentication system.
- -->
- <util:constant id="shibboleth.authn.RemoteUser.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-
+ <!-- Define if you want to apply a filtering expression. -->
<!--
<bean id="shibboleth.authn.RemoteUser.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
- c:_0="^(.+)@example\.edu]$" />
+ c:_0="^(.+)@example\.org$" />
-->
<!--
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-internal-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-internal-authn-config.xml
index d23d45dde..517de4d08 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-internal-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-internal-authn-config.xml
@@ -12,52 +12,19 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Check getRemoteUser() for identity (the typical case). -->
- <util:constant id="shibboleth.authn.RemoteUser.checkRemoteUser" static-field="java.lang.Boolean.TRUE"/>
-
- <!-- Populate one or both of the lists below to define HTTP headers or Servlet Attributes to check. -->
-
- <util:list id="shibboleth.authn.RemoteUser.checkHeaders">
- <!--
- <value>User-Identity</value>
- -->
- </util:list>
-
- <util:list id="shibboleth.authn.RemoteUser.checkAttributes">
- <!--
- <value>User-Identity</value>
- -->
- </util:list>
-
- <!-- Simple transforms to apply to username before validation. -->
- <util:constant id="shibboleth.authn.RemoteUser.Lowercase" static-field="java.lang.Boolean.FALSE"/>
- <util:constant id="shibboleth.authn.RemoteUser.Uppercase" static-field="java.lang.Boolean.FALSE"/>
- <util:constant id="shibboleth.authn.RemoteUser.Trim" static-field="java.lang.Boolean.TRUE"/>
+ <!-- Most settings are controlled with authn.properties -->
<!-- Apply any regular expression replacement pairs before validation. -->
<util:list id="shibboleth.authn.RemoteUser.Transforms">
<!--
- <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
+ <bean parent="shibboleth.Pair" p:first="^(.+)@example\.org$" p:second="$1" />
-->
</util:list>
- <!-- Uncomment/configure to install username allow set, deny set, and/or match expressions. -->
-
- <util:set id="shibboleth.authn.RemoteUser.allowedUsernames">
- <!--
- <value>goodguy</value>
- -->
- </util:set>
-
- <util:set id="shibboleth.authn.RemoteUser.deniedUsernames">
- <!--
- <value>badguy</value>
- -->
- </util:set>
-
+ <!-- Define if you want to apply a filtering expression. -->
<!--
<bean id="shibboleth.authn.RemoteUser.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
- c:_0="^(.+)@example\.edu]$" />
+ c:_0="^(.+)@example\.org$" />
-->
</beans>
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index 80da96247..c78a6cb2c 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -26,7 +26,7 @@ idp.authn.flows = Password
# Properties below override specific method behavior, as an alternative
# to defining Spring beans in XML. Refer to the documentation for a complete
-# list. Most of the properties below are mentioned only because they are
+# list. Many of the properties below are mentioned only because they are
# atypical defaults assumed for a given method.
# Flow selection among multiple equivalent options can be managed with
@@ -47,16 +47,35 @@ idp.authn.flows = Password
#idp.authn.External.order = 1000
#idp.authn.External.nonBrowserSupported = false
+# Unset if you plan to return full Java Subject from external source
+#idp.authn.External.addDefaultPrincipals = true
+# Servlet context-relative path to wherever your implementation lives
+idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#### RemoteUser ####
#idp.authn.RemoteUser.order = 1000
#idp.authn.RemoteUser.nonBrowserSupported = false
+#idp.authn.RemoteUser.addDefaultPrincipals = true
+# Servlet context-relative path to wherever your implementation lives
+#idp.authn.RemoteUser.externalAuthnPath = contextRelative:/Authn/RemoteUser
#### RemoteUserInternal ####
#idp.authn.RemoteUserInternal.order = 1000
#idp.authn.RemoteUserInternal.nonBrowserSupported = false
+# Unset in most cases only if using the authnMethodHeader feature
+#idp.authn.RemoteUserInternal.addDefaultPrincipals = true
+#idp.authn.RemoteUserInternal.checkRemoteUser = true
+# Comma-delimited lists of attributes or headers to pull from
+#idp.authn.RemoteUserInternal.checkAttributes =
+#idp.authn.RemoteUserInternal.checkHeaders =
+# Simple transforms to apply
+#idp.authn.RemoteUserInternal.Trim = true
+#idp.authn.RemoteUserInternal.Lowercase = false
+#idp.authn.RemoteUserInternal.Uppercase = false
+idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
+#idp.authn.RemoteUserInternal.deniedUsernames =
#### SPNEGO ####
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list