[java-identity-provider] branch main updated: More bean to property conversion.
Scott Cantor
cantor.2 at osu.edu
Mon Sep 14 18:51:53 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=238c5ba8dbdff6479f3ecbae295e88e1297808bc
The following commit(s) were added to refs/heads/main by this push:
new 238c5ba8d More bean to property conversion.
238c5ba8d is described below
commit 238c5ba8dbdff6479f3ecbae295e88e1297808bc
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 14 14:51:45 2020 -0400
More bean to property conversion.
---
.../net/shibboleth/idp/flows/authn/duo-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/function-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml | 2 +-
.../net/shibboleth/idp/flows/authn/spnego-authn-beans.xml | 1 +
.../net/shibboleth/idp/flows/authn/x509-authn-beans.xml | 4 ++--
.../shibboleth/idp/flows/authn/x509-internal-authn-beans.xml | 2 +-
.../idp/module/conf/authn/external-authn-config.xml | 2 +-
.../idp/module/conf/authn/function-authn-config.xml | 8 +-------
.../shibboleth/idp/module/conf/authn/x509-authn-config.xml | 8 ++------
idp-conf/src/main/resources/conf/authn/authn.properties | 11 +++++++++++
10 files changed, 22 insertions(+), 20 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
index cf61262ce..2774cadf6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/duo-authn-beans.xml
@@ -86,7 +86,7 @@
class="net.shibboleth.idp.authn.duo.impl.ValidateDuoAuthAPI"
p:usernameLookupStrategy-ref="shibboleth.authn.Duo.UsernameLookupStrategy"
p:duoIntegrationLookupStrategy-ref="shibboleth.authn.Duo.NonBrowser.DuoIntegrationStrategy"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.Duo.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.Duo.addDefaultPrincipals') ?: %{idp.authn.Duo.addDefaultPrincipals:true}}"
p:preauthAuthenticator-ref="DuoPreauthAuthenticator"
p:authAuthenticator-ref="DuoAuthAuthenticator"
p:classifiedMessages="#{getObject('shibboleth.authn.Duo.ClassifiedMessageMap')}"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
index e0051169e..eb4140e76 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/function-authn-beans.xml
@@ -27,7 +27,7 @@
</bean>
<bean id="ValidateFunctionResult" class="net.shibboleth.idp.authn.impl.ValidateFunctionResult" scope="prototype"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.Function.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.Function.addDefaultPrincipals') ?: %{idp.authn.Function.addDefaultPrincipals:true}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.Function.resultCachingPredicate')}"
p:resultLookupStrategy="#{getObject('shibboleth.authn.Function.ResultLookupStrategy') ?: getObject('DefaultResultLookupStrategy')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
index eef5e8e34..88c977bf2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/ipaddress-authn-beans.xml
@@ -27,7 +27,7 @@
<bean id="ValidateUserAgentAddress" class="net.shibboleth.idp.authn.impl.ValidateUserAgentAddress" scope="prototype"
p:mappings="#{getObject('shibboleth.authn.IPAddress.Mappings')}"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.IPAddress.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.IPAddress.addDefaultPrincipals') ?: %{idp.authn.IPAddress.addDefaultPrincipals:true}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.IPAddress.resultCachingPredicate')}" />
<bean id="PopulateSubjectCanonicalizationContext"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
index 63558efdd..d78518f7d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
@@ -50,6 +50,7 @@
class="net.shibboleth.idp.authn.impl.ValidateExternalAuthentication" scope="prototype"
p:metricName="net.shibboleth.idp.authn.spnego"
p:matchExpression="#{getObject('shibboleth.authn.SPNEGO.matchExpression')}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.SPNEGO.addDefaultPrincipals') ?: %{idp.authn.SPNEGO.addDefaultPrincipals:true}}"
p:classifiedMessages="#{getObject('shibboleth.authn.SPNEGO.ClassifiedMessageMap')}" />
<bean id="SPNEGOAutoLoginManager"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
index 4216fad67..4a1a4efb0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
@@ -20,14 +20,14 @@
<!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.X509.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
- c:target="#{getObject('shibboleth.authn.X509.externalAuthnPath') ?: 'contextRelative:x509-prompt.jsp'}" />
+ c:target="#{getObject('shibboleth.authn.X509.externalAuthnPath') ?: '%{idp.authn.X509.externalAuthnPath:contextRelative:x509-prompt.jsp}'.trim()}" />
<import resource="conditional:%{idp.home}/conf/authn/x509-authn-config.xml" />
<bean id="ValidateExternalAuthentication"
class="net.shibboleth.idp.authn.impl.ValidateExternalAuthentication" scope="prototype"
p:metricName="net.shibboleth.idp.authn.x509"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.X509.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.X509.addDefaultPrincipals') ?: %{idp.authn.X509.addDefaultPrincipals:true}}}"
p:classifiedMessages="#{getObject('shibboleth.authn.X509.ClassifiedMessageMap')}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.X509.resultCachingPredicate')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
index aa9e15e1a..1c52e1490 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
@@ -27,7 +27,7 @@
<bean id="ValidateX509Certificate"
class="net.shibboleth.idp.authn.impl.ValidateX509Certificate" scope="prototype"
p:trustEngine="#{getObject('shibboleth.authn.X509.TrustEngine')}"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.X509.addDefaultPrincipals') ?: true}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.X509.addDefaultPrincipals') ?: %{idp.authn.X509Internal.addDefaultPrincipals:true}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.X509.resultCachingPredicate')}" />
<bean id="PopulateSubjectCanonicalizationContext"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
index 723dddeac..af1ac3cc1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/external-authn-config.xml
@@ -21,7 +21,7 @@
<!-- Define if you want to apply a filtering expression. -->
<!--
<bean id="shibboleth.authn.External.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
- c:_0="^(.+)@example\.edu]$" />
+ c:_0="^(.+)@example\.org$" />
-->
<!--
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/function-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/function-authn-config.xml
index cf7876af6..180555631 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/function-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/function-authn-config.xml
@@ -12,13 +12,6 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!--
- Add authentication flow descriptor's supportedPrincipals collection to the resulting Subject?
- You would normally only unset this if you plan to return a completely constructed Subject from
- your authentication function.
- -->
- <util:constant id="shibboleth.authn.Function.addDefaultPrincipals" static-field="java.lang.Boolean.TRUE" />
-
<!--
The entire flow depends on the execution of a function bean you supply. A pathological script example
is below. The function may return a String, Principal, Subject, or a null to signal failure.
@@ -34,4 +27,5 @@
</value>
</constructor-arg>
</bean>
+
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/x509-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/x509-authn-config.xml
index 18b015a81..b6fc9ff11 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/x509-authn-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/x509-authn-config.xml
@@ -12,13 +12,9 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Servlet context-relative path to wherever your implementation lives. -->
- <bean id="shibboleth.authn.X509.externalAuthnPath" class="java.lang.String"
- c:_0="contextRelative:x509-prompt.jsp" />
-
<!--
- Default is to always use the path in the bean above. If you want to determine it
- dynamically, define a bean called "shibboleth.authn.X509.externalAuthnPathStrategy"
+ The idp.authn.X509.externalAuthnPath property controls the default location to use.
+ For advanced cases, define a bean called "shibboleth.authn.X509.externalAuthnPathStrategy"
of type Function<ProfileRequestContext,String> that returns the path to use.
-->
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index c78a6cb2c..d6db56478 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -59,6 +59,7 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.RemoteUser.addDefaultPrincipals = true
# Servlet context-relative path to wherever your implementation lives
#idp.authn.RemoteUser.externalAuthnPath = contextRelative:/Authn/RemoteUser
+# Most other settings need to be supplied via web.xml to the servlet
#### RemoteUserInternal ####
@@ -81,6 +82,7 @@ idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
#idp.authn.SPNEGO.order = 1000
#idp.authn.SPNEGO.nonBrowserSupported = false
+#idp.authn.SPNEGO.addDefaultPrincipals = true
#idp.authn.SPNEGO.externalAuthnPath = /Authn/SPNEGO
#idp.authn.SPNEGO.enforceRun = false
#idp.authn.SPNEGO.refreshKrbConfig = false
@@ -92,6 +94,9 @@ idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
#idp.authn.X509.order = 1000
#idp.authn.X509.nonBrowserSupported = false
+#idp.authn.X509.addDefaultPrincipals = true
+# Servlet context-relative path to wherever your implementation lives
+#idp.authn.X509.externalAuthnPath = contextRelative:x509-prompt.jsp
#idp.authn.X509.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
@@ -101,6 +106,7 @@ idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
#idp.authn.X509Internal.order = 1000
#idp.authn.X509Internal.nonBrowserSupported = false
+#idp.authn.X509Internal.addDefaultPrincipals = true
#idp.authn.X509Internal.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
@@ -112,6 +118,7 @@ idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
#idp.authn.IPAddress.passiveAuthenticationSupported = true
#idp.authn.IPAddress.lifetime = PT60S
#idp.authn.IPAddress.inactivityTimeout = PT60S
+#idp.authn.IPAddress.addDefaultPrincipals = true
#idp.authn.IPAddress.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol
@@ -119,12 +126,16 @@ idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
#idp.authn.Function.order = 1000
#idp.authn.Function.passiveAuthenticationSupported = true
+# Unset if you plan to return full Java Subject from function
+#idp.authn.Function.addDefaultPrincipals = true
#### Duo ####
#idp.authn.Duo.order = 1000
#idp.authn.Duo.nonBrowserSupported = false
#idp.authn.Duo.forcedAuthenticationSupported = true
+# Unset if you have advanced Duo integrations with individualized Principals
+#idp.authn.Duo.addDefaultPrincipals = true
# The list below should be changed to reflect whatever locally- or
# community-defined values are appropriate to represent Duo. It is
# strongly advised that the value not be specific to Duo or any
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list