[java-idp-oidc] branch main updated: Adjust sub claim defaults and comments.
Scott Cantor
cantor.2 at osu.edu
Tue Feb 9 19:22:14 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=552a6bc66910733500e43550f0c8257e7a00c83d
The following commit(s) were added to refs/heads/main by this push:
new 552a6bc6 Adjust sub claim defaults and comments.
552a6bc6 is described below
commit 552a6bc66910733500e43550f0c8257e7a00c83d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 9 14:22:12 2021 -0500
Adjust sub claim defaults and comments.
---
.../plugin/oidc/op/conf/oidc-attribute-filter.xml | 7 ++++
.../oidc/op/conf/oidc-attribute-resolver.xml | 42 +++++++++++++---------
.../idp/plugin/oidc/op/conf/oidc.properties | 2 +-
3 files changed, 33 insertions(+), 18 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
index 6d732745..9c8fc465 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-filter.xml
@@ -13,9 +13,16 @@
<AttributeFilterPolicy id="OPENID_SCOPE">
<PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="openid" />
+ <!-- May adjust to taste depending on strategy used to produce sub claim. -->
<AttributeRule attributeID="subject">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
+ <AttributeRule attributeID="subject-public">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
+ <AttributeRule attributeID="subject-pairwise">
+ <PermitValueRule xsi:type="ANY" />
+ </AttributeRule>
</AttributeFilterPolicy>
<!--
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-resolver.xml b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-resolver.xml
index a6f4aebd..1fdfa9ee 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-resolver.xml
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc-attribute-resolver.xml
@@ -11,26 +11,20 @@
<!--
Exactly one attribute needs to supply the "sub" claim, but this can't be
- fully standardized. There are suggested approaches below. Using the scoped
- encoder is recommended to ensure uniqueness.
+ fully standardized. There are suggested approaches below. Using the Scoped
+ definition is recommended to ensure intrinsic uniqueness.
-->
- <!--
- This example (the data connector in particular) will generate public or
- pairwise values depending on client registration. The public values will
- depend on, but not expose, an underlying managed value.
- -->
- <AttributeDefinition id="subject" xsi:type="Scoped" scope="%{idp.scope}"
- activationConditionRef="shibboleth.oidc.Conditions.SubjectRequired">
- <InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
- <AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
- </AttributeDefinition>
-
<!--
- These examples use activation conditions and filter rules elsewhere to allow
- for different formats for public and pairwise behavior.
+ These two examples use activation conditions and filter rules elsewhere to
+ allow for different public and pairwise behavior. This is a nice strategy
+ because using a "knowable" value for public sub claims is easier to support,
+ and allows provisioning by out of band systems.
+
+ While these examples do expose "uid" as the value for public sub claims,
+ this is simply to provide a "working" out of the box example. Using something
+ more stable, managed by IDM infrastructure, is the advisable approach.
-->
- <!--
<AttributeDefinition id="subject-public" xsi:type="Scoped" scope="%{idp.scope}"
activationConditionRef="shibboleth.oidc.Conditions.PublicRequired">
<InputAttributeDefinition ref="uid" />
@@ -42,8 +36,22 @@
<InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
<AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
</AttributeDefinition>
- -->
+ <!--
+ This example (the data connector in particular) will generate public or
+ pairwise values depending on client registration. The public values will
+ depend on, but not expose, an underlying value, which is again set to "uid"
+ for simplicity, but this is not a good strategy unless "uid" itself is a
+ stable, managed value.
+ -->
+ <!--
+ <AttributeDefinition id="subject" xsi:type="Scoped" scope="%{idp.scope}"
+ activationConditionRef="shibboleth.oidc.Conditions.SubjectRequired">
+ <InputDataConnector ref="computedSubjectId" attributeNames="subjectId"/>
+ <AttributeEncoder xsi:type="oidcext:OIDCScopedString" name="sub" />
+ </AttributeDefinition>
+ -->
+
<!--
The EPPN is the most common federated username in higher education.
For guidelines on the implementation of this attribute, refer to eduPerson
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 95d2597c..be0a2b1b 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -1,5 +1,5 @@
# Set the Open ID Connect Issuer value
-idp.oidc.issuer = https://your.issuer.example.com
+idp.oidc.issuer = https://your.issuer.example.org
#Dynamic registration properties
# The validity of registration before a new one is required.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list