[java-identity-provider] branch main updated: IDP-1824 - Conditionalize NameID encryption on format

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5dfb60fcc09acfc667982b429a3b13a256a0b08f

The following commit(s) were added to refs/heads/main by this push:
       new  5dfb60fcc IDP-1824 - Conditionalize NameID encryption on format
5dfb60fcc is described below

commit 5dfb60fcc09acfc667982b429a3b13a256a0b08f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 16 14:57:17 2021 -0400

    IDP-1824 - Conditionalize NameID encryption on format
    
    https://issues.shibboleth.net/jira/browse/IDP-1824
---
 .../shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml   | 6 ++++++
 .../net/shibboleth/idp/flows/saml/saml2/common-beans.xml          | 8 +++++++-
 idp-conf/src/test/resources/conf/global.xml                       | 5 +++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
index 996eead6c..9d2b6eddd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
@@ -73,8 +73,14 @@
     <bean id="LogoutPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
         p:fieldExtractors="#{getObject('shibboleth.PostAssertionAuditExtractors') ?: getObject('shibboleth.DefaultPostAssertionAuditExtractors')}" />
 
+    <!-- Default formats not to encrypt. -->
+    <util:set id="DefaultPlaintextNameIDFormats">
+        <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
+    </util:set>
+
     <bean id="EncryptNameIDs"
             class="org.opensaml.saml.saml2.profile.impl.EncryptNameIDs" scope="prototype"
+            p:excludedFormats="#{getObject('shibboleth.PlaintextNameIDFormats') ?: getObject('DefaultPlaintextNameIDFormats')}"
             p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple">
         <property name="encryptionContextLookupStrategy">
             <bean parent="shibboleth.Functions.Compose"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
index 2d17e7da5..62452ac7b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
@@ -107,12 +107,18 @@
         <constructor-arg ref="shibboleth.SelfEncryptionConfigurationLookup" />
     </bean>
 
+    <!-- Default formats not to encrypt. -->
+    <util:set id="DefaultPlaintextNameIDFormats">
+        <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
+    </util:set>
+
     <bean id="EncryptNameIDs"
             class="org.opensaml.saml.saml2.profile.impl.EncryptNameIDs" scope="prototype"
+            p:excludedFormats="#{getObject('shibboleth.PlaintextNameIDFormats') ?: getObject('DefaultPlaintextNameIDFormats')}"
             p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple"
             p:encryptToSelf-ref="shibboleth.Conditions.IssuingDelegatedAssertion"
             p:encryptToSelfParametersStrategy-ref="EncryptToSelfParametersStrategy"
-            p:selfRecipientLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple" >
+            p:selfRecipientLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple">
         <property name="encryptionContextLookupStrategy">
             <bean parent="shibboleth.Functions.Compose"
                 c:g-ref="shibboleth.ChildLookup.EncryptionParameters"
diff --git a/idp-conf/src/test/resources/conf/global.xml b/idp-conf/src/test/resources/conf/global.xml
index ef53c5ccc..1909cb450 100644
--- a/idp-conf/src/test/resources/conf/global.xml
+++ b/idp-conf/src/test/resources/conf/global.xml
@@ -51,6 +51,11 @@
     </util:map>
     -->
     
+    <util:set id="shibboleth.PlaintextNameIDFormats">
+        <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
+        <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.TRANSIENT" />
+    </util:set>
+    
     <util:set id="testbed.MetadataIndexes">
         <bean class="org.opensaml.saml.metadata.resolver.index.impl.SAMLArtifactMetadataIndex" />
         <ref bean="shibboleth.CASMetadataIndices" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.