[JIRA] (IDP-1923) authn.properties is missing idp.authn.SAML.supportedPrincipals

[Vladimir Mencl (Jira)]

Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1923?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 ) IDP-1923 ( https://shibboleth.atlassian.net/browse/IDP-1923?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 ) authn.properties is missing idp.authn.SAML.supportedPrincipals ( https://shibboleth.atlassian.net/browse/IDP-1923?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.5 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Authentication, Configuration Created: 21/Mar/22 9:05 PM Priority: Trivial Reporter: Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 )

Hi,

When experimenting with adding an additional AuthnContextClass value (REFEDS MFA) to a SAML Proxying IdP, I found that I need to add the value to idp.authn.SAML.supportedPrincipals , but this property was not present in conf/authn/authn.properties.

For other authentication flows, the idp.authn.*.supportedPrincipals properties are present in conf/authn/authn.properties , but not for authn/SAML.

It appears the idp.authn.SAML.supportedPrincipals property is in default installs undefined, and the definition of authn/SAML in authn-system.xml sets the supportedPrincipalsByString property to an empty list … which in combination with the behavior of AuthenticationFlowDescriptor.doInitialize makes the bean preserve the list of supportedPrincipals inherited from abstract shibboleth.AuthenticationFlow.

It would be consistent with other flows and easier for deployers customising the list of supported authentication context class references to add the default values for authn/SAML supportedPrincipals explicitly to conf/authn/authn.properties :

{noformat}
idp.authn.SAML.supportedPrincipals =
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password,
saml1/urn:oasis:names:tc:SAML:1.0:am:password
{noformat}

Cheers,
Vlad

( https://shibboleth.atlassian.net/browse/IDP-1923#add-comment?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1923#add-comment?atlOrigin=eyJpIjoiZTI0YmMxMzZiMDg3NGU1MWE2ODZjZGQ5ZDY0Yzc4MjQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:a0fdf6e )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220322/9e53f9fd/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-6c504e3d-bc83-406f-a628-d873359a43bc
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220322/9e53f9fd/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-2e667fd0-50e7-4d28-bc35-a451f167cecc
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220322/9e53f9fd/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d93fc84c-6851-4e75-bc11-7d200c950033
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220322/9e53f9fd/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-0fd6d687-bb79-40ba-b1de-af5e29b784e8
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220322/9e53f9fd/attachment-0007.png>