[java-opensaml] branch main updated: OSJ-392: OpenSAML's strict processing mode does not load ADFS metadata
Brent Putman
putmanb at georgetown.edu
Mon Feb 26 19:36:18 UTC 2024
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=86924bcd8c83a3d8c6a733e13f369e042ade0569
The following commit(s) were added to refs/heads/main by this push:
new 86924bcd8 OSJ-392: OpenSAML's strict processing mode does not load ADFS metadata
86924bcd8 is described below
commit 86924bcd8c83a3d8c6a733e13f369e042ade0569
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Feb 22 20:23:34 2024 -0500
OSJ-392: OpenSAML's strict processing mode does not load ADFS metadata
Update the RoleDescriptorXSAnyAdapter to support mutation of the
known child element types using the setters and mutable collections
defined on the RoleDescriptor interface.
---
.../metadata/impl/RoleDescriptorXSAnyAdapter.java | 501 +++++++++++++++++++--
.../impl/RoleDescriptorXSAnyAdapterTest.java | 192 ++++++++
.../opensaml/saml/saml2/metadata/adfs-metadata.xml | 486 +++++++++++++++++++-
.../saml/saml2/metadata/adfs-role-descriptor.xml | 173 +++++++
4 files changed, 1305 insertions(+), 47 deletions(-)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapter.java
index ca96bf72e..3416c5d28 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapter.java
@@ -16,8 +16,17 @@ package org.opensaml.saml.saml2.metadata.impl;
import java.time.Duration;
import java.time.Instant;
+import java.util.ArrayList;
import java.util.Collection;
+import java.util.Iterator;
+import java.util.LinkedList;
import java.util.List;
+import java.util.ListIterator;
+import java.util.Objects;
+import java.util.Set;
+import java.util.function.Consumer;
+import java.util.function.Predicate;
+import java.util.function.UnaryOperator;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
@@ -46,8 +55,41 @@ import net.shibboleth.shared.xml.DOMTypeSupport;
/**
* Component that adapts an instance of {@link XSAny} to the interface {@link RoleDescriptor}.
+ *
+ * <p>
+ * If the 'known' child elements which are explicitly defined on {@link RoleDescriptor} are mutated via the
+ * relevant setter or mutable collection, those changes will be synced back to the adapted {@link XSAny}
+ * instance. Do not modify such children on the adapted instance directly (via {@link #getAdapted()} and
+ * {@link XSAny#getUnknownXMLObjects()}). These changes can not and will not be synced back to this adapter.
+ * Other child element types specific to the adapted role descriptor sub-type can and must be mutated via
+ * calls against the adapted instance directly.
+ * </p>
*/
public class RoleDescriptorXSAnyAdapter extends AbstractXSAnyAdapter implements RoleDescriptor {
+
+ /** Set of QNames which are 'known' child element names and managed internally by this implementation. */
+ private static final Set<QName> KNOWN_CHILD_ELEMENTS = CollectionSupport.setOf(
+ Signature.DEFAULT_ELEMENT_NAME,
+ Extensions.DEFAULT_ELEMENT_NAME,
+ KeyDescriptor.DEFAULT_ELEMENT_NAME,
+ Organization.DEFAULT_ELEMENT_NAME,
+ ContactPerson.DEFAULT_ELEMENT_NAME
+ );
+
+ /** Signature child. */
+ @Nullable private Signature signature;
+
+ /** Extensions child. */
+ @Nullable private Extensions extensions;
+
+ /** Organization child. */
+ @Nullable private Organization organization;
+
+ /** KeyDescriptor children. */
+ @Nonnull private MutableChildrenList<KeyDescriptor> keyDescriptors = new MutableChildrenList<>(new ArrayList<>());
+
+ /** ContactPerson children. */
+ @Nonnull private MutableChildrenList<ContactPerson> contactPersons = new MutableChildrenList<>(new ArrayList<>());
/**
* Constructor.
@@ -56,7 +98,34 @@ public class RoleDescriptorXSAnyAdapter extends AbstractXSAnyAdapter implements
*/
public RoleDescriptorXSAnyAdapter(@Nonnull final XSAny xsAny) {
super(xsAny);
+
getAdapted().getUnknownAttributes().registerID(new QName(RoleDescriptor.ID_ATTRIB_NAME));
+
+ // Initialize the known child element type data from the adapted instance
+ signature = getAdapted().getUnknownXMLObjects().stream()
+ .filter(Signature.class::isInstance)
+ .map(Signature.class::cast)
+ .findFirst().orElse(null);
+
+ extensions = getAdapted().getUnknownXMLObjects().stream()
+ .filter(Extensions.class::isInstance)
+ .map(Extensions.class::cast)
+ .findFirst().orElse(null);
+
+ organization = getAdapted().getUnknownXMLObjects().stream()
+ .filter(Organization.class::isInstance)
+ .map(Organization.class::cast)
+ .findFirst().orElse(null);
+
+ keyDescriptors.addAllNoSync(getAdapted().getUnknownXMLObjects().stream()
+ .filter(KeyDescriptor.class::isInstance)
+ .map(KeyDescriptor.class::cast)
+ .toList());
+
+ contactPersons.addAllNoSync(getAdapted().getUnknownXMLObjects().stream()
+ .filter(ContactPerson.class::isInstance)
+ .map(ContactPerson.class::cast)
+ .toList());
}
/** {@inheritDoc} */
@@ -71,16 +140,15 @@ public class RoleDescriptorXSAnyAdapter extends AbstractXSAnyAdapter implements
/** {@inheritDoc} */
@Nullable public Signature getSignature() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(Signature.DEFAULT_ELEMENT_NAME);
- if (xmlObjects.isEmpty()) {
- return null;
- }
- return (Signature) xmlObjects.get(0);
+ return signature;
}
/** {@inheritDoc} */
public void setSignature(@Nullable final Signature newSignature) {
- throw new UnsupportedOperationException();
+ if (signature != newSignature) {
+ signature = newSignature;
+ syncChildren();
+ }
}
/** {@inheritDoc} */
@@ -217,63 +285,44 @@ public class RoleDescriptorXSAnyAdapter extends AbstractXSAnyAdapter implements
/** {@inheritDoc} */
@Nullable public Extensions getExtensions() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(Extensions.DEFAULT_ELEMENT_NAME);
- if (xmlObjects.isEmpty()) {
- return null;
- }
-
- return xmlObjects.stream()
- .filter(Extensions.class::isInstance)
- .map(Extensions.class::cast)
- .findFirst().get();
+ return extensions;
}
/** {@inheritDoc} */
- public void setExtensions(@Nullable final Extensions extensions) {
- throw new UnsupportedOperationException();
+ public void setExtensions(@Nullable final Extensions newExtensions) {
+ if (extensions != newExtensions) {
+ extensions = newExtensions;
+ syncChildren();
+ }
}
/** {@inheritDoc} */
- @Nonnull @Live public List<KeyDescriptor> getKeyDescriptors() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(KeyDescriptor.DEFAULT_ELEMENT_NAME);
- // TODO: this returned list is immutable, which violates the API
- return xmlObjects.stream()
- .filter(KeyDescriptor.class::isInstance)
- .map(KeyDescriptor.class::cast)
- .toList();
+ @Nullable public Organization getOrganization() {
+ return organization;
}
/** {@inheritDoc} */
- @Nullable public Organization getOrganization() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(Organization.DEFAULT_ELEMENT_NAME);
- if (xmlObjects.isEmpty()) {
- return null;
+ public void setOrganization(@Nullable final Organization newOrganization) {
+ if (organization != newOrganization) {
+ organization = newOrganization;
+ syncChildren();
}
- return xmlObjects.stream()
- .filter(Organization.class::isInstance)
- .map(Organization.class::cast)
- .findFirst().get();
}
/** {@inheritDoc} */
- public void setOrganization(@Nullable final Organization organization) {
- throw new UnsupportedOperationException();
+ @Nonnull @Live public List<KeyDescriptor> getKeyDescriptors() {
+ return keyDescriptors;
}
/** {@inheritDoc} */
@Nonnull @Live public List<ContactPerson> getContactPersons() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(ContactPerson.DEFAULT_ELEMENT_NAME);
- // TODO: this returned list is immutable, which violates the API
- return xmlObjects.stream()
- .filter(ContactPerson.class::isInstance)
- .map(ContactPerson.class::cast)
- .toList();
+ return contactPersons;
}
/** {@inheritDoc} */
@Nonnull @NotLive @Unmodifiable public List<Endpoint> getEndpoints() {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(Endpoint.DEFAULT_ELEMENT_NAME);
- return xmlObjects.stream()
+ //Note that this can and will only return Endpoints which have existing XMLObject support
+ return getAdapted().getUnknownXMLObjects().stream()
.filter(Endpoint.class::isInstance)
.map(Endpoint.class::cast)
.collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
@@ -281,11 +330,371 @@ public class RoleDescriptorXSAnyAdapter extends AbstractXSAnyAdapter implements
/** {@inheritDoc} */
@Nonnull @NotLive @Unmodifiable public List<Endpoint> getEndpoints(@Nonnull final QName type) {
- final List<XMLObject> xmlObjects = getAdapted().getUnknownXMLObjects(type);
- return xmlObjects.stream()
- .filter(Endpoint.class::isInstance)
- .map(Endpoint.class::cast)
+ //Note that this can and will only return Endpoints which have existing XMLObject support
+ return getEndpoints().stream()
+ .filter(t -> type.equals(t.getElementQName()) || type.equals(t.getSchemaType()))
.collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
}
+
+ /**
+ * Synchronize the instance's local child element storage back to the adapted instance of {@link XSAny}.
+ */
+ private void syncChildren() {
+ List<XMLObject> children = new LinkedList<>();
+
+ if (getSignature() != null) {
+ children.add(getSignature());
+ }
+ if (getExtensions() != null) {
+ children.add(getExtensions());
+ }
+ if (!getKeyDescriptors().isEmpty()) {
+ children.addAll(getKeyDescriptors());
+ }
+ if (getOrganization() != null) {
+ children.add(getOrganization());
+ }
+ if (!getContactPersons().isEmpty()) {
+ children.addAll(getContactPersons());
+ }
+
+ // These are the children that are not 'known' by the base role descriptor and are therefore
+ // presumably part of the sub-type data model. Since RoleDescriptor uses a <sequence>, these
+ // will always come after the 'known' child types. We just leave these stored in the adapted
+ // instance's child list and preserve here on a sync op.
+ children.addAll(
+ getAdapted().getUnknownXMLObjects().stream()
+ .filter(Objects::nonNull)
+ .filter(t -> ! KNOWN_CHILD_ELEMENTS.contains(t.getElementQName()))
+ .toList());
+
+ getAdapted().getUnknownXMLObjects().clear();
+ getAdapted().getUnknownXMLObjects().addAll(children);
+ }
+
+ /**
+ *
+ * Array implementation which causes all XMLObject children of the owning instance to be synced back to the
+ * underlying adapted {@link XSAny} on any list mutation operations.
+ *
+ * @param <T> the type of the list
+ */
+ private class MutableChildrenList<T extends XMLObject> implements List<T> {
+
+ /** Internal storage for the list. */
+ @Nonnull private List<T> storage;
+
+ /**
+ * Constructor.
+ *
+ * @param list the backing storage for the list
+ */
+ public MutableChildrenList(@Nonnull final List<T> list) {
+ storage = list;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public T set(final int index, final T element) {
+ T result = storage.set(index, element);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean add(final T e) {
+ boolean result = storage.add(e);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void add(final int index, final T element) {
+ storage.add(index, element);
+ syncChildren();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public T remove(final int index) {
+ T result = storage.remove(index);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean remove(final Object o) {
+ boolean result = storage.remove(o);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void clear() {
+ storage.clear();
+ syncChildren();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean addAll(final Collection<? extends T> c) {
+ boolean result = storage.addAll(c);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean addAll(final int index, final Collection<? extends T> c) {
+ boolean result = storage.addAll(index, c);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean removeAll(final Collection<?> c) {
+ boolean result = storage.removeAll(c);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean retainAll(final Collection<?> c) {
+ boolean result = storage.retainAll(c);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean removeIf(final Predicate<? super T> filter) {
+ boolean result = storage.removeIf(filter);
+ syncChildren();
+ return result;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void replaceAll(final UnaryOperator<T> operator) {
+ storage.replaceAll(operator);
+ syncChildren();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int size() {
+ return storage.size();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean isEmpty() {
+ return storage.isEmpty();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean contains(final Object o) {
+ return storage.contains(o);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Object[] toArray() {
+ return storage.toArray();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public <T> T[] toArray(final T[] a) {
+ return storage.toArray(a);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean containsAll(final Collection<?> c) {
+ return storage.containsAll(c);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public T get(final int index) {
+ return storage.get(index);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int indexOf(final Object o) {
+ return storage.indexOf(o);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int lastIndexOf(final Object o) {
+ return storage.lastIndexOf(o);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Iterator<T> iterator() {
+ return new MutableChildrenIterator<>(storage.iterator());
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public ListIterator<T> listIterator() {
+ return new MutableChildrenListIterator<>(storage.listIterator());
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public ListIterator<T> listIterator(final int index) {
+ return new MutableChildrenListIterator<>(storage.listIterator(index));
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public List<T> subList(final int fromIndex, final int toIndex) {
+ return new MutableChildrenList<>(storage.subList(fromIndex, toIndex));
+ }
+
+ /**
+ * Same as {@link #addAll(Collection)}, except do not sync back to adapted instance.
+ *
+ * @param c collection containing elements to be added to this list
+ *
+ * @return true if this list changed as a result of the call
+ */
+ private boolean addAllNoSync(final Collection<? extends T> c) {
+ return storage.addAll(c);
+ }
+
+ /**
+ * Iterator for mutable children which disallows removal.
+ *
+ * @param <E> the type of the iterator
+ */
+ private class MutableChildrenIterator<E> implements Iterator<E> {
+
+ /** The wrapped iterator instance. */
+ @Nonnull private Iterator<E> wrapped;
+
+ /**
+ * Constructor.
+ *
+ * @param iter the wrapped iterator
+ */
+ public MutableChildrenIterator(@Nonnull final Iterator<E> iter) {
+ wrapped = iter;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean hasNext() {
+ return wrapped.hasNext();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public E next() {
+ return wrapped.next();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void remove() {
+ throw new UnsupportedOperationException("remove");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void forEachRemaining(final Consumer<? super E> action) {
+ throw new UnsupportedOperationException("forEachRemaining");
+ }
+
+ }
+
+ /**
+ * ListIterator for mutable children which disallows removal.
+ *
+ * @param <E> the type of the iterator
+ */
+ private class MutableChildrenListIterator<E> implements ListIterator<E> {
+
+ /** The wrapper iterator. */
+ @Nonnull private ListIterator<E> wrapped;
+
+ /**
+ * Constructor.
+ *
+ * @param iter the wrapped iterator
+ */
+ public MutableChildrenListIterator(@Nonnull final ListIterator<E> iter) {
+ wrapped = iter;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean hasNext() {
+ return wrapped.hasNext();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public E next() {
+ return wrapped.next();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean hasPrevious() {
+ return wrapped.hasPrevious();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public E previous() {
+ return wrapped.previous();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int nextIndex() {
+ return wrapped.nextIndex();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int previousIndex() {
+ return wrapped.previousIndex();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void remove() {
+ throw new UnsupportedOperationException("remove");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void set(final E e) {
+ throw new UnsupportedOperationException("set");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void add(final E e) {
+ throw new UnsupportedOperationException("add");
+ }
+
+ }
+
+ }
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapterTest.java
new file mode 100644
index 000000000..0cd8ae091
--- /dev/null
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/metadata/impl/RoleDescriptorXSAnyAdapterTest.java
@@ -0,0 +1,192 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.saml2.metadata.impl;
+
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.namespace.QName;
+
+import org.opensaml.core.testing.XMLObjectBaseTestCase;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.core.xml.schema.XSAny;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.saml.saml2.metadata.ContactPerson;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.Extensions;
+import org.opensaml.saml.saml2.metadata.IDPSSODescriptor;
+import org.opensaml.saml.saml2.metadata.KeyDescriptor;
+import org.opensaml.saml.saml2.metadata.Organization;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.xmlsec.signature.Signature;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
+/**
+ *
+ */
+public class RoleDescriptorXSAnyAdapterTest extends XMLObjectBaseTestCase {
+
+ private static final QName SECURITY_TOKEN_SERVICE_TYPE = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "SecurityTokenServiceType");
+ private static final QName APPLICATION_SERVICE_TYPE = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "ApplicationServiceType");
+
+ private static final QName CLAIM_TYPES_REQUESTED_ELEMENT = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "ClaimTypesRequested");
+ private static final QName TARGET_SCOPES_ELEMENT = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "TargetScopes");
+ private static final QName APP_SERVICE_ENDPOINT_ELEMENT = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "ApplicationServiceEndpoint");
+ private static final QName PASSIVE_REQUESTOR_ENDPOINT_ELEMENT = new QName("http://docs.oasis-open.org/wsfed/federation/200706", "PassiveRequestorEndpoint");
+
+ @Test
+ public void basicEntityDescriptor() throws Exception {
+ EntityDescriptor entityDescriptor;
+ try (final InputStream in = getClass().getResourceAsStream("/org/opensaml/saml/saml2/metadata/adfs-metadata.xml")) {
+ entityDescriptor = (EntityDescriptor) XMLObjectSupport.unmarshallFromInputStream(parserPool, in);
+ }
+
+
+ Assert.assertEquals(entityDescriptor.getRoleDescriptors().size(), 4);
+
+ Assert.assertTrue(RoleDescriptorXSAnyAdapter.class.isInstance(entityDescriptor.getRoleDescriptors().get(0)));
+ Assert.assertTrue(APPLICATION_SERVICE_TYPE.equals(entityDescriptor.getRoleDescriptors().get(0).getSchemaType()));
+
+ Assert.assertTrue(RoleDescriptorXSAnyAdapter.class.isInstance(entityDescriptor.getRoleDescriptors().get(1)));
+ Assert.assertTrue(SECURITY_TOKEN_SERVICE_TYPE.equals(entityDescriptor.getRoleDescriptors().get(1).getSchemaType()));
+
+ Assert.assertTrue(SPSSODescriptor.class.isInstance(entityDescriptor.getRoleDescriptors().get(2)));
+ Assert.assertTrue(IDPSSODescriptor.class.isInstance(entityDescriptor.getRoleDescriptors().get(3)));
+
+ RoleDescriptorXSAnyAdapter appType = (RoleDescriptorXSAnyAdapter) entityDescriptor.getRoleDescriptors().get(0);
+ Assert.assertEquals(appType.getUnknownAttributes().get(new QName("ServiceDisplayName")), "ESUE Authentication Service");
+ Assert.assertEquals(appType.getSupportedProtocols(), CollectionSupport.listOf(
+ "http://docs.oasis-open.org/ws-sx/ws-trust/200512",
+ "http://schemas.xmlsoap.org/ws/2005/02/trust",
+ "http://docs.oasis-open.org/wsfed/federation/200706"));
+ Assert.assertEquals(appType.getKeyDescriptors().size(), 1);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().size(), 5);
+
+ RoleDescriptorXSAnyAdapter secTokenType = (RoleDescriptorXSAnyAdapter) entityDescriptor.getRoleDescriptors().get(1);
+ Assert.assertEquals(secTokenType.getUnknownAttributes().get(new QName("ServiceDisplayName")), "ESUE Authentication Service");
+ Assert.assertEquals(secTokenType.getSupportedProtocols(), CollectionSupport.listOf(
+ "http://docs.oasis-open.org/ws-sx/ws-trust/200512",
+ "http://schemas.xmlsoap.org/ws/2005/02/trust",
+ "http://docs.oasis-open.org/wsfed/federation/200706"));
+ Assert.assertEquals(secTokenType.getKeyDescriptors().size(), 2);
+ Assert.assertEquals(secTokenType.getAdapted().getUnknownXMLObjects().size(), 6);
+
+ }
+
+ @Test
+ public void basicRoleDescriptor() throws Exception {
+ XSAny xsAny;
+ try (final InputStream in = getClass().getResourceAsStream("/org/opensaml/saml/saml2/metadata/adfs-role-descriptor.xml")) {
+ xsAny = (XSAny) getUnmarshaller(XMLObjectProviderRegistrySupport.getDefaultProviderQName()).unmarshall(
+ parserPool.parse(in).getDocumentElement());
+ }
+
+ Assert.assertEquals(RoleDescriptor.DEFAULT_ELEMENT_NAME, xsAny.getElementQName());
+ Assert.assertEquals(APPLICATION_SERVICE_TYPE, xsAny.getSchemaType());
+
+ RoleDescriptorXSAnyAdapter appType = new RoleDescriptorXSAnyAdapter(xsAny);
+ Assert.assertEquals(appType.getUnknownAttributes().get(new QName("ServiceDisplayName")), "ESUE Authentication Service");
+ Assert.assertEquals(appType.getSupportedProtocols(), CollectionSupport.listOf(
+ "http://docs.oasis-open.org/ws-sx/ws-trust/200512",
+ "http://schemas.xmlsoap.org/ws/2005/02/trust",
+ "http://docs.oasis-open.org/wsfed/federation/200706"));
+
+ Assert.assertNull(appType.getSignature());
+ Assert.assertNotNull(appType.getExtensions());
+ Assert.assertEquals(appType.getKeyDescriptors().size(), 1);
+ Assert.assertNotNull(appType.getOrganization());
+ Assert.assertEquals(appType.getContactPersons().size(), 1);
+
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().size(), 8);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(0).getElementQName(), Extensions.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(1).getElementQName(), KeyDescriptor.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(2).getElementQName(), Organization.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(3).getElementQName(), ContactPerson.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(4).getElementQName(), CLAIM_TYPES_REQUESTED_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(5).getElementQName(), TARGET_SCOPES_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(6).getElementQName(), APP_SERVICE_ENDPOINT_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(7).getElementQName(), PASSIVE_REQUESTOR_ENDPOINT_ELEMENT);
+ }
+
+ @Test
+ public void mutateRoleDescriptorChildren() throws Exception {
+ XSAny xsAny;
+ try (final InputStream in = getClass().getResourceAsStream("/org/opensaml/saml/saml2/metadata/adfs-role-descriptor.xml")) {
+ xsAny = (XSAny) getUnmarshaller(XMLObjectProviderRegistrySupport.getDefaultProviderQName()).unmarshall(
+ parserPool.parse(in).getDocumentElement());
+ }
+
+ Assert.assertEquals(RoleDescriptor.DEFAULT_ELEMENT_NAME, xsAny.getElementQName());
+ Assert.assertEquals(APPLICATION_SERVICE_TYPE, xsAny.getSchemaType());
+
+ RoleDescriptorXSAnyAdapter appType = new RoleDescriptorXSAnyAdapter(xsAny);
+
+ appType.setSignature((Signature) XMLObjectSupport.buildXMLObject(Signature.DEFAULT_ELEMENT_NAME));
+ appType.setExtensions(null);
+ List<KeyDescriptor> keys = new ArrayList<>();
+ keys.add((KeyDescriptor) XMLObjectSupport.buildXMLObject(KeyDescriptor.DEFAULT_ELEMENT_NAME));
+ keys.add((KeyDescriptor) XMLObjectSupport.buildXMLObject(KeyDescriptor.DEFAULT_ELEMENT_NAME));
+ appType.getKeyDescriptors().addAll(keys);
+ appType.getContactPersons().add((ContactPerson) XMLObjectSupport.buildXMLObject(ContactPerson.DEFAULT_ELEMENT_NAME));
+ appType.getAdapted().getUnknownXMLObjects().add(XMLObjectSupport.buildXMLObject(simpleXMLObjectQName));
+
+ Assert.assertNotNull(appType.getSignature());
+ Assert.assertNull(appType.getExtensions());
+ Assert.assertEquals(appType.getKeyDescriptors().size(), 3);
+ Assert.assertNotNull(appType.getOrganization());
+ Assert.assertEquals(appType.getContactPersons().size(), 2);
+
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().size(), 12);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(0).getElementQName(), Signature.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(1).getElementQName(), KeyDescriptor.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(2).getElementQName(), KeyDescriptor.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(3).getElementQName(), KeyDescriptor.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(4).getElementQName(), Organization.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(5).getElementQName(), ContactPerson.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(6).getElementQName(), ContactPerson.DEFAULT_ELEMENT_NAME);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(7).getElementQName(), CLAIM_TYPES_REQUESTED_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(8).getElementQName(), TARGET_SCOPES_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(9).getElementQName(), APP_SERVICE_ENDPOINT_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(10).getElementQName(), PASSIVE_REQUESTOR_ENDPOINT_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(11).getElementQName(), simpleXMLObjectQName);
+
+ appType.setSignature(null);
+ appType.getKeyDescriptors().clear();
+ appType.setOrganization(null);
+ List<ContactPerson> persons = CollectionSupport.copyToList(appType.getContactPersons());
+ for (ContactPerson cp : persons) {
+ appType.getContactPersons().remove(cp);
+ }
+ appType.getAdapted().getUnknownXMLObjects().removeIf(t -> t.getElementQName().equals(simpleXMLObjectQName));
+
+ Assert.assertNull(appType.getSignature());
+ Assert.assertNull(appType.getExtensions());
+ Assert.assertEquals(appType.getKeyDescriptors().size(), 0);
+ Assert.assertNull(appType.getOrganization());
+ Assert.assertEquals(appType.getContactPersons().size(), 0);
+
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().size(), 4);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(0).getElementQName(), CLAIM_TYPES_REQUESTED_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(1).getElementQName(), TARGET_SCOPES_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(2).getElementQName(), APP_SERVICE_ENDPOINT_ELEMENT);
+ Assert.assertEquals(appType.getAdapted().getUnknownXMLObjects().get(3).getElementQName(), PASSIVE_REQUESTOR_ENDPOINT_ELEMENT);
+ }
+
+}
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-metadata.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-metadata.xml
index 8c3bd2a6e..ef8344b1b 100644
--- a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-metadata.xml
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-metadata.xml
@@ -1 +1,485 @@
-<EntityDescriptor ID="_762114d1-6c5f-4637-9feb-e3f001309047" entityID="http://adfs.example.org/adfs/services/trust" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_762114d1-6c5f-4637-9feb-e3f001309047"><ds:Transforms><ds:Transform Algor [...]
\ No newline at end of file
+<EntityDescriptor ID="_762114d1-6c5f-4637-9feb-e3f001309047"
+ entityID="http://adfs.example.org/adfs/services/trust" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+ <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:SignedInfo>
+ <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+ <ds:Reference URI="#_762114d1-6c5f-4637-9feb-e3f001309047">
+ <ds:Transforms>
+ <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
+ <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+ </ds:Transforms>
+ <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ <ds:DigestValue>H9JdAThG4TD/TLubIMvPQLhmO9yXvLVh8siRlAuOr/I=</ds:DigestValue>
+ </ds:Reference>
+ </ds:SignedInfo>
+ <ds:SignatureValue>K3Z14qfa3JRNcJaqdCGuHg4OsUpBrms9eJobv30cbGJqCiR54TE+HBH73SqDeMPEEvR2SW0R/rgZ89xMCTxGzjPJ1THCNcDc2HKwbEh4szId1BFUf4sPSm6AQPzh07eZ6HuWLvdMWwVfr+ZwCDTPOe3d8E0t4mJGXUOj2gNWdqM=
+ </ds:SignatureValue>
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFkzCCBHugAwIBAgIKER152QAAAAAADDANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjEyMzY1NVoXDTE0MDUxNjEyMzY1NVowga0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSAwHgYDVQQDExdFU1VFIEFERlMgVG9rZW4gU2lnbmluZzCBnzANBgkqhki [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </ds:Signature>
+ <RoleDescriptor xsi:type="fed:ApplicationServiceType"
+ protocolSupportEnumeration="http://docs.oasis-open.org/ws-sx/ws-trust/200512 http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/wsfed/federation/200706"
+ ServiceDisplayName="ESUE Authentication Service" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706">
+ <KeyDescriptor use="encryption">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFljCCBH6gAwIBAgIKEfZv5gAAAAAADTANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjE2MzM1NFoXDTE0MDUxNjE2MzM1NFowgbAxCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSMwIQYDVQQDExpFU1VFIEFERlMgVG9rZW4gRGVjcnlwdGlvbjCBnzA [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <fed:ClaimTypesRequested>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Given Name</auth:DisplayName>
+ <auth:Description>The given name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name</auth:DisplayName>
+ <auth:Description>The unique name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>UPN</auth:DisplayName>
+ <auth:Description>The user principal name (UPN) of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/CommonName" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Common Name</auth:DisplayName>
+ <auth:Description>The common name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/EmailAddress" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0
+ </auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/Group" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group</auth:DisplayName>
+ <auth:Description>A group that the user is a member of</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/UPN" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x UPN</auth:DisplayName>
+ <auth:Description>The UPN of the user when interoperating with AD FS 1.1 or ADFS 1.0</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Role</auth:DisplayName>
+ <auth:Description>A role that the user has</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Surname</auth:DisplayName>
+ <auth:Description>The surname of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>PPID</auth:DisplayName>
+ <auth:Description>The private identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name ID</auth:DisplayName>
+ <auth:Description>The SAML name identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication time stamp</auth:DisplayName>
+ <auth:Description>Used to display the time and date that the user was authenticated</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication method</auth:DisplayName>
+ <auth:Description>The method used to authenticate the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only group SID</auth:DisplayName>
+ <auth:Description>The deny-only group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary SID</auth:DisplayName>
+ <auth:Description>The deny-only primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary group SID</auth:DisplayName>
+ <auth:Description>The deny-only primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group SID</auth:DisplayName>
+ <auth:Description>The group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary group SID</auth:DisplayName>
+ <auth:Description>The primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary SID</auth:DisplayName>
+ <auth:Description>The primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Windows account name</auth:DisplayName>
+ <auth:Description>The domain account name of the user in the form of <domain>\<user>
+ </auth:Description>
+ </auth:ClaimType>
+ </fed:ClaimTypesRequested>
+ <fed:TargetScopes>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedsymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/13/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/13/issuedtokenmixedsymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/ls/</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>http://adfs.example.org/adfs/services/trust</Address>
+ </EndpointReference>
+ </fed:TargetScopes>
+ <fed:ApplicationServiceEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ </fed:ApplicationServiceEndpoint>
+ <fed:PassiveRequestorEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/ls/</Address>
+ </EndpointReference>
+ </fed:PassiveRequestorEndpoint>
+ </RoleDescriptor>
+ <RoleDescriptor xsi:type="fed:SecurityTokenServiceType"
+ protocolSupportEnumeration="http://docs.oasis-open.org/ws-sx/ws-trust/200512 http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/wsfed/federation/200706"
+ ServiceDisplayName="ESUE Authentication Service" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706">
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIC7DCCAdSgAwIBAgIQMI+9q+H5N6RImRB2/fZISzANBgkqhkiG9w0BAQsFADAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwHhcNMTExMDEwMTUxMzIxWhcNMTIxMDA5MTUxMzIxWjAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsQfUzIz7SEqSayXm+M0tVUvd0uX7neM2FKW9fX88BiGjc41NUidIG25Kq30UKHBaCkDW++xHt9ELWxgJAjfMXspCbfxoPoDqgKAUUBizN88JqLIB8NBGqRo4zSfWkVo1VXiouAVtIUrq94BzPOarlIN+TdxJXuwlH3fHzWla [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFkzCCBHugAwIBAgIKER152QAAAAAADDANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjEyMzY1NVoXDTE0MDUxNjEyMzY1NVowga0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSAwHgYDVQQDExdFU1VFIEFERlMgVG9rZW4gU2lnbmluZzCBnzANBgk [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <fed:TokenTypesOffered>
+ <fed:TokenType Uri="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <fed:TokenType Uri="urn:oasis:names:tc:SAML:1.0:assertion" />
+ </fed:TokenTypesOffered>
+ <fed:ClaimTypesOffered>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Given Name</auth:DisplayName>
+ <auth:Description>The given name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name</auth:DisplayName>
+ <auth:Description>The unique name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>UPN</auth:DisplayName>
+ <auth:Description>The user principal name (UPN) of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/CommonName" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Common Name</auth:DisplayName>
+ <auth:Description>The common name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/EmailAddress" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0
+ </auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/Group" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group</auth:DisplayName>
+ <auth:Description>A group that the user is a member of</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/UPN" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x UPN</auth:DisplayName>
+ <auth:Description>The UPN of the user when interoperating with AD FS 1.1 or ADFS 1.0</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Role</auth:DisplayName>
+ <auth:Description>A role that the user has</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Surname</auth:DisplayName>
+ <auth:Description>The surname of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>PPID</auth:DisplayName>
+ <auth:Description>The private identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name ID</auth:DisplayName>
+ <auth:Description>The SAML name identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication time stamp</auth:DisplayName>
+ <auth:Description>Used to display the time and date that the user was authenticated</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication method</auth:DisplayName>
+ <auth:Description>The method used to authenticate the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only group SID</auth:DisplayName>
+ <auth:Description>The deny-only group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary SID</auth:DisplayName>
+ <auth:Description>The deny-only primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary group SID</auth:DisplayName>
+ <auth:Description>The deny-only primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group SID</auth:DisplayName>
+ <auth:Description>The group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary group SID</auth:DisplayName>
+ <auth:Description>The primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary SID</auth:DisplayName>
+ <auth:Description>The primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Windows account name</auth:DisplayName>
+ <auth:Description>The domain account name of the user in the form of <domain>\<user>
+ </auth:Description>
+ </auth:ClaimType>
+ </fed:ClaimTypesOffered>
+ <fed:SecurityTokenServiceEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/certificatemixed</Address>
+ <Metadata>
+ <Metadata xmlns="http://schemas.xmlsoap.org/ws/2004/09/mex"
+ xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex">
+ <wsx:MetadataSection Dialect="http://schemas.xmlsoap.org/ws/2004/09/mex"
+ xmlns="">
+ <wsx:MetadataReference>
+ <Address xmlns="http://www.w3.org/2005/08/addressing">https://adfs.example.org/adfs/services/trust/mex</Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </Metadata>
+ </Metadata>
+ </EndpointReference>
+ </fed:SecurityTokenServiceEndpoint>
+ <fed:PassiveRequestorEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/ls/</Address>
+ </EndpointReference>
+ </fed:PassiveRequestorEndpoint>
+ </RoleDescriptor>
+ <SPSSODescriptor WantAssertionsSigned="true"
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <KeyDescriptor use="encryption">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFljCCBH6gAwIBAgIKEfZv5gAAAAAADTANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjE2MzM1NFoXDTE0MDUxNjE2MzM1NFowgbAxCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSMwIQYDVQQDExpFU1VFIEFERlMgVG9rZW4gRGVjcnlwdGlvbjCBnzA [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIC7DCCAdSgAwIBAgIQMI+9q+H5N6RImRB2/fZISzANBgkqhkiG9w0BAQsFADAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwHhcNMTExMDEwMTUxMzIxWhcNMTIxMDA5MTUxMzIxWjAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsQfUzIz7SEqSayXm+M0tVUvd0uX7neM2FKW9fX88BiGjc41NUidIG25Kq30UKHBaCkDW++xHt9ELWxgJAjfMXspCbfxoPoDqgKAUUBizN88JqLIB8NBGqRo4zSfWkVo1VXiouAVtIUrq94BzPOarlIN+TdxJXuwlH3fHzWla [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFkzCCBHugAwIBAgIKER152QAAAAAADDANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjEyMzY1NVoXDTE0MDUxNjEyMzY1NVowga0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSAwHgYDVQQDExdFU1VFIEFERlMgVG9rZW4gU2lnbmluZzCBnzANBgk [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://adfs.example.org/adfs/ls/" index="0" isDefault="true" />
+ <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Location="https://adfs.example.org/adfs/ls/" index="1" />
+ <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://adfs.example.org/adfs/ls/" index="2" />
+ </SPSSODescriptor>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <KeyDescriptor use="encryption">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFljCCBH6gAwIBAgIKEfZv5gAAAAAADTANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjE2MzM1NFoXDTE0MDUxNjE2MzM1NFowgbAxCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSMwIQYDVQQDExpFU1VFIEFERlMgVG9rZW4gRGVjcnlwdGlvbjCBnzA [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIC7DCCAdSgAwIBAgIQMI+9q+H5N6RImRB2/fZISzANBgkqhkiG9w0BAQsFADAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwHhcNMTExMDEwMTUxMzIxWhcNMTIxMDA5MTUxMzIxWjAyMTAwLgYDVQQDEydBREZTIFNpZ25pbmcgLSBBUzFULmVzdWUub2hpby1zdGF0ZS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsQfUzIz7SEqSayXm+M0tVUvd0uX7neM2FKW9fX88BiGjc41NUidIG25Kq30UKHBaCkDW++xHt9ELWxgJAjfMXspCbfxoPoDqgKAUUBizN88JqLIB8NBGqRo4zSfWkVo1VXiouAVtIUrq94BzPOarlIN+TdxJXuwlH3fHzWla [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <KeyDescriptor use="signing">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFkzCCBHugAwIBAgIKER152QAAAAAADDANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjEyMzY1NVoXDTE0MDUxNjEyMzY1NVowga0xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSAwHgYDVQQDExdFU1VFIEFERlMgVG9rZW4gU2lnbmluZzCBnzANBgk [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://adfs.example.org/adfs/ls/" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="E-Mail Address"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Given Name"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="UPN"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/claims/CommonName"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Common Name"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/claims/EmailAddress"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="AD FS 1.x E-Mail Address"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/claims/Group"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Group"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/claims/UPN"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="AD FS 1.x UPN"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Role"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Surname"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="PPID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Name ID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Authentication time stamp"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Authentication method"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Deny only group SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Deny only primary SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Deny only primary group SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Group SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Primary group SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Primary SID"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ <Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Windows account name"
+ xmlns="urn:oasis:names:tc:SAML:2.0:assertion" />
+ </IDPSSODescriptor>
+</EntityDescriptor>
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-role-descriptor.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-role-descriptor.xml
new file mode 100644
index 000000000..9eb34b5a9
--- /dev/null
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/adfs-role-descriptor.xml
@@ -0,0 +1,173 @@
+<RoleDescriptor xsi:type="fed:ApplicationServiceType"
+ protocolSupportEnumeration="http://docs.oasis-open.org/ws-sx/ws-trust/200512 http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/wsfed/federation/200706"
+ ServiceDisplayName="ESUE Authentication Service" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706">
+ <Extensions>
+ <test:SimpleElement xmlns:test="http://www.example.org/testObjects"/>
+ <test:SimpleElement xmlns:test="http://www.example.org/testObjects"/>
+ <test:SimpleElement xmlns:test="http://www.example.org/testObjects"/>
+ </Extensions>
+ <KeyDescriptor use="encryption">
+ <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+ <X509Data>
+ <X509Certificate>MIIFljCCBH6gAwIBAgIKEfZv5gAAAAAADTANBgkqhkiG9w0BAQUFADBUMRMwEQYKCZImiZPyLGQBGRYDZWR1MRowGAYKCZImiZPyLGQBGRYKb2hpby1zdGF0ZTEUMBIGCgmSJomT8ixkARkWBGVzdWUxCzAJBgNVBAMTAmNhMB4XDTEyMDUxNjE2MzM1NFoXDTE0MDUxNjE2MzM1NFowgbAxCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMREwDwYDVQQHEwhDb2x1bWJ1czEiMCAGA1UEChMZVGhlIE9oaW8gU3RhdGUgVW5pdmVyc2l0eTE2MDQGA1UECwwtRW5yb2xsbWVudCBTZXJ2aWNlcyAmIFVuZGVyZ3JhZHVhdGUgRWR1Y2F0aW9uMSMwIQYDVQQDExpFU1VFIEFERlMgVG9rZW4gRGVjcnlwdGlvbjCBnzANBgk [...]
+ </X509Certificate>
+ </X509Data>
+ </KeyInfo>
+ </KeyDescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en-US">Shibboleth University</OrganizationName>
+ <OrganizationDisplayName xml:lang="en-US">Shibboleth University</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en-US">https://www.shibboleth.net</OrganizationURL>
+ </Organization>
+ <ContactPerson>
+ <Company>Shibboleth University</Company>
+ <EmailAddress>abc123 at shibboleth.net</EmailAddress>
+ </ContactPerson>
+ <fed:ClaimTypesRequested>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Given Name</auth:DisplayName>
+ <auth:Description>The given name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name</auth:DisplayName>
+ <auth:Description>The unique name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>UPN</auth:DisplayName>
+ <auth:Description>The user principal name (UPN) of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/CommonName" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Common Name</auth:DisplayName>
+ <auth:Description>The common name of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/EmailAddress" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x E-Mail Address</auth:DisplayName>
+ <auth:Description>The e-mail address of the user when interoperating with AD FS 1.1 or ADFS 1.0
+ </auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/Group" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group</auth:DisplayName>
+ <auth:Description>A group that the user is a member of</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/claims/UPN" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>AD FS 1.x UPN</auth:DisplayName>
+ <auth:Description>The UPN of the user when interoperating with AD FS 1.1 or ADFS 1.0</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Role</auth:DisplayName>
+ <auth:Description>A role that the user has</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Surname</auth:DisplayName>
+ <auth:Description>The surname of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>PPID</auth:DisplayName>
+ <auth:Description>The private identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Name ID</auth:DisplayName>
+ <auth:Description>The SAML name identifier of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication time stamp</auth:DisplayName>
+ <auth:Description>Used to display the time and date that the user was authenticated</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Authentication method</auth:DisplayName>
+ <auth:Description>The method used to authenticate the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only group SID</auth:DisplayName>
+ <auth:Description>The deny-only group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary SID</auth:DisplayName>
+ <auth:Description>The deny-only primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Deny only primary group SID</auth:DisplayName>
+ <auth:Description>The deny-only primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Group SID</auth:DisplayName>
+ <auth:Description>The group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary group SID</auth:DisplayName>
+ <auth:Description>The primary group SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"
+ Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Primary SID</auth:DisplayName>
+ <auth:Description>The primary SID of the user</auth:Description>
+ </auth:ClaimType>
+ <auth:ClaimType
+ Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" Optional="true"
+ xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706">
+ <auth:DisplayName>Windows account name</auth:DisplayName>
+ <auth:Description>The domain account name of the user in the form of <domain>\<user>
+ </auth:Description>
+ </auth:ClaimType>
+ </fed:ClaimTypesRequested>
+ <fed:TargetScopes>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedsymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/13/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/13/issuedtokenmixedsymmetricbasic256</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/ls/</Address>
+ </EndpointReference>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>http://adfs.example.org/adfs/services/trust</Address>
+ </EndpointReference>
+ </fed:TargetScopes>
+ <fed:ApplicationServiceEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/services/trust/2005/issuedtokenmixedasymmetricbasic256</Address>
+ </EndpointReference>
+ </fed:ApplicationServiceEndpoint>
+ <fed:PassiveRequestorEndpoint>
+ <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
+ <Address>https://adfs.example.org/adfs/ls/</Address>
+ </EndpointReference>
+ </fed:PassiveRequestorEndpoint>
+</RoleDescriptor>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list