[java-identity-provider] branch main updated: Simplify default config for new installs.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=eb751e32cadc2074202808951cebe2d67b8e801f

The following commit(s) were added to refs/heads/main by this push:
     new eb751e32c Simplify default config for new installs.
eb751e32c is described below

commit eb751e32cadc2074202808951cebe2d67b8e801f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 3 10:10:12 2025 -0500

    Simplify default config for new installs.
---
 .../idp/module/conf/c14n/subject-c14n.xml          | 43 ++++------------------
 1 file changed, 7 insertions(+), 36 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/c14n/subject-c14n.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/c14n/subject-c14n.xml
index b354535d2..1b514774a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/c14n/subject-c14n.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/c14n/subject-c14n.xml
@@ -15,48 +15,19 @@
     <!-- ========================= Java Subject -> Principal Mapping ========================= -->
 
     <!--
-    These are lists of Subject Canonicalization flows that turn complex Subject data into a string-based
-    principal name that the rest of the IdP can operate on. They're used primarily after authentication
-    and also during less common operations like SAML attribute queries, to map the SAML Subject into a
-    principal name.
+    Most of the simple settings that configure these features are in subject-c14n.properties.
     
-    Flows are identified with an ID that corresponds to a Spring Web Flow subflow name.
-    
-    Most of the simple settings that configure these flows are in subject-c14n.properties.
+    You can override/extend/supplement the built-in c14n flow settings by defining additional
+    descriptors in this file, which allows for example the use of multiple "copies" of the same
+    underlying implementations to be configured to run at the same time. See docs for details.
     -->
 
     <!--
-    ====================================================================
-    Flows used after authentication to produce canonical principal name.
-    ====================================================================
+    This is now a legacy bean left in place for compatibility with pre-5.2 plugins and configurations.
+    Authentication flows can directly control which free-standing c14n flows to use via new properties
+    of the form "idp.authn.Password.c14n.flows", etc. See documentation for details.
     -->
     <util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows">
-        <!--
-        This is an advanced post-login step that performs attribute resolution and then produces a username
-        from an attribute value. To enable universally, just uncomment, but if you want it to run under more
-        specific conditions, set an activationCondition property to a condition to apply. 
-        -->
-        <!-- <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /> -->
-
-        <!--
-        This is an advanced option for use with SAML 2 proxy authentication to a second IdP that
-        derives the principal name semi-directly from the incoming NameID value. It is functionally
-        akin to the c14n/SAML2Transform flow for SAML Request scenarios, but separately defined so
-        a suitably restrictive format list and/or condition can be applied to it. 
-        -->
-        <!-- <ref bean="c14n/SAML2ProxyTransform" /> -->
-
-        <!--
-        This is an alternative that handles Subjects containing an X500Principal object and
-        allows extraction from the DN.
-        -->
-        <ref bean="c14n/x500" />
-
-        <!--
-        This is the standard post-login step that returns a username derived from the login process. If you
-        have more complex needs such as mapping a certificate DN into a principal name, an alternative may
-        be required such as that above, but you can use this for simple transforms.
-        -->
         <ref bean="c14n/simple" />
     </util:list>
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.