[java-identity-provider] branch main updated: JSATTR-6: SAML AttributeQuery DataConnector

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
https://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=92e423222f79cc2422713bfb990ab87af9b14fd7

The following commit(s) were added to refs/heads/main by this push:
     new 92e423222 JSATTR-6: SAML AttributeQuery DataConnector
92e423222 is described below

commit 92e423222f79cc2422713bfb990ab87af9b14fd7
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Nov 5 22:33:45 2025 -0500

    JSATTR-6: SAML AttributeQuery DataConnector
    
    Add custom properties to parser.properties.
    
    Add initial bean dependencies to attribute-resolver-system.xml.
---
 .../idp/conf/attribute-resolver-system.xml         | 65 ++++++++++++++++++++++
 .../net/shibboleth/spring/parser.properties        | 20 ++++++-
 2 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
index 229376bd6..9d44faf9b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
@@ -18,4 +18,69 @@
     <!-- Wildcard import hook for plugins. -->
     <import resource="classpath*:/META-INF/net/shibboleth/idp/service/attribute/resolver/postconfig.xml" />
     
+    <!-- Dependencies of SAML data connector. -->
+    <bean id="shibboleth.SAMLDataConnector.SelfEntityIDResolver" 
+        class="net.shibboleth.profile.relyingparty.impl.CriteriaSelfEntityIDResolver"
+        p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
+    
+    <bean id="shibboleth.SAMLDataConnector.DecryptionConfigurationResolver" 
+        class="net.shibboleth.profile.relyingparty.impl.CriteriaDecryptionConfigurationResolver"
+        p:relyingPartyConfigurationResolver-ref="shibboleth.RelyingPartyResolverService" />
+
+    <bean id="shibboleth.SAMLDataConnector.AssertionValidator" class="org.opensaml.saml.saml2.assertion.SAML20AssertionValidator">
+        <!-- Condition validators. -->
+        <constructor-arg index="0">
+            <util:list>
+                <bean class="org.opensaml.saml.saml2.assertion.impl.AudienceRestrictionConditionValidator" />
+                <bean class="org.opensaml.saml.saml2.assertion.impl.DelegationRestrictionConditionValidator" />
+                <bean class="org.opensaml.saml.saml2.assertion.impl.OneTimeUseConditionValidator">
+                    <constructor-arg ref="shibboleth.ReplayCache" />
+                    <constructor-arg value="#{null}" />
+                </bean>
+                <bean class="org.opensaml.saml.saml2.assertion.impl.ProxyRestrictionConditionValidator" />
+            </util:list>
+        </constructor-arg>
+        <!-- SubjectConfirmation validators. -->
+        <constructor-arg index="1">
+            <util:list>
+                <bean class="org.opensaml.saml.saml2.assertion.impl.BearerSubjectConfirmationValidator" />
+                <bean class="org.opensaml.saml.saml2.assertion.impl.HolderOfKeySubjectConfirmationValidator" />
+            </util:list>
+        </constructor-arg>
+        <!-- Statement validators. -->
+        <constructor-arg index="2" value="#{getObject('%{idp.attribute-resolver.dc.SAML.statementValidators:}'.trim())}" />
+        <!-- Generic AssertionValidator -->
+        <constructor-arg index="3" value="#{getObject('%{idp.attribute-resolver.dc.SAML.assertionValidator:}'.trim())}" />
+        <!-- SignatureTrustEngine  -->
+        <constructor-arg index="4" ref="shibboleth.ChainingSignatureTrustEngine" />
+        <!-- SignaturePrevalidator -->
+        <constructor-arg index="5">
+            <bean class="org.opensaml.saml.security.impl.SAMLSignatureProfileValidator" />
+        </constructor-arg>
+    </bean>
+
+    <bean id="shibboleth.SAMLDataConnector.AssertionValidationContextBuilder"
+          class="org.opensaml.saml.saml2.assertion.messaging.impl.DefaultAssertionValidationContextBuilder">
+        <property name="clockSkew" value="%{idp.policy.clockSkew:PT3M}" />
+        <property name="lifetime" value="%{idp.policy.assertionLifetime:PT3M}" />
+        <property name="requireEntityIssuer">
+            <ref bean="shibboleth.Conditions.TRUE" />
+        </property>
+        <property name="requiredConditions">
+            <set>
+                <util:constant static-field="org.opensaml.saml.saml2.core.AudienceRestriction.DEFAULT_ELEMENT_NAME" />
+            </set>
+        </property>
+        <!-- TODO need predicate impl for IOOC
+        <property name="signatureRequired">
+            <bean parent="shibboleth.Conditions.NOT">
+                <constructor-arg>
+                    <bean class="TODO" />
+                </constructor-arg>
+            </bean>
+        </property>
+        -->
+    </bean>
+        
+    
 </beans>
diff --git a/idp-schema/src/main/resources/META-INF/net/shibboleth/spring/parser.properties b/idp-schema/src/main/resources/META-INF/net/shibboleth/spring/parser.properties
index 1288b99a0..df3b06782 100644
--- a/idp-schema/src/main/resources/META-INF/net/shibboleth/spring/parser.properties
+++ b/idp-schema/src/main/resources/META-INF/net/shibboleth/spring/parser.properties
@@ -18,4 +18,22 @@ net.shibboleth.spring.metadata.AbstractDynamicMetadataProviderParser.ParserPool.
 net.shibboleth.spring.metadata.AbstractMetadataProviderParser.ByReferenceMetadataFilterBridge.bean = shibboleth.ByReferenceMetadataFilterBridge
 net.shibboleth.spring.metadata.AbstractMetadataProviderParser.AutoWiredNodeProcessingMetadataFilter.bean = shibboleth.AutoWiredNodeProcessingMetadataFilter
 
-net.shibboleth.spring.metadata.filter.SchemaValidationParser.SchemaBuilder.bean = shibboleth.SchemaBuilder
\ No newline at end of file
+net.shibboleth.spring.metadata.filter.SchemaValidationParser.SchemaBuilder.bean = shibboleth.SchemaBuilder
+
+
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.EndpointResolver.bean= shibboleth.EndpointResolver
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.RoleDescriptorResolver.bean= shibboleth.RoleDescriptorResolver
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.IdentifierGenerationStrategy.bean= shibboleth.DefaultIdentifierGenerationStrategy
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.SOAPClient.bean= shibboleth.SOAPClient.SAML
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.SOAPPipelineName.value = SAML2.AttributeQuery
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.SOAPClientSecurityConfigurationProfileId.value = http://shibboleth.net/ns/profiles/saml2/query/attribute
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.DecryptionParametersResolver.bean= shibboleth.DecryptionParametersResolver
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.DecryptionConfigurationResolver.bean= shibboleth.SAMLDataConnector.DecryptionConfigurationResolver
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.DecryptionSecurityConfigurationProfileId.value = http://shibboleth.net/ns/profiles/saml2/query/attribute
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.AssertionValidationContextBuilder.bean= shibboleth.SAMLDataConnector.AssertionValidationContextBuilder
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.AssertionValidator.bean= shibboleth.SAMLDataConnector.AssertionValidator
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.AttributeTranscoderRegistry.bean= shibboleth.AttributeRegistryService
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.AttributeFilterService.bean= shibboleth.AttributeFilterService
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.AbstractSAMLDataConnectorParser.MetadataResolver.bean= shibboleth.MetadataResolver
+
+net.shibboleth.idp.attribute.resolver.spring.dc.saml.impl.SimpleAggregationSAMLDataConnectorParser.SelfEntityIDResolver.bean = shibboleth.SAMLDataConnector.SelfEntityIDResolver 
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.