[java-plugin-shibd-saml] branch main updated: Wire up property for default acceptance of unfiltered attributes.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=382e66e0e6ec086a6500b93333023b24358dbddd

The following commit(s) were added to refs/heads/main by this push:
     new 382e66e  Wire up property for default acceptance of unfiltered attributes.
382e66e is described below

commit 382e66e0e6ec086a6500b93333023b24358dbddd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 23 11:40:56 2025 -0400

    Wire up property for default acceptance of unfiltered attributes.
---
 .../idp/flows/sp/consumer/saml2/saml2-beans.xml     |  1 +
 .../shibboleth/idp/module/conf/sp/saml.properties   |  3 +++
 .../saml2/profile/impl/ExtractSAMLAttributes.java   | 21 ++++++++++++++++++++-
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index dd80fc2..7f2f5d5 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -235,6 +235,7 @@
 
     <bean id="ExtractSAMLAttributes"
         class="net.shibboleth.sp.saml.saml2.profile.impl.ExtractSAMLAttributes" scope="prototype"
+        p:acceptUnfilteredAttributes="%{sp.saml.acceptUnfilteredAttributes:false}"
         p:standardExtractionStrategy-ref="StandardExtractionStrategy" />
         
     <bean id="PrepareAgentResponse"
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index bde7435..27755e0 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -26,6 +26,9 @@ sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
 # Default security configuration for SAML
 #sp.saml.security.config = shibboleth.DefaultXMLSecurityConfiguration
 
+# Set true to accept any decided attributes without a filtering rule
+#sp.saml.acceptUnfilteredAttributes = false
+
 # "Standard" attribute extraction from SAML response/assertion
 #sp.saml.extractStandardAttributes = false
 # Legacy names defaulted into agents
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ExtractSAMLAttributes.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ExtractSAMLAttributes.java
index 93f877b..8d6dbf0 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ExtractSAMLAttributes.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ExtractSAMLAttributes.java
@@ -131,6 +131,9 @@ public class ExtractSAMLAttributes extends AbstractApplicationAction {
     /** Strategy for pulling out "standard" data from the response. */
     @Nullable private Function<SAMLTokenContext,Collection<IdPAttribute>> standardExtractionStrategy;
     
+    /** Whether to accept decoded attributes that no filter rules applied to. */
+    private boolean acceptUnfilteredAttributes;
+    
     /** Context containing the token(s) to process. */
     @NonnullBeforeExec private SAMLTokenContext samlTokenContext;
     
@@ -221,6 +224,21 @@ public class ExtractSAMLAttributes extends AbstractApplicationAction {
         checkSetterPreconditions();
         standardExtractionStrategy = strategy;
     }
+    
+    /**
+     * Set whether to accept decoded {@link IdPAttribute} objects pulled from the assertions if
+     * no filtering rule applied to them.
+     * 
+     * <p>This is a variant of the original SP's "wildcard" rule support to allow non-enumerated
+     * attributes to be accepted.</p>
+     * 
+     * @param flag
+     */
+    public void setAcceptUnfilteredAttributes(final boolean flag) {
+        checkSetterPreconditions();
+        
+        acceptUnfilteredAttributes = flag;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -498,7 +516,8 @@ public class ExtractSAMLAttributes extends AbstractApplicationAction {
             .setProxiedRequesterContextLookupStrategy(null)
             .setAttributeIssuerID(issuerLookupStrategy.apply(profileRequestContext))
             .setAttributeRecipientID(requesterLookupStrategy.apply(profileRequestContext))
-            .setAttributeRecipientGroupID(profileConfiguration.getAttributeRecipientGroupID(profileRequestContext));
+            .setAttributeRecipientGroupID(profileConfiguration.getAttributeRecipientGroupID(profileRequestContext))
+            .setIncludeUnfilteredAttributes(acceptUnfilteredAttributes);
     }
     
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.