[java-identity-provider] branch main updated: Add a few NameID decoding rules OOB.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d070ebb1370e1f4ef8fc9960f4f07ce5cbd99ec8

The following commit(s) were added to refs/heads/main by this push:
     new d070ebb13 Add a few NameID decoding rules OOB.
d070ebb13 is described below

commit d070ebb1370e1f4ef8fc9960f4f07ce5cbd99ec8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Sep 24 15:45:14 2025 -0400

    Add a few NameID decoding rules OOB.
---
 .../idp/module/conf/attributes/samlSubject.xml     | 74 +++++++++++++++++++++-
 1 file changed, 71 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/attributes/samlSubject.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/attributes/samlSubject.xml
index 3ffa3ccf9..6b6a994b8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/attributes/samlSubject.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/attributes/samlSubject.xml
@@ -13,12 +13,16 @@
        default-destroy-method="destroy">
 
     <!--
-    Note that all built-in rules rely on URI-naming and thus include the implied settings:
-    
+    Note that all built-in Attribute rules rely on URI-naming and thus include the implied settings:
     <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:attrname-format:uri</prop>
+    
+    NameID rules are decode-only and apply primarily to SAML proxying as well as future SP plugins.
     -->
 
-    <!-- https://wiki.oasis-open.org/security/SAMLSubjectIDAttr -->
+    <!--
+    http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
+    https://wiki.oasis-open.org/security/SAMLSubjectIDAttr
+    -->
 
     <bean parent="shibboleth.TranscodingRuleLoader">
     <constructor-arg>
@@ -66,6 +70,70 @@
             </property>
         </bean>
 
+        <!-- The most common SAML NameID Formats encountered in the wild. -->
+
+        <bean parent="shibboleth.TranscodingProperties">
+            <property name="properties">
+                <props merge="true">
+                    <prop key="id">persistent-id</prop>
+                    <prop key="transcoder">SAML2StringNameIDTranscoder</prop>
+                    <prop key="encoder">false</prop>
+                    <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</prop>
+                    <prop key="saml2.defaultQualifiers">true</prop>
+                    <prop key="saml2.valueTemplate">$Name!!$NameQualifier!!$SPNameQualifier</prop>
+                    <prop key="displayName.en">Persistent ID</prop>
+                    <prop key="displayName.de">Persistent ID</prop>
+                    <prop key="displayName.fr">Persistent ID</prop>
+                    <prop key="displayName.it">Persistent ID</prop>
+                    <prop key="displayName.ja">ペアワイズID</prop>
+                    <prop key="description.en">Persistent ID: A unique identifier for a person, different for each service provider</prop>
+                    <prop key="description.de">Persistent ID: Eindeutige Benutzeridentifikation, unterschiedlich pro Service Provider</prop>
+                    <prop key="description.de-ch">Persistent ID: Eindeutige Benützeridentifikation, unterschiedlich pro Service Provider</prop>
+                    <prop key="description.fr">Persistent ID: Un identifiant unique de l'utilisateur, différent pour chaque fournisseur de service</prop>
+                    <prop key="description.it">Persistent ID: identificativo unico della persona, differente per ogni fornitore di servizio</prop>
+                    <prop key="description.ja">フェデレーション内で一意かつSP毎に送出される値が異なる利用者識別子(eduPersonTargetedIDの後継)</prop>
+                </props>
+            </property>
+        </bean>
+
+        <bean parent="shibboleth.TranscodingProperties">
+            <property name="properties">
+                <props merge="true">
+                    <prop key="id">mail</prop>
+                    <prop key="transcoder">SAML2StringNameIDTranscoder</prop>
+                    <prop key="encoder">false</prop>
+                    <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</prop>
+                    <prop key="saml2.defaultQualifiers">false</prop>
+                    <prop key="saml2.valueTemplate">$Name</prop>
+                    <prop key="displayName.en">E-mail</prop>
+                    <prop key="displayName.de">E-Mail</prop>
+                    <prop key="displayName.fr">Email</prop>
+                    <prop key="displayName.it">E-mail</prop>
+                    <prop key="displayName.ja">メールアドレス</prop>
+                    <prop key="description.en">E-Mail: Preferred address for e-mail to be sent to this person</prop>
+                    <prop key="description.de">E-Mail-Adresse</prop>
+                    <prop key="description.de-ch">E-Mail Adresse</prop>
+                    <prop key="description.fr">Adresse de courrier électronique</prop>
+                    <prop key="description.it">E-Mail: l'indirizzo e-mail preferito dall'utente</prop>
+                    <prop key="description.ja">メールアドレス</prop>
+                </props>
+            </property>
+        </bean>
+
+        <bean parent="shibboleth.TranscodingProperties">
+            <property name="properties">
+                <props merge="true">
+                    <prop key="id">distinguishedName</prop>
+                    <prop key="transcoder">SAML2StringNameIDTranscoder</prop>
+                    <prop key="encoder">false</prop>
+                    <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</prop>
+                    <prop key="saml2.defaultQualifiers">false</prop>
+                    <prop key="saml2.valueTemplate">$Name</prop>
+                    <prop key="displayName.en">Distinguished name</prop>
+                </props>
+            </property>
+        </bean>
+
     </list>
     </constructor-arg>
     </bean>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.