[java-plugin-shibd] branch main updated: Add an example filter policy roughly matching old SP default.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=58710be68a1d4d38ed8e49b3eff30ab5a039cab8

The following commit(s) were added to refs/heads/main by this push:
     new 58710be  Add an example filter policy roughly matching old SP default.
58710be is described below

commit 58710be68a1d4d38ed8e49b3eff30ab5a039cab8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 29 14:33:30 2025 -0400

    Add an example filter policy roughly matching old SP default.
---
 .../module/conf/examples/attribute-filter-sp.xml   | 83 ++++++++++++++++++++++
 .../net/shibboleth/sp/conf/module.properties       |  3 +
 2 files changed, 86 insertions(+)

diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/examples/attribute-filter-sp.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/examples/attribute-filter-sp.xml
new file mode 100644
index 0000000..e16c5e3
--- /dev/null
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/examples/attribute-filter-sp.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+This is an EXAMPLE policy for use with the SP plugins that includes some
+basic semantic rules arounud affiliation values and "known" scoped attributes.
+
+The example may be copied over and added to the Attribute Filter's resource
+set via services.xml or the rules copied into an existing policy file.
+
+If you pair this policy (alone) with the sp.saml.acceptUnfilteredAttributes
+property, this can supply the most crucial rules while passing through any
+other decoded IdPAttributes to agent(s).
+
+Alternatively you can add dedicated rules for any/all desired IdPAttributes
+you want to use in your agent(s).
+-->
+<AttributeFilterPolicyGroup id="SP-Filter-Policy"
+        xmlns="urn:mace:shibboleth:2.0:afp"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+
+
+    <AttributeFilterPolicy id="SP-Example-Rules">
+        <PolicyRequirementRule xsi:type="Inbound" />
+
+        <AttributeRule attributeID="eduPersonAffiliation">
+            <PermitValueRule xsi:type="OR">
+                <Rule xsi:type="Value" value="faculty"/>
+                <Rule xsi:type="Value" value="student"/>
+                <Rule xsi:type="Value" value="staff"/>
+                <Rule xsi:type="Value" value="alum"/>
+                <Rule xsi:type="Value" value="member"/>
+                <Rule xsi:type="Value" value="affiliate"/>
+                <Rule xsi:type="Value" value="employee"/>
+                <Rule xsi:type="Value" value="library-walk-in"/>
+            </PermitValueRule>        
+        </AttributeRule>
+        
+        <AttributeRule attributeID="eduPersonScopedAffiliation">
+            <PermitValueRule xsi:type="AND">
+                <Rule xsi:type="ScopeMatchesShibMDScope"/>
+                <Rule xsi:type="OR">
+                    <Rule xsi:type="Value" value="faculty"/>
+                    <Rule xsi:type="Value" value="student"/>
+                    <Rule xsi:type="Value" value="staff"/>
+                    <Rule xsi:type="Value" value="alum"/>
+<!--                    <Rule xsi:type="Value" value="member"/>-->
+                    <Rule xsi:type="Value" value="affiliate"/>
+                    <Rule xsi:type="Value" value="employee"/>
+                    <Rule xsi:type="Value" value="library-walk-in"/>
+                </Rule>
+            </PermitValueRule>        
+        </AttributeRule>
+
+        <AttributeRule attributeID="eduPersonPrincipalName">
+            <PermitValueRule xsi:type="AND">
+                <Rule xsi:type="NOT">
+                    <Rule xsi:type="ValueRegex" regex="@"/>
+                </Rule>
+                <Rule xsi:type="ScopeMatchesShibMDScope"/>
+            </PermitValueRule>
+        </AttributeRule>
+
+        <AttributeRule attributeID="samlSubjectID">
+            <PermitValueRule xsi:type="AND">
+                <Rule xsi:type="NOT">
+                    <Rule xsi:type="ValueRegex" regex="@"/>
+                </Rule>
+                <Rule xsi:type="ScopeMatchesShibMDScope"/>
+            </PermitValueRule>
+        </AttributeRule>
+
+        <AttributeRule attributeID="samlPairwiseID">
+            <PermitValueRule xsi:type="AND">
+                <Rule xsi:type="NOT">
+                    <Rule xsi:type="ValueRegex" regex="@"/>
+                </Rule>
+                <Rule xsi:type="ScopeMatchesShibMDScope"/>
+            </PermitValueRule>
+        </AttributeRule>
+
+    </AttributeFilterPolicy>
+
+</AttributeFilterPolicyGroup>
\ No newline at end of file
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
index 2214794..233c344 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/module.properties
@@ -15,3 +15,6 @@ sp.Core.1.dest = conf/sp/agents.xml
 
 sp.Core.2.src = /net/shibboleth/idp/module/conf/sp/sp.properties
 sp.Core.2.dest = conf/sp/sp.properties
+
+sp.Core.3.src = /net/shibboleth/idp/module/conf/examples/attribute-filter-sp.xml
+so.Core.3.dest = conf/examples/attribute-filter-sp.xml

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.