[java-plugin-shibd-saml] branch main updated: JSHIBD-18 - Automate population of initiator and token consumer flows
Codeberg
noreply at shibboleth.net
Wed Jan 14 18:01:25 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/a94105c3b3ff562b80c0634f90f78c9319308dd6
The following commit(s) were added to refs/heads/main by this push:
new a94105c JSHIBD-18 - Automate population of initiator and token consumer flows
a94105c is described below
commit a94105c3b3ff562b80c0634f90f78c9319308dd6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 14 13:01:13 2026 -0500
JSHIBD-18 - Automate population of initiator and token consumer flows
https://shibboleth.atlassian.net/browse/JSHIBD-18
Add protocol support service bean to supply default flows.
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 7 +-
.../shibboleth/idp/module/conf/sp/sp.properties | 105 ++++++++++++++++++---
2 files changed, 98 insertions(+), 14 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index ea8cce3..0c00be8 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -15,8 +15,13 @@
<context:annotation-config/>
<!-- Import parent beans for metadata-driven configuration approach. -->
-<!-- <import resource="relying-party-mddriven.xml" /> -->
+<!-- <import resource="agents-system-mddriven.xml" /> -->
+ <!-- Auto-wired protocol service support bean for use by parent plugin. -->
+ <bean class="net.shibboleth.sp.BasicProtocolSupportService"
+ p:id="SAML2"
+ p:sessionInitiators="saml2"
+ p:tokenConsumers="#{{ 'saml2/post', 'saml2/post-simplesign', 'saml2/artifact' }}" />
<!--
Auto-wiring exposers for credentials to get them loaded into the agent resolver.
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 1a0c136..46fb7cb 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -10,18 +10,6 @@ sp.defaultAuthority = https://idp.example.org
#sp.service.agents.failFast = false
sp.service.agents.checkInterval = PT5M
-# Default agent IP address filter
-#sp.agent.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
-# Set to basic for shared secret authentication
-#sp.agent.authn.method =
-# Set false to globally disable cookie-based authentication by agents
-#sp.agent.authn.cached = true
-#sp.agent.authn.cacheDuration = PT1H
-
-# Default precedence/set of Session Initiator and Token Consumer flows to attempt
-sp.application.sessionInitiators = saml2, disco
-sp.application.tokenConsumers = saml2/artifact, saml2/post, saml2/post-simplesign
-
# General SP cookie properties
#sp.cookie.secure = true
#sp.cookie.httpOnly = true
@@ -34,6 +22,7 @@ sp.application.tokenConsumers = saml2/artifact, saml2/post, saml2/post-simplesig
#sp.cookie.limit = 10
# Default state token management (SAML RelayState, etc.)
+#sp.stateToken.errorsFatal = false
# Set to shibboleth.sp.CookieStateTokenManager to switch to cookie-based mechanism
#sp.stateToken.Manager = shibboleth.sp.StorageStateTokenManager
# Controls storage back-end for storage-based state tokens
@@ -44,10 +33,100 @@ sp.application.tokenConsumers = saml2/artifact, saml2/post, saml2/post-simplesig
# Request/response correlation control
#sp.correlation.cookiePrefix = __Host-shibsp_req_
+# POST data preservation controls
+#sp.postData.preservation = false
+#sp.postData.limit = 1048576
+#sp.postData.lifetime = PT5M
+#sp.postData.cookiePrefix = __Host-shibsp_post_
+#sp.postData.StorageService = shibboleth.StorageService
+#sp.postData.errorsFatal = false
+
# Uncomment/set to define a default IdP discovery service URL or Function
-sp.discoveryURL = https://test.shibboleth.net/shibboleth-ds/index.html
+#sp.discoveryURL =
#sp.discoveryURLFunction =
# Settings for Hub-mediated session storage
#sp.session.storageService =
#sp.session.maxStorageTimeout = P1D
+
+###############################
+# Agent Authentication Settings
+###############################
+
+# Default agent IP address filter
+#sp.agent.authn.allowedAddressRanges = 127.0.0.1/32, ::1/128
+# Set to basic for shared secret authentication
+#sp.agent.authn.method =
+# Set false to globally disable cookie-based authentication by agents
+#sp.agent.authn.cached = true
+#sp.agent.authn.cacheDuration = PT1H
+
+
+# Properties exist for optional "enterprise" agent secret validation. Most of them
+# are for LDAP, replicating the large range of properties available in the IdP "proper"
+# but kept separate for flexibility. They are "chained" to the IdP properties in most
+# cases for convenience but can be overridden if necessary.
+
+#sp.agent.authn.JAAS.loginConfigNames = ShibSPAgentAuth
+#sp.agent.authn.JAAS.loginConfig = %{idp.home}/conf/sp/jaas.config
+
+#sp.agent.authn.Krb5.servicePrincipal =
+#sp.agent.authn.Krb5.keytab =
+
+## Authenticator strategy,
+# either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
+#sp.agent.authn.LDAP.authenticator = %{idp.authn.LDAP.authenticator:anonSearchAuthenticator}
+
+## Connection properties ##
+#sp.agent.authn.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL:ldap://localhost:10389}
+#sp.agent.authn.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
+# Time to wait for startTLS responses
+#sp.agent.authn.LDAP.startTLSTimeout = %{idp.authn.LDAP.startTLSTimeout:PT3S}
+# Time to wait for connections to open
+#sp.agent.authn.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
+# Time to wait for operation responses (e.g. search, bind)
+#sp.agent.authn.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
+# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
+#sp.agent.authn.LDAP.connectionStrategy = %{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}
+
+## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
+#sp.agent.authn.LDAP.sslConfig = %{idp.authn.LDAP.sslConfig:certificateTrust}
+## If using certificateTrust above, set to the trusted certificate's path
+#sp.agent.authn.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:%{idp.home}/credentials/ldap-server.crt}
+## If using keyStoreTrust above, set to the truststore path
+#sp.agent.authn.LDAP.trustStore = %{idp.authn.LDAP.trustStore:%{idp.home}/credentials/ldap-server.truststore}
+
+## Return attributes during authentication
+# Setting this property will cause entry resolution to occur as part of authentication
+# Note that this property is not compatible with the adAuthenticator
+#sp.agent.authn.LDAP.returnAttributes = %{idp.authn.LDAP.returnAttributes:1.1}
+
+## DN resolution properties ##
+
+# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
+# for AD: CN=Users,DC=example,DC=org
+#sp.agent.authn.LDAP.baseDN = %{idp.authn.LDAP.baseDN:ou=people,dc=example,dc=org}
+#sp.agent.authn.LDAP.subtreeSearch = %{idp.authn.LDAP.subtreeSearch:false}
+#sp.agent.authn.LDAP.userFilter = %{idp.authn.LDAP.userFilter:undefined}
+# bind search configuration
+# for AD: sp.agent.authn.LDAP.bindDN=adminuser at domain.com
+#sp.agent.authn.LDAP.bindDN = %{idp.authn.LDAP.bindDN:uid=myservice,ou=system}
+
+# Format DN resolution, used by directAuthenticator, adAuthenticator
+# for AD use sp.agent.authn.LDAP.dnFormat=%s at domain.com
+#sp.agent.authn.LDAP.dnFormat = %{idp.authn.LDAP.dnFormat:uid=%s,ou=people,dc=example,dc=org}
+
+# pool passivator, either none, bind or anonymousBind
+#sp.agent.authn.LDAP.bindPoolPassivator = %{idp.authn.LDAP.bindPoolPassivator:none}
+
+# LDAP pool configuration, used for both authn and DN resolution
+#sp.agent.authn.pool.LDAP.minSize = %{idp.authn.pool.LDAP.minSize:3}
+#sp.agent.authn.pool.LDAP.maxSize = %{idp.authn.pool.LDAP.maxSize:10}
+#sp.agent.authn.pool.LDAP.validateOnCheckout = %{idp.authn.pool.LDAP.validateOnCheckout:false}
+#sp.agent.authn.pool.LDAP.validatePeriodically = %{idp.authn.pool.LDAP.validatePeriodically:true}
+#sp.agent.authn.pool.LDAP.validatePeriod = %{idp.authn.pool.LDAP.validatePeriod:PT5M}
+#sp.agent.authn.pool.LDAP.validateDN = %{idp.authn.pool.LDAP.validateDN:}
+#sp.agent.authn.pool.LDAP.validateFilter = %{idp.authn.pool.LDAP.validateFilter:(objectClass=*)}
+#sp.agent.authn.pool.LDAP.prunePeriod = %{idp.authn.pool.LDAP.prunePeriod:PT5M}
+#sp.agent.authn.pool.LDAP.idleTime = %{idp.authn.pool.LDAP.idleTime:PT10M}
+#sp.agent.authn.pool.LDAP.blockWaitTime = %{idp.authn.pool.LDAP.blockWaitTime:PT3S}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list