[java-identity-provider] branch main updated: Wire in property to allow wildcard acceptance when proxying.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/ec5596ab6eeb43dce73d74cdf4ca122a471d2738

The following commit(s) were added to refs/heads/main by this push:
     new ec5596ab6 Wire in property to allow wildcard acceptance when proxying.
ec5596ab6 is described below

commit ec5596ab6eeb43dce73d74cdf4ca122a471d2738
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 14 20:53:16 2026 -0500

    Wire in property to allow wildcard acceptance when proxying.
---
 .../shibboleth/idp/flows/authn/saml-authn-beans.xml |  1 +
 .../idp/module/conf/authn/authn.properties          |  4 +++-
 .../profile/impl/ValidateSAMLAuthentication.java    | 21 ++++++++++++++++++++-
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 4e60153d2..213264ea1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -459,6 +459,7 @@
         p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"        
         p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}"
         p:decodeNameID="%{idp.authn.SAML.decodeNameID:false}"
+        p:acceptUnfilteredAttributes="%{idp.authn.SAML.acceptUnfilteredAttributes:false}"
         p:loggedAttributeId="%{idp.authn.SAML.loggedAttributeId:}" />
 
     <bean id="UsableC14NFlows" parent="shibboleth.CommaDelimStringArray" c:_0="%{idp.authn.SAML.c14n.flows:}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
index 5c7302309..59c96c4e9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/authn.properties
@@ -225,7 +225,9 @@ idp.authn.IPAddress.supportedPrincipals = \
 #idp.authn.SAML.proxyEntityID = https://idp.example.org/idp/shibboleth
 #idp.authn.SAML.discoveryRequired = true
 # Apply registry rules to decode NameID(s)
-idp.authn.SAML.decodeNameID = true
+#idp.authn.SAML.decodeNameID = false
+# Accept decoded attributes not referenced by filter policies 
+#idp.authn.SAML.acceptUnfilteredAttributes = false
 # Optionally specify list of c14n beans to apply
 #idp.authn.SAML.c14n.flows =
 # Generally left false with bidirectional mappings in
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index ecf6a8341..f24a842f9 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -130,6 +130,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
 
     /** Whether to apply transcoder registry to NameID elements. */
     private boolean decodeNameID;
+
+    /** Whether to accept decoded attributes that no filter rules applied to. */
+    private boolean acceptUnfilteredAttributes;
     
     /** An IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes. */
     @Nullable @NotEmpty private String loggedAttributeId;
@@ -225,6 +228,21 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         decodeNameID = flag;
     }
     
+    /**
+     * Set whether to accept decoded {@link IdPAttribute} objects pulled from the assertions if
+     * no filtering rule applied to them.
+     * 
+     * <p>This is a variant of the original SP's "wildcard" rule support to allow non-enumerated
+     * attributes to be accepted.</p>
+     * 
+     * @param flag
+     */
+    public void setAcceptUnfilteredAttributes(final boolean flag) {
+        checkSetterPreconditions();
+        
+        acceptUnfilteredAttributes = flag;
+    }
+    
     /**
      * Set an attribute ID to pull a "name" from for logging purposes.
      * 
@@ -626,7 +644,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
     }
     
     /**
-     * Check for inbound attributes and apply filtering.
+     * Filter inbound attributes.
      * 
      * @param profileRequestContext current profile request context
      */
@@ -668,6 +686,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         filterContext.setDirection(Direction.INBOUND)
             .setPrefilteredIdPAttributes(ac.getUnfilteredIdPAttributes())
+            .setIncludeUnfilteredAttributes(acceptUnfilteredAttributes)
             .setMetadataResolver(metadataResolver)
             .setRequesterMetadataContextLookupStrategy(null)
             .setIssuerMetadataContextLookupStrategy(

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.