[java-plugin-shibd-saml] branch main updated: JSHIBD-18 - Automate population of flows, profiles, etc.
Codeberg
noreply at shibboleth.net
Thu Jan 15 20:08:40 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/bb384a9096a6a2d817ac83d2afc55cf1aa55fe31
The following commit(s) were added to refs/heads/main by this push:
new bb384a9 JSHIBD-18 - Automate population of flows, profiles, etc.
bb384a9 is described below
commit bb384a9096a6a2d817ac83d2afc55cf1aa55fe31
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 15 15:08:27 2026 -0500
JSHIBD-18 - Automate population of flows, profiles, etc.
https://shibboleth.atlassian.net/browse/JSHIBD-18
Added automatic injecting of profile configurations.
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 18 +++++++---
.../shibboleth/idp/module/conf/sp/saml.properties | 2 +-
.../net/shibboleth/idp/module/conf/sp/agents.xml | 41 +++++++++++-----------
.../idp/module/conf/sp/saml-test-agents.xml | 40 +++++++++++----------
.../shibboleth/idp/module/conf/sp/sp.properties | 2 ++
5 files changed, 59 insertions(+), 44 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 85fe66a..1bae617 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -19,10 +19,20 @@
<!-- Auto-wired protocol service support bean for use by parent plugin. -->
<bean class="net.shibboleth.sp.BasicProtocolSupportService"
- p:id="SAML2"
- p:order="%{sp.saml.relativeOrder:1}"
- p:sessionInitiators="saml2"
- p:tokenConsumers="#{{ 'saml2/post', 'saml2/post-simplesign', 'saml2/artifact' }}" />
+ p:id="SAML2"
+ p:order="%{sp.saml.relativeOrder:1}"
+ p:sessionInitiators="saml2"
+ p:tokenConsumers="#{{ 'saml2/post', 'saml2/post-simplesign', 'saml2/artifact' }}">
+ <property name="defaultProfileConfigurations">
+ <list>
+ <ref bean="SAML2.SSO" />
+ </list>
+ </property>
+ <property name="metadataDrivenDefaultProfileConfigurations">
+ <list>
+ </list>
+ </property>
+ </bean>
<!--
Auto-wiring exposers for credentials to get them loaded into the agent resolver.
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index 95f5343..b07e5a5 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -10,7 +10,7 @@ sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
#sp.saml.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
#sp.saml.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
-# Profile defaults, can be overridden globally or per-Agent/Application/IdP
+# Global profile defaults
#sp.saml.encryption.optional = true
# TODO: The next two are global only at the moment.
#sp.saml.checkRecipient = true
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 64379dd..ef2305d 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -32,26 +32,6 @@
<bean p:id="localhost" parent="shibboleth.sp.Agent" p:credentials="#{ {null : 'foo'} }" />
- <!-- ============ Profile defaults ============ -->
-
- <!-- Used for all applications by default to provide a baseline for profile settings. -->
-
- <util:list id="shibboleth.sp.DefaultProfileConfigurations">
- <!-- Your profiles here. -->
- <bean parent="SAML2.SSO" p:checkAddress="false" p:checkInResponseTo="false" />
- </util:list>
-
-
- <!--
- Unverified RP configuration, defaults to no support for any profiles.
-
- "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
- legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
- -->
- <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
- <!-- Your profiles here. -->
- </util:list>
-
<!-- ============ RelyingParty Overrides ============ -->
<!--
@@ -64,6 +44,27 @@
<!-- Your RelyingParty overrides here. -->
</util:list>
+
+ <!-- ============ Overridden Profile Configuration Defaults ============ -->
+
+ <!--
+ The Hub auto-enables all profiles supplied by any plugins installed for you.
+ Uncommenting and defining these lists will override the default sets and apply them to
+ every Agent/Application for you, if you do not also override the individual properties.
+
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the
+ identity and legitimacy of an authenticating system. Some profiles are designed to operate
+ this way, usually to expose public information about the system.
+ -->
+
+ <!--
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
+ </util:list>
+
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ </util:list>
+ -->
+
<import resource="saml-credentials.xml" />
</beans>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
index 2cf6754..69a7943 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/saml-test-agents.xml
@@ -67,25 +67,6 @@
<ref bean="SAML2.Logout" />
</util:list>
- <!-- ============ Profile defaults ============ -->
-
- <!-- Used for all applications by default to provide a baseline for profile settings. -->
-
- <util:list id="shibboleth.sp.DefaultProfileConfigurations">
- <!-- Your profiles here. -->
- <ref bean="SAML2.SSO" />
- </util:list>
-
-
- <!--
- Unverified RP configuration, defaults to no support for any profiles.
-
- "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the identity and
- legitimacy of an authenticating system. Some profiles may simply be designed to operate this way.
- -->
- <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
- <!-- Your profiles here. -->
- </util:list>
<!-- ============ RelyingParty Overrides ============ -->
@@ -99,4 +80,25 @@
<!-- Your RelyingParty overrides here. -->
</util:list>
+
+ <!-- ============ Overridden Profile Configuration Defaults ============ -->
+
+ <!--
+ The Hub auto-enables all profiles supplied by any plugins installed for you.
+ Uncommenting and defining these lists will override the default sets and apply them to
+ every Agent/Application for you, if you do not also override the individual properties.
+
+ "Unverified" typically means the Hub has no metadata, or equivalent way of assuring the
+ identity and legitimacy of an authenticating system. Some profiles are designed to operate
+ this way, usually to expose public information about the system.
+ -->
+
+ <!--
+ <util:list id="shibboleth.sp.DefaultProfileConfigurations">
+ </util:list>
+
+ <util:list id="shibboleth.sp.UnverifiedProfileConfigurations">
+ </util:list>
+ -->
+
</beans>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 46fb7cb..f5395be 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -9,6 +9,8 @@ sp.defaultAuthority = https://idp.example.org
#sp.service.agents.resources = shibboleth.sp.AgentResolverResources
#sp.service.agents.failFast = false
sp.service.agents.checkInterval = PT5M
+# Set to true for defaulted profile configs to be metadata-driven/aware
+#sp.service.agents.useMetadataDrivenProfiles = false
# General SP cookie properties
#sp.cookie.secure = true
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list