[java-plugin-shibd-saml] 03/03: Finalize and clean up audit extractors, deal with NameIDs separately.
Codeberg
noreply at shibboleth.net
Wed Jul 1 14:24:52 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/03424e2c7fc2512ab2a5ba221a74b68dcd51a548
commit 03424e2c7fc2512ab2a5ba221a74b68dcd51a548
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Jul 1 10:24:32 2026 -0400
Finalize and clean up audit extractors, deal with NameIDs separately.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 116 ++++++++-------------
.../idp/flows/sp/consumer/saml2/saml2-flow.xml | 1 +
.../idp/flows/sp/initiator/saml2/saml2-flow.xml | 3 +-
.../flows/sp/logout/consumer/saml2/saml2-beans.xml | 3 -
.../flows/sp/logout/consumer/saml2/saml2-flow.xml | 2 +-
.../flows/sp/logout/initiator/saml2/saml2-flow.xml | 1 +
.../shibboleth/idp/flows/sp/saml2-common-beans.xml | 6 ++
7 files changed, 55 insertions(+), 77 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index a376066..19711e1 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -289,6 +289,18 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SESSION_INDEX"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SessionIndexAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
@@ -537,42 +549,6 @@
</constructor-arg>
</bean>
</entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
- </key>
- <bean class="net.shibboleth.idp.saml.audit.impl.NameIDAuditExtractor">
- <constructor-arg>
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </constructor-arg>
- </bean>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
- </key>
- <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
- <constructor-arg>
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </constructor-arg>
- </bean>
- </entry>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
- </key>
- <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
- <constructor-arg>
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Outbound" />
- </constructor-arg>
- </bean>
- </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.IS_PASSIVE"/>
@@ -875,9 +851,9 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_COUNT"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.NameIDAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
@@ -887,9 +863,9 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_AUDIENCE"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyAudienceAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
@@ -899,21 +875,33 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <bean class="net.shibboleth.profile.audit.impl.AttributesAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ c:g-ref="shibboleth.ChildLookup.AttributeContext">
+ <constructor-arg name="f">
+ <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.sp.saml.saml2.context.SAMLTokenContext) }" />
+ </constructor-arg>
+ </bean>
</constructor-arg>
</bean>
</entry>
+ </map>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.sp.saml.InboundNameIDAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_COUNT"/>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
@@ -923,9 +911,9 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_AUDIENCE"/>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.ProxyAudienceAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
@@ -935,17 +923,13 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
</key>
- <bean class="net.shibboleth.profile.audit.impl.AttributesAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.AttributeContext">
- <constructor-arg name="f">
- <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
- c:type="#{ T(net.shibboleth.sp.saml.saml2.context.SAMLTokenContext) }" />
- </constructor-arg>
- </bean>
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
</constructor-arg>
</bean>
</entry>
@@ -953,22 +937,10 @@
</property>
</bean>
- <bean id="shibboleth.sp.saml.InboundLogoutRequestAuditExtractors" lazy-init="true"
+ <bean id="shibboleth.sp.saml.DefaultOutboundNameIDAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
- <entry>
- <key>
- <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SESSION_INDEX"/>
- </key>
- <bean class="net.shibboleth.idp.saml.audit.impl.SessionIndexAuditExtractor">
- <constructor-arg>
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
- </constructor-arg>
- </bean>
- </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
@@ -977,7 +949,7 @@
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</constructor-arg>
</bean>
</entry>
@@ -989,7 +961,7 @@
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</constructor-arg>
</bean>
</entry>
@@ -1001,7 +973,7 @@
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.SAMLObject"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</constructor-arg>
</bean>
</entry>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index 55c42c5..47efa6e 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -37,6 +37,7 @@
<evaluate expression="ValidateAssertions" />
<evaluate expression="ProcessAssertionsForAuthentication" />
<evaluate expression="DecryptNameIDs" />
+ <evaluate expression="InboundNameIDPopulateAuditContext" />
<evaluate expression="DecryptAttributes" />
<evaluate expression="ExtractSAMLAttributes" />
<evaluate expression="AssertionPopulateAuditContext" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
index 87ac46f..f30a7f0 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
@@ -26,12 +26,13 @@
<evaluate expression="PopulateEncryptionParameters" />
<evaluate expression="AddAuthnRequest" />
+ <evaluate expression="OutboundNameIDPopulateAuditContext" />
<evaluate expression="EncryptNameIDs" />
<evaluate expression="HandleOutboundMessage" />
<evaluate expression="PreserveRelayState" />
- <evaluate expression="PreservePostData" />
<evaluate expression="OutboundRequestPopulateAuditContext" />
+ <evaluate expression="PreservePostData" />
<evaluate expression="EncodeMessage" />
<evaluate expression="'proceed'" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
index 99451ec..104cbef 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
@@ -181,9 +181,6 @@
<bean id="DecryptNameIDs" class="org.opensaml.saml.saml2.profile.impl.DecryptNameIDs" scope="prototype" />
- <bean id="InboundLogoutRequestPopulateAuditContext" parent="shibboleth.sp.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.sp.saml.InboundLogoutRequestAuditExtractors') ?: getObject('shibboleth.sp.saml.DefaultInboundLogoutRequestAuditExtractors')}" />
-
<bean id="ProcessLogoutRequest"
class="net.shibboleth.sp.saml.saml2.profile.impl.ProcessLogoutRequest" scope="prototype"
p:parserPool-ref="shibboleth.ParserPool"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
index 47a73e8..e3c661d 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-flow.xml
@@ -58,7 +58,7 @@
<action-state id="DoLogoutRequest">
<evaluate expression="PopulateDecryptionParameters" />
<evaluate expression="DecryptNameIDs" />
- <evaluate expression="InboundLogoutRequestPopulateAuditContext" />
+ <evaluate expression="InboundNameIDPopulateAuditContext" />
<evaluate expression="ProcessLogoutRequest" />
<evaluate expression="'proceed'" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/initiator/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/initiator/saml2/saml2-flow.xml
index 3ccb229..4f6fc04 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/initiator/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/initiator/saml2/saml2-flow.xml
@@ -26,6 +26,7 @@
<evaluate expression="PopulateEncryptionParameters" />
<evaluate expression="AddLogoutRequest" />
+ <evaluate expression="OutboundNameIDPopulateAuditContext" />
<evaluate expression="EncryptNameIDs" />
<evaluate expression="HandleOutboundMessage" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml
index a44d7ae..c29bb3d 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml
@@ -42,6 +42,12 @@
</property>
</bean>
+ <bean id="InboundNameIDPopulateAuditContext" parent="shibboleth.sp.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.sp.saml.InboundNameIDAuditExtractors') ?: getObject('shibboleth.sp.saml.DefaultInboundNameIDAuditExtractors')}" />
+
+ <bean id="OutboundNameIDPopulateAuditContext" parent="shibboleth.sp.AbstractPopulateAuditContext"
+ p:fieldExtractors="#{getObject('shibboleth.sp.saml.OutboundNameIDAuditExtractors') ?: getObject('shibboleth.sp.saml.DefaultOutboundNameIDAuditExtractors')}" />
+
<bean id="WebFlowInboundMessageHandlerAdaptor"
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype" abstract="true"
c:executionDirection="INBOUND" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list