[java-plugin-shibd] 03/03: Move agent authn beans into root context and fix up LDAP factory.
Codeberg
noreply at shibboleth.net
Mon Nov 2 15:55:05 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/1c6a5b91b6576eb387018e7193e8d2a8e24f9877
commit 1c6a5b91b6576eb387018e7193e8d2a8e24f9877
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Nov 2 10:54:47 2026 -0500
Move agent authn beans into root context and fix up LDAP factory.
---
.../agent-authn.xml} | 118 +++------------------
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +
.../idp/flows/sp/abstract/sp-abstract-beans.xml | 110 +------------------
.../shibboleth/idp/module/conf/sp/sp.properties | 58 +++++-----
4 files changed, 47 insertions(+), 241 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/agent-authn.xml
similarity index 54%
copy from sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
copy to sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/agent-authn.xml
index 1e9fa90..94b3889 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/agent-authn.xml
@@ -1,106 +1,19 @@
<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
- xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:int="http://www.springframework.org/schema/integration"
+ xmlns:int-ip="http://www.springframework.org/schema/integration/ip"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
- default-init-method="initialize" default-destroy-method="destroy">
-
- <bean id="InitializeProfileRequestContext"
- class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
- p:profileId-ref="shibboleth.sp.profileId"
- p:loggingId-ref="shibboleth.sp.loggingId" />
-
- <bean id="FlowStartPopulateAuditContext" parent="shibboleth.sp.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.sp.FlowStartAuditExtractors') ?: getObject('shibboleth.sp.DefaultFlowStartAuditExtractors')}" />
-
- <bean id="PopulateMetricContext"
- class="org.opensaml.profile.action.impl.PopulateMetricContext" scope="prototype"
- p:counterName="#{getObject('shibboleth.metrics.ProfileCounter')}"
- p:metricStrategy="#{getObject('shibboleth.metrics.MetricStrategy')}" />
-
- <bean id="LogEvent" class="org.opensaml.profile.action.impl.LogEvent" scope="prototype"
- p:suppressedEvents="#{getObject('shibboleth.SuppressedEvents') ?: getObject('shibboleth.DefaultSuppressedEvents')}">
- <property name="eventContextLookupStrategy">
- <bean class="net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction" />
- </property>
- </bean>
-
- <bean id="ExtractUsernamePasswordFromBasicAuth"
- class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
-
- <bean id="InitializeAgentRequestContext"
- class="net.shibboleth.sp.authn.impl.InitializeAgentRequestContext" scope="prototype"
- p:agentResolver-ref="shibboleth.sp.AgentResolverService"
- p:populateMDC="%{idp.logging.MDC.enabled:true}" />
-
- <bean id="CreateOutputMessage"
- class="net.shibboleth.sp.profile.impl.CreateOutputMessage" scope="prototype"
- p:overwriteExisting="true" />
-
- <bean id="CreateServletResponse"
- class="net.shibboleth.sp.profile.impl.CreateOutputMessage" scope="prototype"
- p:createServletResponse="true" />
-
- <bean id="ValidateAgentAddress"
- class="net.shibboleth.sp.authn.impl.ValidateAgentAddress" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
-
- <bean id="ValidateCachedAuthentication"
- class="net.shibboleth.sp.authn.impl.ValidateCachedAuthentication" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
-
- <bean id="ValidateAgentCredentials"
- class="net.shibboleth.sp.authn.impl.ValidateAgentCredentials" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:cacheDuration="%{sp.agent.authn.cacheDuration:PT1H}"
- p:requireAll="%{sp.agent.authn.requireAll:false}"
- p:validators="#{getObject('shibboleth.sp.AgentValidators') ?: getObject('DefaultAgentValidators')}"
- p:cleanupHook-ref="DefaultCleanupHook" />
-
- <bean id="DefaultCleanupHook"
- class="net.shibboleth.idp.authn.impl.ValidateCredentials.UsernamePasswordCleanupHook" />
-
- <bean id="ValidateAgentOperation"
- class="net.shibboleth.sp.authn.impl.ValidateAgentOperation" scope="prototype" />
-
- <bean id="DecodeAgentRequest" class="net.shibboleth.sp.profile.impl.DecodeAgentRequest" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:populateMDC="%{idp.logging.MDC.enabled:true}" />
-
- <bean id="PostAgentDecodePopulateAuditContext" parent="shibboleth.sp.AbstractPopulateAuditContext"
- p:fieldExtractors="#{getObject('shibboleth.sp.PostAgentDecodeAuditExtractors') ?: getObject('shibboleth.sp.DefaultPostAgentDecodeAuditExtractors')}" />
-
- <bean id="WriteAuditLog"
- class="net.shibboleth.sp.profile.impl.WriteAuditLog" scope="prototype" lazy-init="true"
- p:formattingMap="#{getObject('shibboleth.sp.AuditFormattingMap') ?: getObject('shibboleth.sp.DefaultAuditFormattingMap')}"
- p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
- p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
- p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
- p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier" />
-
- <bean id="EncodeAgentResponse" class="net.shibboleth.sp.profile.impl.EncodeAgentResponse" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
- p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" />
-
- <bean id="RecordResponseComplete" class="net.shibboleth.idp.profile.impl.RecordResponseComplete" scope="prototype" />
-
- <bean id="CreateOutputMessageIfNeeded"
- class="net.shibboleth.sp.profile.impl.CreateOutputMessage" scope="prototype" />
-
- <bean id="PrepareAgentErrorResponse"
- class="net.shibboleth.sp.profile.impl.PrepareAgentErrorResponse" scope="prototype" />
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
+ http://www.springframework.org/schema/integration https://www.springframework.org/schema/integration/spring-integration.xsd
+ http://www.springframework.org/schema/integration/ip https://www.springframework.org/schema/integration/ip/spring-integration-ip.xsd"
- <!-- Beans for agent authentication -->
+ default-init-method="initialize" default-destroy-method="destroy">
- <util:list id="DefaultAgentValidators">
- <!-- Default just uses secrets defined in agents.xml file. -->
- <ref bean="shibboleth.sp.AgentSecretValidator" />
- </util:list>
-
- <!-- Validator parent beans -->
+ <!-- Agent authentication beans exposed for deployer use in root context. -->
<bean id="shibboleth.sp.CredentialValidator" abstract="true"
p:savePasswordToCredentialSet="%{sp.agent.authn.retainAsPrivateCredential:false}" />
@@ -174,8 +87,11 @@
p:connectionStrategyType="#{'%{sp.agent.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}'.trim()}"
p:ldapUrl="%{sp.agent.authn.LDAP.ldapURL:ldap://localhost:10389}"
p:useStartTLS="%{sp.agent.authn.LDAP.useStartTLS:true}"
+ p:startTLSTimeout="%{sp.authn.LDAP.startTLSTimeout:PT3S}"
p:connectTimeout="%{sp.agent.authn.LDAP.connectTimeout:PT3S}"
p:responseTimeout="%{sp.agent.authn.LDAP.responseTimeout:PT3S}"
+ p:autoReconnect="%{sp.authn.LDAP.autoReconnect:true}"
+ p:reconnectTimeout="%{sp.authn.LDAP.reconnectTimeout:PT10S}"
p:trustCertificatesCredentialConfig-ref="shibboleth.sp.authn.LDAP.trustCertificates"
p:truststoreCredentialConfig-ref="shibboleth.sp.authn.LDAP.truststore"
p:disablePooling="%{sp.agent.authn.LDAP.disablePooling:false}"
@@ -208,8 +124,4 @@
p:accountStateWarningPeriod="%{sp.agent.authn.LDAP.accountStateWarningPeriod:#{null}}"
p:accountStateLoginFailures="%{sp.agent.authn.LDAP.accountStateLoginFailures:0}" />
- <!-- This is just a mocked descriptor to stuff into the context for compatibility with the IdP code. -->
- <bean id="AgentAuthnFlowDescriptor" parent="shibboleth.AuthenticationFlow"
- p:flowId="authn/Dummy" />
-
-</beans>
+</beans>
\ No newline at end of file
diff --git a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 7141dc4..2c9bd8b 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -16,6 +16,8 @@
<bean class="net.shibboleth.sp.service.impl.ConditionalHttpClientUserAgent"
c:_0="#{ 'shibd/' + (T(net.shibboleth.sp.conf.Version).getVersion() ?: 'Unknown') }" />
+ <import resource="agent-authn.xml" />
+
<!-- Agent reseolver service. -->
<bean id="shibboleth.sp.AgentResolverService" parent="shibboleth.ReloadableService"
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
index 1e9fa90..6daf6bf 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
@@ -93,121 +93,13 @@
<bean id="PrepareAgentErrorResponse"
class="net.shibboleth.sp.profile.impl.PrepareAgentErrorResponse" scope="prototype" />
- <!-- Beans for agent authentication -->
+ <!-- Internal beans for agent authentication, most are global. -->
<util:list id="DefaultAgentValidators">
<!-- Default just uses secrets defined in agents.xml file. -->
<ref bean="shibboleth.sp.AgentSecretValidator" />
</util:list>
- <!-- Validator parent beans -->
-
- <bean id="shibboleth.sp.CredentialValidator" abstract="true"
- p:savePasswordToCredentialSet="%{sp.agent.authn.retainAsPrivateCredential:false}" />
-
- <bean id="shibboleth.sp.AgentSecretValidator" parent="shibboleth.sp.CredentialValidator"
- class="net.shibboleth.sp.authn.impl.AgentSecretCredentialValidator"
- p:id="spagent-internal" />
-
- <!-- JAAS beans -->
-
- <bean id="ParsedLoginConfigNames" parent="shibboleth.CommaDelimStringArray"
- c:_0="#{'%{sp.agent.authn.JAAS.loginConfigNames:ShibSPAgentAuth}'.trim()}" />
-
- <bean id="shibboleth.sp.JAASValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
- class="net.shibboleth.idp.authn.impl.JAASCredentialValidator"
- p:id="spagent-jaas"
- p:loginConfigNames-ref="ParsedLoginConfigNames"
- p:loginConfigType="JavaLoginConfig"
- p:loginConfigResource="#{'%{sp.agent.authn.JAAS.loginConfig:%{idp.home}/conf/sp/jaas.config}'.trim()}" />
-
- <!-- Kerberos beans -->
-
- <bean id="shibboleth.sp.KerberosValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
- class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator"
- p:id="spagent-krb5"
- p:refreshKrb5Config="%{sp.agent.authn.Krb5.refreshConfig:false}"
- p:preserveTicket="false"
- p:servicePrincipal="#{'%{sp.agent.authn.Krb5.servicePrincipal:}'.trim()}"
- p:keytabPath="#{'%{sp.agent.authn.Krb5.keytab:}'.trim()}" />
-
- <!-- HTPasswd beans -->
-
- <bean id="shibboleth.sp.HTPasswdValidator" abstract="true"
- class="net.shibboleth.idp.authn.impl.HTPasswdCredentialValidator"
- p:id="spagent-htpasswd" />
-
- <!-- X.509 beans -->
-
- <bean id="shibboleth.sp.X509Validator" abstract="true"
- class="net.shibboleth.idp.authn.impl.X509CertificateCredentialValidator"
- p:id="spagent-x509" />
-
-
- <!-- LDAP beans -->
-
- <bean id="shibboleth.sp.LDAPValidator" parent="shibboleth.sp.CredentialValidator" lazy-init="true"
- class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
- p:id="spagent-ldap"
- p:authenticator-ref="shibboleth.sp.authn.LDAP.authenticator" />
-
- <bean id="shibboleth.sp.authn.LDAP.authenticator" parent="shibboleth.sp.LDAPAuthenticationFactory"
- lazy-init="true" />
-
- <bean id="shibboleth.sp.authn.LDAP.returnAttributes" parent="shibboleth.CommaDelimStringArray">
- <constructor-arg type="java.lang.String" value="%{sp.agent.authn.LDAP.returnAttributes:1.1}" />
- </bean>
- <bean id="shibboleth.sp.X509ResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
- <bean id="shibboleth.sp.KeystoreResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
-
- <bean id="shibboleth.sp.authn.LDAP.trustCertificates" parent="shibboleth.sp.X509ResourceCredentialConfig"
- p:trustCertificates="%{sp.agent.authn.LDAP.trustCertificates:undefined}" />
- <bean id="shibboleth.sp.authn.LDAP.truststore" parent="shibboleth.sp.KeystoreResourceCredentialConfig"
- p:truststore="%{sp.agent.authn.LDAP.trustStore:undefined}" />
-
- <bean id="shibboleth.sp.LDAPAuthenticationFactory" abstract="true"
- class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
- p:authenticatorType="#{'%{sp.agent.authn.LDAP.authenticator:anonSearchAuthenticator}'.trim()}"
- p:trustType="#{'%{sp.agent.authn.LDAP.sslConfig:certificateTrust}'.trim()}"
- p:connectionStrategyType="#{'%{sp.agent.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}'.trim()}"
- p:ldapUrl="%{sp.agent.authn.LDAP.ldapURL:ldap://localhost:10389}"
- p:useStartTLS="%{sp.agent.authn.LDAP.useStartTLS:true}"
- p:connectTimeout="%{sp.agent.authn.LDAP.connectTimeout:PT3S}"
- p:responseTimeout="%{sp.agent.authn.LDAP.responseTimeout:PT3S}"
- p:trustCertificatesCredentialConfig-ref="shibboleth.sp.authn.LDAP.trustCertificates"
- p:truststoreCredentialConfig-ref="shibboleth.sp.authn.LDAP.truststore"
- p:disablePooling="%{sp.agent.authn.LDAP.disablePooling:false}"
- p:blockWaitTime="%{sp.agent.authn.pool.LDAP.blockWaitTime:PT3S}"
- p:minPoolSize="%{sp.agent.authn.pool.LDAP.minSize:3}"
- p:maxPoolSize="%{sp.agent.authn.pool.LDAP.maxSize:10}"
- p:validateOnCheckout="%{sp.agent.authn.pool.LDAP.validateOnCheckout:false}"
- p:validatePeriodically="%{sp.agent.authn.pool.LDAP.validatePeriodically:true}"
- p:validatePeriod="%{sp.agent.authn.pool.LDAP.validatePeriod:PT5M}"
- p:validateDn="#{'%{sp.agent.authn.pool.LDAP.validateDN:}'.trim()}"
- p:validateFilter="#{'%{sp.agent.authn.pool.LDAP.validateFilter:(objectClass=*)}'.trim()}"
- p:bindPoolPassivatorType="#{'%{sp.agent.authn.LDAP.bindPoolPassivator:none}'.trim()}"
- p:prunePeriod="%{sp.agent.authn.pool.LDAP.prunePeriod:PT5M}"
- p:idleTime="%{sp.agent.authn.pool.LDAP.idleTime:PT10M}"
- p:dnFormat="%{sp.agent.authn.LDAP.dnFormat:undefined}"
- p:baseDn="#{'%{sp.agent.authn.LDAP.baseDN:undefined}'.trim()}"
- p:userFilter="#{'%{sp.agent.authn.LDAP.userFilter:undefined}'.trim()}"
- p:subtreeSearch="%{sp.agent.authn.LDAP.subtreeSearch:false}"
- p:resolveEntryOnFailure="%{sp.agent.authn.LDAP.resolveEntryOnFailure:false}"
- p:resolveEntryWithBindDn="%{sp.agent.authn.LDAP.resolveEntryWithBindDN:false}"
- p:velocityEngine-ref="shibboleth.VelocityEngine"
- p:bindDn="#{'%{sp.agent.authn.LDAP.bindDN:undefined}'.trim()}"
- p:bindDnCredential="%{sp.agent.authn.LDAP.bindDNCredential:undefined}"
- p:usePasswordPolicy="%{sp.agent.authn.LDAP.usePasswordPolicy:false}"
- p:usePasswordExpiration="%{sp.agent.authn.LDAP.usePasswordExpiration:false}"
- p:activeDirectory="%{sp.agent.authn.LDAP.activeDirectory:false}"
- p:freeIPA="%{sp.agent.authn.LDAP.freeIPADirectory:false}"
- p:EDirectory="%{sp.agent.authn.LDAP.eDirectory:false}"
- p:accountStateExpirationPeriod="%{sp.agent.authn.LDAP.accountStateExpirationPeriod:#{null}}"
- p:accountStateWarningPeriod="%{sp.agent.authn.LDAP.accountStateWarningPeriod:#{null}}"
- p:accountStateLoginFailures="%{sp.agent.authn.LDAP.accountStateLoginFailures:0}" />
-
<!-- This is just a mocked descriptor to stuff into the context for compatibility with the IdP code. -->
<bean id="AgentAuthnFlowDescriptor" parent="shibboleth.AuthenticationFlow"
p:flowId="authn/Dummy" />
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 4930aa4..2f221cb 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -89,8 +89,8 @@ sp.service.credential.checkInterval = PT5M
# Properties exist for optional "enterprise" agent secret validation. Most of them
# are for LDAP, replicating the large range of properties available in the IdP "proper"
-# but kept separate for flexibility. They are "chained" to the IdP properties in most
-# cases for convenience but can be overridden if necessary.
+# but kept separate for flexibility. They are NOT "chained" to the IdP properties in most
+# cases but can be by setting them to an expression such as %{idp.authn.LDAP.XXX:default}
#sp.agent.authn.JAAS.loginConfigNames = ShibSPAgentAuth
#sp.agent.authn.JAAS.loginConfig = %{idp.home}/conf/sp/jaas.config
@@ -100,58 +100,58 @@ sp.service.credential.checkInterval = PT5M
## Authenticator strategy,
# either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
-#sp.agent.authn.LDAP.authenticator = %{idp.authn.LDAP.authenticator:anonSearchAuthenticator}
+#sp.agent.authn.LDAP.authenticator = anonSearchAuthenticator
## Connection properties ##
-#sp.agent.authn.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL:ldap://localhost:10389}
-#sp.agent.authn.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
+#sp.agent.authn.LDAP.ldapURL = ldap://localhost:10389
+#sp.agent.authn.LDAP.useStartTLS = true
# Time to wait for startTLS responses
-#sp.agent.authn.LDAP.startTLSTimeout = %{idp.authn.LDAP.startTLSTimeout:PT3S}
+#sp.agent.authn.LDAP.startTLSTimeout = PT3S
# Time to wait for connections to open
-#sp.agent.authn.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
+#sp.agent.authn.LDAP.connectTimeout = PT3S
# Time to wait for operation responses (e.g. search, bind)
-#sp.agent.authn.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
+#sp.agent.authn.LDAP.responseTimeout = PT3S
# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
-#sp.agent.authn.LDAP.connectionStrategy = %{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}
+#sp.agent.authn.LDAP.connectionStrategy = ACTIVE_PASSIVE
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
-#sp.agent.authn.LDAP.sslConfig = %{idp.authn.LDAP.sslConfig:certificateTrust}
+#sp.agent.authn.LDAP.sslConfig = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
-#sp.agent.authn.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:%{idp.home}/credentials/ldap-server.crt}
+sp.agent.authn.LDAP.trustCertificates = %{idp.home}/credentials/sp/ldap-server.crt
## If using keyStoreTrust above, set to the truststore path
-#sp.agent.authn.LDAP.trustStore = %{idp.authn.LDAP.trustStore:%{idp.home}/credentials/ldap-server.truststore}
+sp.agent.authn.LDAP.trustStore = %{idp.home}/credentials/sp/ldap-server.truststore
## Return attributes during authentication
# Setting this property will cause entry resolution to occur as part of authentication
# Note that this property is not compatible with the adAuthenticator
-#sp.agent.authn.LDAP.returnAttributes = %{idp.authn.LDAP.returnAttributes:1.1}
+#sp.agent.authn.LDAP.returnAttributes = 1.1
## DN resolution properties ##
# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
-#sp.agent.authn.LDAP.baseDN = %{idp.authn.LDAP.baseDN:ou=people,dc=example,dc=org}
-#sp.agent.authn.LDAP.subtreeSearch = %{idp.authn.LDAP.subtreeSearch:false}
-#sp.agent.authn.LDAP.userFilter = %{idp.authn.LDAP.userFilter:undefined}
+#sp.agent.authn.LDAP.baseDN = ou=people,dc=example,dc=org
+#sp.agent.authn.LDAP.subtreeSearch = false
+#sp.agent.authn.LDAP.userFilter = undefined
# bind search configuration
# for AD: sp.agent.authn.LDAP.bindDN=adminuser at domain.com
-#sp.agent.authn.LDAP.bindDN = %{idp.authn.LDAP.bindDN:uid=myservice,ou=system}
+#sp.agent.authn.LDAP.bindDN = uid=myservice,ou=system
# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use sp.agent.authn.LDAP.dnFormat=%s at domain.com
-#sp.agent.authn.LDAP.dnFormat = %{idp.authn.LDAP.dnFormat:uid=%s,ou=people,dc=example,dc=org}
+#sp.agent.authn.LDAP.dnFormat = uid=%s,ou=people,dc=example,dc=org
# pool passivator, either none, bind or anonymousBind
-#sp.agent.authn.LDAP.bindPoolPassivator = %{idp.authn.LDAP.bindPoolPassivator:none}
+#sp.agent.authn.LDAP.bindPoolPassivator = none
# LDAP pool configuration, used for both authn and DN resolution
-#sp.agent.authn.pool.LDAP.minSize = %{idp.authn.pool.LDAP.minSize:3}
-#sp.agent.authn.pool.LDAP.maxSize = %{idp.authn.pool.LDAP.maxSize:10}
-#sp.agent.authn.pool.LDAP.validateOnCheckout = %{idp.authn.pool.LDAP.validateOnCheckout:false}
-#sp.agent.authn.pool.LDAP.validatePeriodically = %{idp.authn.pool.LDAP.validatePeriodically:true}
-#sp.agent.authn.pool.LDAP.validatePeriod = %{idp.authn.pool.LDAP.validatePeriod:PT5M}
-#sp.agent.authn.pool.LDAP.validateDN = %{idp.authn.pool.LDAP.validateDN:}
-#sp.agent.authn.pool.LDAP.validateFilter = %{idp.authn.pool.LDAP.validateFilter:(objectClass=*)}
-#sp.agent.authn.pool.LDAP.prunePeriod = %{idp.authn.pool.LDAP.prunePeriod:PT5M}
-#sp.agent.authn.pool.LDAP.idleTime = %{idp.authn.pool.LDAP.idleTime:PT10M}
-#sp.agent.authn.pool.LDAP.blockWaitTime = %{idp.authn.pool.LDAP.blockWaitTime:PT3S}
+#sp.agent.authn.pool.LDAP.minSize = 3
+#sp.agent.authn.pool.LDAP.maxSize = 10
+#sp.agent.authn.pool.LDAP.validateOnCheckout = false
+#sp.agent.authn.pool.LDAP.validatePeriodically = true
+#sp.agent.authn.pool.LDAP.validatePeriod = PT5M
+#sp.agent.authn.pool.LDAP.validateDN =
+#sp.agent.authn.pool.LDAP.validateFilter = (objectClass=*)
+#sp.agent.authn.pool.LDAP.prunePeriod = PT5M
+#sp.agent.authn.pool.LDAP.idleTime = PT10M
+#sp.agent.authn.pool.LDAP.blockWaitTime = PT3S
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list