[cpp-sp] branch main updated: Add option to drop unmapped attributes.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/fd5377f6e9ae329b2360a2a6e242c96f8149807a

The following commit(s) were added to refs/heads/main by this push:
     new fd5377f6 Add option to drop unmapped attributes.
fd5377f6 is described below

commit fd5377f6e9ae329b2360a2a6e242c96f8149807a
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Sep 17 09:34:18 2026 -0400

    Add option to drop unmapped attributes.
---
 configs/agent.ini                                       |  1 +
 shibsp/attribute/impl/DefaultAttributeConfiguration.cpp | 13 +++++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/configs/agent.ini b/configs/agent.ini
index 9f3d8add..dc97baed 100644
--- a/configs/agent.ini
+++ b/configs/agent.ini
@@ -46,6 +46,7 @@ reloadChanges = true
 #[attribute-settings]
 #scopeDelimiter = @
 #exportDuplicateValues = true
+#dropUnmappedAttributes = false
 #caseInsensitiveAttributes = foo bar
 #legacyClassRefAttribute = Shib-AuthnContext-Class
 #legacyAuthnTimeAttribute = Shib-Authentication-Instant
diff --git a/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp b/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
index 1f323f62..467c0190 100644
--- a/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
+++ b/shibsp/attribute/impl/DefaultAttributeConfiguration.cpp
@@ -78,7 +78,7 @@ namespace {
         // Unused ptree if we configure via inline.
         ptree m_pt;
         string m_scopeDelimiter;
-        bool m_urlEncoding,m_exportDuplicates,m_partialRegexMatching;
+        bool m_urlEncoding,m_exportDuplicates,m_dropUnmapped,m_partialRegexMatching;
         map<string,string> m_mappings;
         set<string> m_caseInsensitiveIds;
     };
@@ -122,15 +122,18 @@ void DefaultAttributeConfiguration::init(const ptree& pt)
     static const char CASE_INSENSITIVE_ATTRS_PROP_NAME[] = "caseInsensitiveAttributes";
     static const char ENCODING_PROP_NAME[] = "encoding";
     static const char EXPORT_DUP_VALUES_PROP_NAME[] = "exportDuplicateValues";
+    static const char DROP_UNMAPPED_ATTRS_PROP_NAME[] = "dropUnmappedAttributes";
     const char SCOPE_DELIMITER_PROP_NAME[] = "scopeDelimiter";
 
     static bool EXPORT_DUP_VALUES_PROP_DEFAULT = true;
+    static bool DROP_UNMAPPED_ATTRS_PROP_DEFAULT = false;
     // Not the default, but the only defined option.
     static const char URL_ENCODING_PROP_VALUE[] = "URL";
     const char SCOPE_DELIMITER_PROP_DEFAULT[] = "@";
 
     m_urlEncoding = false;
-    m_exportDuplicates = true;
+    m_exportDuplicates = EXPORT_DUP_VALUES_PROP_DEFAULT;
+    m_dropUnmapped = DROP_UNMAPPED_ATTRS_PROP_DEFAULT;
 
     // Populate "built-in" mappings.
     for (const string& name : {"Shib-Application-ID", "Shib-Session-ID", "Shib-Session-Expires", "Shib-Session-Inactivity", "REMOTE_USER"}) {
@@ -146,6 +149,7 @@ void DefaultAttributeConfiguration::init(const ptree& pt)
         m_scopeDelimiter = getString(SCOPE_DELIMITER_PROP_NAME, SCOPE_DELIMITER_PROP_DEFAULT);
         m_urlEncoding = !strcmp(getString(ENCODING_PROP_NAME, ""), URL_ENCODING_PROP_VALUE);
         m_exportDuplicates = getBool(EXPORT_DUP_VALUES_PROP_NAME, EXPORT_DUP_VALUES_PROP_DEFAULT);
+        m_dropUnmapped = getBool(DROP_UNMAPPED_ATTRS_PROP_NAME, DROP_UNMAPPED_ATTRS_PROP_DEFAULT);
 
         m_partialRegexMatching = AgentConfig::getConfig().getAgent().getBool(
             Agent::PARTIAL_REGEX_MATCHING_PROP_NAME, Agent::PARTIAL_REGEX_MATCHING_PROP_DEFAULT);
@@ -155,6 +159,7 @@ void DefaultAttributeConfiguration::init(const ptree& pt)
         m_scopeDelimiter = SCOPE_DELIMITER_PROP_DEFAULT;
         m_urlEncoding = false;
         m_exportDuplicates = EXPORT_DUP_VALUES_PROP_DEFAULT;
+        m_dropUnmapped = DROP_UNMAPPED_ATTRS_PROP_DEFAULT;
         m_partialRegexMatching = Agent::PARTIAL_REGEX_MATCHING_PROP_DEFAULT;
     }
 
@@ -202,6 +207,10 @@ bool DefaultAttributeConfiguration::processAttributes(DDF& attributes) const
             m_log.warn("invalid attribute in session data, '%s' was not a list", attr.name());
             attr.destroy();
         }
+        else if (m_dropUnmapped && m_mappings.find(attr.name()) == m_mappings.end()) {
+            m_log.debug("dropping unmapped attribute: %s", attr.name());
+            attr.destroy();
+        }
         else {
             DDF value = attr.first();
             while (!value.isnull()) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.