disable assertion encryption by entityID

[Brent Putman]

On 9/8/21 5:21 AM, Bergmann, Clemens wrote:
>
> Hi,
>
> I want to disable encryption of assertions for one of our test SPs.
>
> I tried to implement it with a predicate passed as 
> p:encryptAssertions-ref.
>
> Part of my configuration is below.
>
> Unfortunately I get an error stating “nested exception is 
> java.lang.IllegalArgumentException: Cannot convert value of type 
> 'net.shibboleth.utilities.java.support.logic.PredicateSupport$$Lambda$678/0x0000000840ee1840' 
> to required type 'boolean' for property 'encryptAssertions'”
>

Short answer:  Instead of encryptAssertions-ref as the property name, 
use encryptAssertionsPredicate-ref instead.

Use of a Predicate instance is an edge case that we don't document 
explicitly in the wiki, but do implicitly.  On the doc page for that 
profile config:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631694/SAML2SSOConfiguration

we do say:

"The most typical options used are described in more detail below, but 
not every obscure option is discussed. See the javadoc 
<http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration> 
for all of the possible configuration options for this profile (note 
that many of them are inherited from parent classes)."

If one follows the Javadoc link and looks up the parent class 
hierarchy, you will see that the actual property setters live here:

http://shibboleth.net/sites/release/java-identity-provider/4.1.4/apidocs/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.html

and that shows the setters for both the boolean and Predicate cases.

Under the covers, most of the actual boolean setters are really just 
convenience methods for delegating to the Predicate setters with 
"always true/false" Predicates, and so the Predicates are what are 
actually stored and used at runtime.

Thanks,
Brent

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210909/bf3fb8ef/attachment.htm>