Skip to content

Commit 131f271

Browse files
cslzchencslzchen
committed
Merge branch 'release/25.0.0'
2 parents 20a8606 + 903108e commit 131f271

17 files changed

+1196
-73
lines changed

‎.github/workflows/build.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ jobs:
1818
with:
1919
java-version: 11
2020
- name: Cache SonarCloud packages
21-
uses: actions/cache@v1
21+
uses: actions/cache@v4
2222
with:
2323
path: ~/.sonar/cache
2424
key: ${{ runner.os }}-sonar
2525
restore-keys: ${{ runner.os }}-sonar
2626
- name: Cache Gradle packages
27-
uses: actions/cache@v1
27+
uses: actions/cache@v4
2828
with:
2929
path: ~/.gradle/caches
3030
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
We follow the CalVer (https://calver.org/) versioning scheme: YY.MINOR.MICRO.
44

5+
25.0.0 (09-10-2025)
6+
===================
7+
8+
* Handle duplicate and multiple SSO emails during institution login
9+
* Add new and sync existing server config files
10+
* Fix GitHub Action
11+
512
24.1.0 (08-09-2024)
613
===================
714

‎etc/cas/config/attribute-map-prod.xml‎

Lines changed: 250 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,250 @@
1+
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
2+
3+
<!--
4+
The mappings are a mix of SAML 1.1 and SAML 2.0 attribute names agreed to within the Shibboleth
5+
community. The non-OID URNs are SAML 1.1 names and most of the OIDs are SAML 2.0 names, with a
6+
few exceptions for newer attributes where the name is the same for both versions. You will
7+
usually want to uncomment or map the names for both SAML versions as a unit.
8+
-->
9+
10+
<!-- First some useful eduPerson attributes that many sites might use. -->
11+
12+
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName" id="eppn">
13+
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
14+
</Attribute>
15+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
16+
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
17+
</Attribute>
18+
<Attribute name="eduPersonPrincipalName" id="eppn">
19+
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
20+
</Attribute>
21+
22+
<Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" id="affiliation">
23+
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
24+
</Attribute>
25+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" id="affiliation">
26+
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
27+
</Attribute>
28+
29+
<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
30+
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
31+
</Attribute>
32+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
33+
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
34+
</Attribute>
35+
36+
<!-- Overridden by UOM SelectiveSsoFilter -->
37+
<!--
38+
<Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>
39+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
40+
-->
41+
42+
<!-- A persistent id attribute that supports personalized anonymous access. -->
43+
44+
<!-- First, the deprecated/incorrect version, decoded as a scoped string: -->
45+
<Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID" id="targeted-id">
46+
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
47+
<!-- <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/> -->
48+
</Attribute>
49+
50+
<!-- Second, an alternate decoder that will decode the incorrect form into the newer form. -->
51+
<!--
52+
<Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID" id="persistent-id">
53+
<AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
54+
</Attribute>
55+
-->
56+
57+
<!-- Third, the new version (note the OID-style name): -->
58+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
59+
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
60+
</Attribute>
61+
62+
<!-- Fourth, the SAML 2.0 NameID Format: -->
63+
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
64+
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
65+
</Attribute>
66+
67+
<!-- Some more eduPerson attributes, uncomment these to use them... -->
68+
<!--
69+
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" id="primary-affiliation">
70+
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
71+
</Attribute>
72+
<Attribute name="urn:mace:dir:attribute-def:eduPersonNickname" id="nickname"/>
73+
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN" id="primary-orgunit-dn"/>
74+
<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgUnitDN" id="orgunit-dn"/>
75+
<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN" id="org-dn"/>
76+
77+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" id="nickname"/>
78+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" id="primary-orgunit-dn"/>
79+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
80+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
81+
82+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
83+
84+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
85+
86+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
87+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
88+
-->
89+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" id="primary-affiliation">
90+
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
91+
</Attribute>
92+
93+
<!-- Examples of LDAP-based attributes, uncomment to use these... -->
94+
<Attribute name="urn:mace:dir:attribute-def:cn" id="cn"/>
95+
<Attribute name="urn:mace:dir:attribute-def:sn" id="sn"/>
96+
<Attribute name="urn:mace:dir:attribute-def:givenName" id="givenName"/>
97+
<Attribute name="urn:mace:dir:attribute-def:displayName" id="displayName"/>
98+
<Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
99+
<!--
100+
<Attribute name="urn:mace:dir:attribute-def:telephoneNumber" id="telephoneNumber"/>
101+
<Attribute name="urn:mace:dir:attribute-def:title" id="title"/>
102+
<Attribute name="urn:mace:dir:attribute-def:initials" id="initials"/>
103+
<Attribute name="urn:mace:dir:attribute-def:description" id="description"/>
104+
<Attribute name="urn:mace:dir:attribute-def:carLicense" id="carLicense"/>
105+
<Attribute name="urn:mace:dir:attribute-def:departmentNumber" id="departmentNumber"/>
106+
<Attribute name="urn:mace:dir:attribute-def:employeeNumber" id="employeeNumber"/>
107+
<Attribute name="urn:mace:dir:attribute-def:employeeType" id="employeeType"/>
108+
<Attribute name="urn:mace:dir:attribute-def:preferredLanguage" id="preferredLanguage"/>
109+
<Attribute name="urn:mace:dir:attribute-def:manager" id="manager"/>
110+
<Attribute name="urn:mace:dir:attribute-def:seeAlso" id="seeAlso"/>
111+
<Attribute name="urn:mace:dir:attribute-def:facsimileTelephoneNumber" id="facsimileTelephoneNumber"/>
112+
<Attribute name="urn:mace:dir:attribute-def:street" id="street"/>
113+
<Attribute name="urn:mace:dir:attribute-def:postOfficeBox" id="postOfficeBox"/>
114+
<Attribute name="urn:mace:dir:attribute-def:postalCode" id="postalCode"/>
115+
<Attribute name="urn:mace:dir:attribute-def:st" id="st"/>
116+
<Attribute name="urn:mace:dir:attribute-def:l" id="l"/>
117+
<Attribute name="urn:mace:dir:attribute-def:o" id="o"/>
118+
<Attribute name="urn:mace:dir:attribute-def:ou" id="ou"/>
119+
<Attribute name="urn:mace:dir:attribute-def:businessCategory" id="businessCategory"/>
120+
<Attribute name="urn:mace:dir:attribute-def:physicalDeliveryOfficeName" id="physicalDeliveryOfficeName"/>
121+
-->
122+
<Attribute name="urn:oid:2.5.4.3" id="cn"/>
123+
<Attribute name="urn:oid:2.5.4.4" id="sn"/>
124+
<Attribute name="urn:oid:2.5.4.42" id="givenName"/>
125+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.241" id="displayName"/>
126+
<Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
127+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="isMemberOf"/>
128+
<!--
129+
<Attribute name="urn:oid:2.5.4.20" id="telephoneNumber"/>
130+
<Attribute name="urn:oid:2.5.4.12" id="title"/>
131+
<Attribute name="urn:oid:2.5.4.43" id="initials"/>
132+
<Attribute name="urn:oid:2.5.4.13" id="description"/>
133+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.1" id="carLicense"/>
134+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.2" id="departmentNumber"/>
135+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.3" id="employeeNumber"/>
136+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.4" id="employeeType"/>
137+
<Attribute name="urn:oid:2.16.840.1.113730.3.1.39" id="preferredLanguage"/>
138+
<Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="manager"/>
139+
<Attribute name="urn:oid:2.5.4.34" id="seeAlso"/>
140+
<Attribute name="urn:oid:2.5.4.23" id="facsimileTelephoneNumber"/>
141+
<Attribute name="urn:oid:2.5.4.9" id="street"/>
142+
<Attribute name="urn:oid:2.5.4.18" id="postOfficeBox"/>
143+
<Attribute name="urn:oid:2.5.4.17" id="postalCode"/>
144+
<Attribute name="urn:oid:2.5.4.8" id="st"/>
145+
<Attribute name="urn:oid:2.5.4.7" id="l"/>
146+
<Attribute name="urn:oid:2.5.4.10" id="o"/>
147+
<Attribute name="urn:oid:2.5.4.11" id="ou"/>
148+
<Attribute name="urn:oid:2.5.4.15" id="businessCategory"/>
149+
<Attribute name="urn:oid:2.5.4.19" id="physicalDeliveryOfficeName"/>
150+
-->
151+
152+
<!-- Active Directory Federation Services (ADFS 2.x) -->
153+
<!-- University of Cape Town (UCT) and Boys Town (BT) -->
154+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="mail" />
155+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="displayName" />
156+
<Attribute name="http://schemas.microsoft.com/identity/claims/displayname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="displayName" />
157+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="givenName" />
158+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="sn" />
159+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="upn" />
160+
<Attribute name="http://schemas.microsoft.com/identity/claims/objectidentifier" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="oid" />
161+
162+
<!-- Institut Teknologi Bandung (ITB) -->
163+
<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>
164+
165+
<!-- East Carolina University (ECU) -->
166+
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ecudepartment" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="department" />
167+
168+
<!-- This is the attribute for eduPersonPrimaryOrgUnitDN. Institutions may or may not use this in DN (distinguished name) format -->
169+
<!-- Instituitons that use eduPersonPrimaryOrgUnitDN as text/string - OKSTATE -->
170+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" id="department"/>
171+
<!-- Institutions that use eduPersonPrimaryOrgUnitDN as DN - None -->
172+
<!-- Institutions that use customized attribute for the department attribute -->
173+
174+
<!-- University of Arizona (UA) -->
175+
<!--
176+
The attribute that UA released has a friendly name "employeePrimaryDeptName". However, OSF Shibboleth maps the
177+
OID directly to "department" for institutions-auth.xsl (OSF CAS) to use for XML tranformation. Thus, there is
178+
no need to track what friendly name each institution use for department in that XSL file.
179+
-->
180+
<Attribute name="urn:oid:1.3.6.1.4.1.5643.10.0.52" id="department"/>
181+
182+
<!-- University of British Columbia (UBC) -->
183+
<Attribute name="urn:oid:1.3.6.1.4.1.60.1.7.1" id="persistent-id"/>
184+
185+
<!-- University of Southern California (USC) -->
186+
<Attribute name="urn:mace:usc.edu:gds:attribute-def:uscEmailPrimaryAddress" id="mailOther"/>
187+
<Attribute name="urn:mace:usc.edu:gds:attribute-def:uscDisplayGivenName" id="uscDisplayGivenName"/>
188+
<Attribute name="urn:mace:usc.edu:gds:attribute-def:uscDisplayMiddleName" id="uscDisplayMiddleName"/>
189+
<Attribute name="urn:mace:usc.edu:gds:attribute-def:uscDisplaySn" id="uscDisplaySn"/>
190+
191+
<!-- Virginia Commonwealth University (VCU) -->
192+
<!-- The attribute that VCU released has a friendly name "vcuEduPersonDepartment", which OSF Shibboleth doesn't use. -->
193+
<Attribute name="urn:oid:1.3.6.1.4.1.10384.0.0.3.1" id="department"/>
194+
195+
<!-- Georgia Institute of Technology (GATECH) -->
196+
<Attribute name="urn:oid:1.3.6.1.4.1.636.2.11.1.56" id="department"/>
197+
198+
<!-- Vrije Universiteit Amsterdam (VUA) -->
199+
<Attribute name="urn:mace:dir:attribute-def:eduDepartment" id="department"/>
200+
201+
<!-- Princeton University (PU) -->
202+
<Attribute name="urn:oid:1.2.840.113556.1.2.141" id="department"/>
203+
204+
<!-- Selective SSO Filter Attribute -->
205+
<!-- University of Manchester (UOM) -->
206+
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="selectiveSsoFilter"/>
207+
<!-- Yale Law School (YLS) -->
208+
<Attribute name="isMemberOfYLS" id="selectiveSsoFilter"/>
209+
210+
<!-- Harvard University (HARVARD) -->
211+
<Attribute name="urn:oid:1.3.6.1.4.1.6341.610.1.2.1.175" id="mail"/>
212+
<Attribute name="urn:mace:harvard.edu:iam:common:full_name" id="displayName"/>
213+
214+
<!-- Ferris State University -->
215+
<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" id="uid" />
216+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/emailaddress" id="mail" />
217+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/lastname" id="sn" />
218+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/givenname" id="givenName" />
219+
220+
<!-- Shared SSO Filter Attribute for FSU and NationalMagLab -->
221+
<Attribute name="urn:fsu:names:SAML:attribute:fsuEduAppRoles" id="userRoles"/>
222+
223+
<!-- Spanish National Research Council (CSIC) -->
224+
<Attribute name="urn:mace:rediris.es:attribute-def:irisMailMainAddress" id="mailOther"/>
225+
226+
<!-- Active Directory Federation Services (ADFS 1.x) -->
227+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="CommonName" id="cn"/>
228+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="GivenName" id="givenName"/>
229+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="Surname" id="sn"/>
230+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="EmailAddress" id="mailOther"/>
231+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="UPN" id="upn"/>
232+
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="Group" id="group"/>
233+
234+
<!-- Macquarie University (MQ) -->
235+
<!--
236+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="persistent-id" id="persistent-id" />
237+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="mail" id="mail" />
238+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="displayName" id="displayName" />
239+
-->
240+
241+
<!-- Albion -->
242+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/mail" id="mail" />
243+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/displayName" id="displayName" />
244+
<Attribute nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" name="http://wso2.org/claims/userprincipal" id="eppn" />
245+
246+
<!-- Customized Institutional Identity Attribute -->
247+
<!-- Washington University in St. Louis (WUSTL) -->
248+
<Attribute name="urn:oid:1.3.6.1.4.1.14519.1.1" id="institutionalidentity"/>
249+
250+
</Attributes>

0 commit comments

Comments
 (0)