Skip to content

Commit 930009f

Browse files
GPortasGPortas
committed
Changed: using tier shib idp docker image
1 parent b034bcb commit 930009f

File tree

272 files changed

+7454
-7103
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

272 files changed

+7454
-7103
lines changed

‎conf/keycloak/docker-compose-dev.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -262,14 +262,14 @@ services:
262262

263263
dev_shibboleth_idp:
264264
build:
265-
context: ../shibboleth
265+
context: ../shibboleth-idp
266266
dockerfile: Dockerfile
267267
hostname: "shibboleth_idp"
268268
image: shibboleth-idp
269269
container_name: dev_shibboleth_idp
270270
restart: unless-stopped
271271
ports:
272-
- "8081:8080"
272+
- "443:443"
273273
networks:
274274
dataverse:
275275
aliases:
@@ -278,13 +278,14 @@ services:
278278
dev_ldap:
279279
image: bitnami/openldap:latest
280280
container_name: dev_ldap
281-
restart: unless-stopped
282-
hostname: "ldap"
281+
hostname: ldap
282+
networks:
283+
dataverse:
284+
aliases:
285+
- ldap
283286
ports:
284287
- "389:389"
285288
- "636:636"
286-
networks:
287-
- dataverse
288289
environment:
289290
- LDAP_ADMIN_PASSWORD=admin
290291
- LDAP_ORGANISATION="Example Org"
@@ -293,7 +294,7 @@ services:
293294
- LDAP_PASSWORD=admin
294295
- LDAP_PORT_NUMBER=389
295296
volumes:
296-
- ../ldap/test_users.ldif:/docker-entrypoint-initads/test_users.ldif
297+
- ../ldap/users.ldif:/docker-entrypoint-initads/users.ldif
297298

298299
dev_minio:
299300
container_name: "dev_minio"

‎conf/keycloak/test-realm.json‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -189,12 +189,12 @@
189189
"manage-clients",
190190
"manage-realm",
191191
"view-identity-providers",
192-
"query-realms",
193192
"manage-authorization",
194193
"manage-identity-providers",
195194
"manage-users",
196-
"view-users",
195+
"query-realms",
197196
"view-realm",
197+
"view-users",
198198
"create-client",
199199
"view-clients",
200200
"manage-events",
@@ -1342,8 +1342,9 @@
13421342
"consentRequired": false,
13431343
"config": {
13441344
"user.session.note": "AUTH_TIME",
1345-
"id.token.claim": "true",
13461345
"introspection.token.claim": "true",
1346+
"userinfo.token.claim": "true",
1347+
"id.token.claim": "true",
13471348
"access.token.claim": "true",
13481349
"claim.name": "auth_time",
13491350
"jsonType.label": "long"
@@ -1380,8 +1381,9 @@
13801381
"consentRequired": false,
13811382
"config": {
13821383
"user.session.note": "client_id",
1383-
"id.token.claim": "true",
13841384
"introspection.token.claim": "true",
1385+
"userinfo.token.claim": "true",
1386+
"id.token.claim": "true",
13851387
"access.token.claim": "true",
13861388
"claim.name": "client_id",
13871389
"jsonType.label": "String"
@@ -1395,8 +1397,9 @@
13951397
"consentRequired": false,
13961398
"config": {
13971399
"user.session.note": "clientAddress",
1398-
"id.token.claim": "true",
13991400
"introspection.token.claim": "true",
1401+
"userinfo.token.claim": "true",
1402+
"id.token.claim": "true",
14001403
"access.token.claim": "true",
14011404
"claim.name": "clientAddress",
14021405
"jsonType.label": "String"
@@ -1410,8 +1413,9 @@
14101413
"consentRequired": false,
14111414
"config": {
14121415
"user.session.note": "clientHost",
1413-
"id.token.claim": "true",
14141416
"introspection.token.claim": "true",
1417+
"userinfo.token.claim": "true",
1418+
"id.token.claim": "true",
14151419
"access.token.claim": "true",
14161420
"claim.name": "clientHost",
14171421
"jsonType.label": "String"
@@ -1545,7 +1549,7 @@
15451549
{
15461550
"alias": "saml",
15471551
"displayName": "",
1548-
"internalId": "bedb6a8b-dd65-41b7-a840-e75c3f33c011",
1552+
"internalId": "10da424c-6370-46d8-9908-f30ddc470e89",
15491553
"providerId": "saml",
15501554
"enabled": true,
15511555
"updateProfileFirstLoginMode": "on",
@@ -1559,28 +1563,24 @@
15591563
"postBindingLogout": "false",
15601564
"postBindingResponse": "true",
15611565
"backchannelSupported": "false",
1562-
"caseSensitiveOriginalUsername": "false",
1563-
"idpEntityId": "http://shibboleth.mydomain.com:8081/idp/shibboleth",
1564-
"useMetadataDescriptorUrl": "false",
1566+
"idpEntityId": "https://shibboleth.mydomain.com/idp/shibboleth",
15651567
"loginHint": "false",
15661568
"allowCreate": "true",
15671569
"enabledFromMetadata": "true",
15681570
"syncMode": "LEGACY",
1569-
"authnContextComparisonType": "exact",
1570-
"singleSignOnServiceUrl": "http://shibboleth.mydomain.com:8081/idp/profile/SAML2/POST/SSO",
1571+
"singleSignOnServiceUrl": "https://shibboleth.mydomain.com/idp/profile/SAML2/POST/SSO",
15711572
"wantAuthnRequestsSigned": "false",
15721573
"allowedClockSkew": "0",
1573-
"encryptionPublicKey": "MIIEJDCCAoygAwIBAgIVAII0/PRaQr1QoXlJtHbcDGRnyocxMA0GCSqGSIb3DQEBCwUAMBkxFzAV\nBgNVBAMMDnNoaWJib2xldGhfaWRwMB4XDTI1MDMyNjEwNTIxNFoXDTQ1MDMyNjEwNTIxNFowGTEX\nMBUGA1UEAwwOc2hpYmJvbGV0aF9pZHAwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDl\n0xXt5gXBftg+yA7FkBgvtGsBAobtrC/xdPmep1HzQYqOrNOO2mKR5klypz/tAydzZCwWcqJ7g6ux\nMVaLyNIawJymqSy9Hpgd9O2Se/nO57bbdCzto9AtwjFAuXS4k3OS198c8OjensfdAnQcwA6vrOcA\ngoWBSG3k5Ha5Ig4HZdO1JVZscyxw70O1Qjg7kpwMY9t8ZN/VWZJ/kKYwzCfjyO4MLyk9UAXxRAUR\noWoCQW2KRE+7m821qcuwRXRM4CwOyHJUXynxvGLLNwbhFslPj9dxvTrxmMZGD1N3W0Z7Qp3+2u4l\nmcph9zEngMa2QdWZJd/0P1SnfslksOWJf3toPKbVwP4KBmygHZU7L9/7YMCWX6Tg5m3moAhjjm/z\nBClwgdWeh1miskwz50uP/bBStuIqi0bd6bvpMqm77GXQfwHL3Aq66/8694Wq3h3ZL5p9mM99CvVB\nQhOnl4ifEYe7rvNyBVw5BbQ8/bjcLCIh47XWCmyEKmzKnMHLu0HcAlECAwEAAaNjMGEwHQYDVR0O\nBBYEFDMD9Qyq3Pk/rhpIDzOtIBiHygAOMEAGA1UdEQQ5MDeCDnNoaWJib2xldGhfaWRwhiVodHRw\nczovL3NoaWJib2xldGhfaWRwL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBgQApJyMz\nQ/p0hyzEsWZVSN8vnSsiaElAYtENRlqtVMFCl1mGz1dVTBxKM1elalCJhD+d5yQwy1a7tRP4zl6L\n8WC3FtURgTRvjyJA/q/r6mAEf9WQBNMHUO78fatfRCUgSJsw1xTMbCH3y/v2+MTjWWgfrIAuit0Q\nzitnaJD/vkjRTTUGeM7L3G8pqMzwaMO3pom7ayDzbN1uhiDNUDMqZJVHE9kZ479nNY4tU++MrguQ\ninSAcKOpybVKOqKuWv+0D56d2tHBpdvb7alRJ4eaO2oWFYZ0UKPLJSbfxzTmOAwb+DPgBu+GMmM2\n4TAauhqi9YcXv4ONb+eWdueb5cU7kzE/F+AoXTsTk2DjI1pbhdrc8uUnSGR1pLtrJI+kp4kbPDZ+\nU/C5SBkrOZ8BuRXe/iB8SXELi+09nKUbe9PDvVUl3dZEwnaQicRkLNC/Py5eg4Xs7lmE7xrmd4sQ\nYZ5ulUrfE3BCIXDxGxz/iFsKh1WkxJeN8TjijJrEadldFcRBNlM=",
15741574
"artifactBindingResponse": "false",
1575-
"validateSignature": "true",
1576-
"signingCertificate": "MIIEJDCCAoygAwIBAgIVAM8b3qtgL+eFCvKP8aXQUe7eEHUFMA0GCSqGSIb3DQEBCwUAMBkxFzAV\nBgNVBAMMDnNoaWJib2xldGhfaWRwMB4XDTI1MDMyNjEwNTIxNFoXDTQ1MDMyNjEwNTIxNFowGTEX\nMBUGA1UEAwwOc2hpYmJvbGV0aF9pZHAwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDw\nt/IWL8OhaR4IB727Qvkq5xxRT5EuXZbPAeEKTi94NowTnlZxtH1VfWaOTL961w6uB7/AzXZE+EI2\nkVJhyGMfd85SqgERrB4eiH0e+bDfxfUYOwNLRdQUzkLEjuUTcJH1NbiHrbxwZjuDCHOqS5zzzRUN\n0g0X+Y8sCgv4OJEjOwpwshVlJZgwoHHGLXdgU/g4B76t2SR5pgxWL4mQOoRcrMzO1Utj/WCtIkp9\n5tL0DhQl0T9UCZ9SsUQRL0Yr5s4Fziz3KODds+LNddw/8QndKMoTZlN4cvLXWZz/2/wNMj9Ix6YM\nspOlM5Ri3lKtvYjVI/StiW6EBcfbJeW5G2fCChYrs4D/vrO26Y1qmfvOTPk2rBrKG8DxBc/SmcxR\n7FSBcLqqI4IWSYyTpJm616sQXR/n7Cc+eU3xpBGV+7tB/Q24YavPAd/aW85T6VTxpYOahbZHPVIV\nFvxTDNF509srfGFQsyshnTv4j7ySdevrLoQnn1di6uC4XnsYrGfFWisCAwEAAaNjMGEwHQYDVR0O\nBBYEFG+NHOYS8FjMWImCMHmMrR9o+S6GMEAGA1UdEQQ5MDeCDnNoaWJib2xldGhfaWRwhiVodHRw\nczovL3NoaWJib2xldGhfaWRwL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBgQCTqg0U\nzzL93Qeov22hsuzV8r+9N1wqMKCKRvX4CYXZSsnmf2eFdtOuZ6jTl7cnyXODUEm6t1hJKKTwu8ok\nQej7S9gfzkYATxUm0vDIvWj6VgtgxJLyKnMqGbSNzSciufFMfwejrqWDCpcfGWLc34yyA7AULzCS\ne2avA2VZWz6TNlveHSnUOGmIixoVuanY/Lxq3oMjjbz4fIME069c+yWdPwCJrhjSUkzewwuwyuQz\neifeApiT/MXtQci+c9XRnb1grqecu55QcHwrfuhI32uJDxpxzslT0Hz+XfZCv+MrGTPLCA9Pt2zq\nGw5p5ehe64KJB0TrcNIqzz1E9uuvDaIySkfHnvAK733yso+kBnGZxhmqRwyiU7sNbXkA/TYAtDbC\nh6klHL0WejbUdoO7FanZaPRKDmq3OtPbvxq1oM80NzHsDI854UCVBUUiiCJP8JTDVxvegkr5gtA7\nKFj7McfFHjwJOOfwsISR1vIBNn/5DpSfGdvQSwgQOurMWBq9OZE=,MIIEJDCCAoygAwIBAgIVAIUVGHsl8DEfYEeE+YxoJdLSl0FJMA0GCSqGSIb3DQEBCwUAMBkxFzAV\nBgNVBAMMDnNoaWJib2xldGhfaWRwMB4XDTI1MDMyNjEwNTIxM1oXDTQ1MDMyNjEwNTIxM1owGTEX\nMBUGA1UEAwwOc2hpYmJvbGV0aF9pZHAwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQC0\n6S4wRM0zmoDtRkEeuDlt0A7nabjUPWkF7BJydw7XtT5eWTWmDKzXhLTVisc6sgS/SYcKBJT39v5V\nTKF18o1TiUv1v0Ig9mxkf7Il2oylcgLg2I+NQaZxxhTnuwA5ckStVgT+SGJGdgWnYDP2zCcNvOvX\nn4yfg4NELnpT9Bz0xtP3yITQj1ULuPNVgqM7DozTgcmVavYIan6RFbWCQS3vUXm3oqCA9efw1HmU\nlfPxU1tWsGGWNu7UEQwUwD4zboLg7B5UNGx83Ixo315h0GfybZlLw+Skh+7wp3dECjynEsFfqve4\nu6IoUgQXlaXH58JjwzBqEtMnP9QvVOauHpK4To7oqtKfZjfMZ1UMWTha5w60LVwz3uRIzIG30Wf4\nK93RqxhDbr1dNXYktkU51BCY9R8DTrgI5eBNw/w1odVkovkHqRmpOvEw/TBPlRHpdCPMpBpUbknB\nL39Q416v76MPjDtAigzFXDWAv7SKB3s5uv/C9eo5SC0hZ/w6+LwZtaECAwEAAaNjMGEwHQYDVR0O\nBBYEFM/KVoSBwjP7n/2dcF5bVIZKPInrMEAGA1UdEQQ5MDeCDnNoaWJib2xldGhfaWRwhiVodHRw\nczovL3NoaWJib2xldGhfaWRwL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBgQB5DKhB\n1FVPdM0QqYmanXd4DOcPp+1/h9VnzilI3YXJKv0JdBOfVSeJDJlQO/Ype0O6w7rmnLyOP98I5bFb\ntic+NDyF2+W2zzv4OKFHmSm8h8rQ7Fj8Lyk0Ci04CzYNpmMFiDMAGAznD5KwnY3EqbW2bpyFYUFc\nBUAw+wJgVQY8oK7ZbTkl74ObB8MrOcwn1PZikZGURUcryhjP6dBg94o5jRl2ujnPCoVO8Yi9bRe1\nAb20cZEWx/AfcBkn+Sq8BTbgpyEff9l5Mi3QSonOfEHfFr81YTq2ef0EieGyzUuwBV2PnXTNbvhU\n9u3eRs6RWPogCk7dyoAeDOS8x2XoAVtL4amRFefpA9t6JfPcQf2JQLwj7ppUFCSnLE0VRABICyZA\nAoJgB+YIcZywXSqqjs70AB42X70X8f+2O2npKwBba/LipmjbMBngMuMhDDYUBaxW3fmZMcl2gtIC\nD4prnPHn37YmkS77qCA9R5HcN+xDh16zVHKjZuTWN5h0IquTndA=",
1575+
"validateSignature": "false",
1576+
"signingCertificate": "MIIDPDCCAiSgAwIBAgIJAMdrd4p+Lz19MA0GCSqGSIb3DQEBCwUAMCIxIDAeBgNV\nBAMMF3NoaWJib2xldGgubXlkb21haW4uY29tMB4XDTI1MDQyNjA4NTUyNFoXDTMw\nMDQyNTA4NTUyNFowIjEgMB4GA1UEAwwXc2hpYmJvbGV0aC5teWRvbWFpbi5jb20w\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDE7AxFgdcrKaWmzGLtj7EL\ncMYfv8kClUTBhrFPlvC7NItnfhQFa7mpC8DPvssfjvz7IhEwGy5hpT/cVJSa/EZo\nkgDWhd7Z9FlVfxlRR41FhxETz08w5K9hIUvAOE0WZKkwP+iX6HkrKielvHRakF7P\nzvodwEftUpSAYRepmq75Z7Nh+MnspB5qaCR3taMHjRZnViHUpzQe5bB+VrqBzysI\nX5XQVQ9L+xoYz81KBhsv5DytXxagF5MhMNAyLOsGkR38+v/ti1O48YoFDtIWFEWZ\n0HKIdY6plRSIz9wq2YRhQ35VRTgSyHCpYrQ+IC6/Q/AEApoSSi/Vneqm0W+WEOhR\nAgMBAAGjdTBzMFIGA1UdEQRLMEmCF3NoaWJib2xldGgubXlkb21haW4uY29thi5o\ndHRwczovL3NoaWJib2xldGgubXlkb21haW4uY29tL2lkcC9zaGliYm9sZXRoMB0G\nA1UdDgQWBBQb5EM7zN6x650s2NAEc07fsIyPuDANBgkqhkiG9w0BAQsFAAOCAQEA\neRxp515VgxtYpHtndHvs16hJRdMkJK2UxHMK9M9WiKug2O7iVlG6oPX9Y61q2UeV\n3S3+1DsZyWsEzqc9+N5lzIwVc8hVQROsNaDx+h7sDOnLHd1CuD9STwy4UypEQ3tr\nYv17fTgn7FZeYFHa3uP1SC5zZr8k93MthFoK5a6WdZhYl0m13pYKLNnQqYYQp574\nfWPHSrjZqAOys/Vw2iOQCy2kHYZE9y9uyp9xURaBY0NL6EXRkdFyMSV9T54L8v7f\nUQ31h17Pw+uK4EyAPCcyH7xGOK0fnq1RyhHl4JUkP9KIQk9F9Hv27JolYgy3eZx0\nY3iA/7tFp9h0olcENcA6JQ==",
15771577
"nameIDPolicyFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
15781578
"entityId": "http://keycloak.mydomain.com:8090/realms/test",
15791579
"signSpMetadata": "false",
15801580
"wantAssertionsEncrypted": "false",
15811581
"sendClientIdOnLogout": "false",
1582-
"metadataDescriptorUrl": "http://shibboleth.mydomain.com:8080/idp/shibboleth",
15831582
"wantAssertionsSigned": "false",
1583+
"metadataDescriptorUrl": "http://shibboleth.mydomain.com:8080/idp/shibboleth",
15841584
"sendIdTokenOnLogout": "true",
15851585
"postBindingAuthnRequest": "true",
15861586
"forceAuthn": "false",
@@ -1613,14 +1613,14 @@
16131613
"subComponents": {},
16141614
"config": {
16151615
"allowed-protocol-mapper-types": [
1616-
"saml-role-list-mapper",
1617-
"oidc-full-name-mapper",
1618-
"oidc-address-mapper",
16191616
"oidc-usermodel-property-mapper",
1620-
"oidc-sha256-pairwise-sub-mapper",
16211617
"saml-user-attribute-mapper",
1618+
"oidc-usermodel-attribute-mapper",
1619+
"oidc-address-mapper",
1620+
"saml-role-list-mapper",
1621+
"oidc-sha256-pairwise-sub-mapper",
16221622
"saml-user-property-mapper",
1623-
"oidc-usermodel-attribute-mapper"
1623+
"oidc-full-name-mapper"
16241624
]
16251625
}
16261626
},
@@ -1632,14 +1632,14 @@
16321632
"subComponents": {},
16331633
"config": {
16341634
"allowed-protocol-mapper-types": [
1635+
"saml-user-property-mapper",
1636+
"saml-user-attribute-mapper",
16351637
"oidc-address-mapper",
1636-
"oidc-usermodel-property-mapper",
1637-
"oidc-usermodel-attribute-mapper",
16381638
"saml-role-list-mapper",
16391639
"oidc-sha256-pairwise-sub-mapper",
1640-
"saml-user-attribute-mapper",
16411640
"oidc-full-name-mapper",
1642-
"saml-user-property-mapper"
1641+
"oidc-usermodel-attribute-mapper",
1642+
"oidc-usermodel-property-mapper"
16431643
]
16441644
}
16451645
},
@@ -1706,6 +1706,13 @@
17061706
"providerId": "dv-builtin-users-authenticator",
17071707
"subComponents": {},
17081708
"config": {}
1709+
},
1710+
{
1711+
"id": "6290c807-4887-4260-8577-948f15671928",
1712+
"name": "Dataverse built-in users authentication",
1713+
"providerId": "dv-builtin-users-authenticator",
1714+
"subComponents": {},
1715+
"config": {}
17091716
}
17101717
],
17111718
"org.keycloak.userprofile.UserProfileProvider": [

‎conf/shibboleth-idp/Dockerfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
FROM tier/shib-idp:latest4
2+
3+
ARG TOMCFG=config/tomcat
4+
ARG TOMCERT=credentials/tomcat
5+
ARG TOMWWWROOT=wwwroot
6+
ARG SHBCFG=config/shib-idp/conf
7+
ARG SHBCREDS=credentials/shib-idp
8+
ARG SHBVIEWS=config/shib-idp/views
9+
ARG SHBEDWAPP=config/shib-idp/edit-webapp
10+
ARG SHBMSGS=config/shib-idp/messages
11+
ARG SHBMD=config/shib-idp/metadata
12+
13+
ADD ${TOMCFG} /usr/local/tomcat/conf
14+
ADD ${TOMCERT} /opt/certs
15+
ADD ${TOMWWWROOT} /usr/local/tomcat/webapps/ROOT
16+
ADD ${SHBCFG} /opt/shibboleth-idp/conf
17+
ADD ${SHBCREDS} /opt/shibboleth-idp/credentials
18+
ADD ${SHBVIEWS} /opt/shibboleth-idp/views
19+
ADD ${SHBMD} /opt/shibboleth-idp/metadata

‎conf/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
This file is an EXAMPLE policy file. While the policy presented in this
4+
example file is illustrative of some simple cases, it relies on the names of
5+
non-existent example services and the example attributes demonstrated in the
6+
default attribute-resolver.xml file.
7+
8+
This example does contain some usable "general purpose" policies that may be
9+
useful in conjunction with specific deployment choices, but those policies may
10+
not be applicable to your specific needs or constraints.
11+
-->
12+
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
13+
xmlns="urn:mace:shibboleth:2.0:afp"
14+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
15+
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
16+
17+
<!--
18+
Example rule relying on a locally applied tag in metadata to trigger attribute
19+
release of some specific attributes. Add additional attributes as desired.
20+
-->
21+
<AttributeFilterPolicy id="Per-Attribute-singleValued">
22+
<PolicyRequirementRule xsi:type="ANY" />
23+
24+
<AttributeRule attributeID="eduPersonPrincipalName">
25+
<PermitValueRule xsi:type="EntityAttributeExactMatch"
26+
attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
27+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
28+
attributeValue="eduPersonPrincipalName" />
29+
</AttributeRule>
30+
31+
<AttributeRule attributeID="mail">
32+
<PermitValueRule xsi:type="EntityAttributeExactMatch"
33+
attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
34+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
35+
attributeValue="mail" />
36+
</AttributeRule>
37+
</AttributeFilterPolicy>
38+
39+
<!--
40+
Same as above but more efficient form for an attribute with multiple values.
41+
-->
42+
<AttributeFilterPolicy id="Per-Attribute-Affiliation">
43+
<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
44+
attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
45+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
46+
attributeValue="eduPersonScopedAffiliation" />
47+
48+
<AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
49+
</AttributeFilterPolicy>
50+
51+
52+
<!--
53+
Example rule for honoring Subject ID requirement tag in metadata.
54+
The example supplies pairwise-id if subject-id isn't explicitly required.
55+
-->
56+
<AttributeFilterPolicy id="subject-identifiers">
57+
<PolicyRequirementRule xsi:type="ANY" />
58+
59+
<AttributeRule attributeID="samlPairwiseID">
60+
<PermitValueRule xsi:type="OR">
61+
<Rule xsi:type="EntityAttributeExactMatch"
62+
attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
63+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
64+
attributeValue="pairwise-id" />
65+
<Rule xsi:type="EntityAttributeExactMatch"
66+
attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
67+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
68+
attributeValue="any" />
69+
</PermitValueRule>
70+
</AttributeRule>
71+
72+
<AttributeRule attributeID="samlSubjectID">
73+
<PermitValueRule xsi:type="EntityAttributeExactMatch"
74+
attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
75+
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
76+
attributeValue="subject-id" />
77+
</AttributeRule>
78+
</AttributeFilterPolicy>
79+
80+
<!-- Release an additional attribute to an SP. -->
81+
<!--
82+
<AttributeFilterPolicy id="example1">
83+
<PolicyRequirementRule xsi:type="Requester" value="https://sp.example.org" />
84+
85+
<AttributeRule attributeID="uid" permitAny="true" />
86+
</AttributeFilterPolicy>
87+
-->
88+
89+
<!-- Release eduPersonScopedAffiliation to two specific SPs. -->
90+
<!--
91+
<AttributeFilterPolicy id="example2">
92+
<PolicyRequirementRule xsi:type="OR">
93+
<Rule xsi:type="Requester" value="https://sp.example.org" />
94+
<Rule xsi:type="Requester" value="https://another.example.org/shibboleth" />
95+
</PolicyRequirementRule>
96+
97+
<AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
98+
</AttributeFilterPolicy>
99+
-->
100+
101+
102+
<!-- Attribute release for all SPs (global) tagged as 'Research and Scholarship' -->
103+
<AttributeFilterPolicy id="releaseRandSAttributeBundle">
104+
<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
105+
attributeName="http://macedir.org/entity-category"
106+
attributeValue="http://refeds.org/category/research-and-scholarship"/>
107+
<AttributeRule attributeID="eduPersonPrincipalName">
108+
<PermitValueRule xsi:type="ANY" />
109+
</AttributeRule>
110+
<AttributeRule attributeID="eduPersonScopedAffiliation">
111+
<PermitValueRule xsi:type="ANY" />
112+
</AttributeRule>
113+
<AttributeRule attributeID="givenName">
114+
<PermitValueRule xsi:type="ANY" />
115+
</AttributeRule>
116+
<AttributeRule attributeID="sn">
117+
<PermitValueRule xsi:type="ANY" />
118+
</AttributeRule>
119+
<AttributeRule attributeID="displayName">
120+
<PermitValueRule xsi:type="ANY" />
121+
</AttributeRule>
122+
<AttributeRule attributeID="mail">
123+
<PermitValueRule xsi:type="ANY" />
124+
</AttributeRule>
125+
</AttributeFilterPolicy>
126+
127+
<!-- Attribute release for all InCommon SPs -->
128+
<AttributeFilterPolicy id="releaseToInCommon">
129+
<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
130+
attributeName="http://macedir.org/entity-category"
131+
attributeValue="http://id.incommon.org/category/registered-by-incommon"/>
132+
<AttributeRule attributeID="eduPersonPrincipalName">
133+
<PermitValueRule xsi:type="ANY" />
134+
</AttributeRule>
135+
<AttributeRule attributeID="eduPersonScopedAffiliation">
136+
<PermitValueRule xsi:type="ANY" />
137+
</AttributeRule>
138+
<AttributeRule attributeID="givenName">
139+
<PermitValueRule xsi:type="ANY" />
140+
</AttributeRule>
141+
<AttributeRule attributeID="sn">
142+
<PermitValueRule xsi:type="ANY" />
143+
</AttributeRule>
144+
<AttributeRule attributeID="displayName">
145+
<PermitValueRule xsi:type="ANY" />
146+
</AttributeRule>
147+
<AttributeRule attributeID="mail">
148+
<PermitValueRule xsi:type="ANY" />
149+
</AttributeRule>
150+
</AttributeFilterPolicy>
151+
152+
153+
</AttributeFilterPolicyGroup>

0 commit comments

Comments
 (0)