Shibboleth IDP4 Notes - Revision history

Gtkrug: /* Sample Attribute Resolver */

2022-05-24T18:23:06Z

Sample Attribute Resolver

← Older revision		Revision as of 18:23, 24 May 2022
Line 259:		Line 259:
	<!-- Attribute Definitions -->		<!-- Attribute Definitions -->
	<!-- ========================================== -->		<!-- ========================================== -->
			<AttributeDefinition id="recipientId" xsi:type="ScriptedAttribute" >
			<Script> <![CDATA[
			recipientIdString = requestContext.getPeerEntityId();
			recipientId.addValue(recipientIdString);
			]]></Script>
			</AttributeDefinition>
	<AttributeDefinition id="nief28CFR" xsi:type="Simple" >		<AttributeDefinition id="nief28CFR" xsi:type="Simple" >
	<InputDataConnector ref="File" attributeNames="CFRCertified"/>		<InputDataConnector ref="File" attributeNames="CFRCertified"/>

Jeff.Krug: /* Dataconnectors */

2022-04-19T15:31:22Z

Dataconnectors

← Older revision		Revision as of 15:31, 19 April 2022
Line 308:		Line 308:

	=== Dataconnectors ===		=== Dataconnectors ===
	Data connectors ~~are largely unchanged from~~ Shibboleth 3, ~~although as noted at~~ the ~~very top~~ of ~~this page, credentials specified as properties are pulled from a separate secrets file~~. Here are three sample data connectors, two are built-in 'static' and 'HTTP', while 'Simple' is the one GTRI created that serves from the filesystem:		Data connectors looks close to the same as Shibboleth 3, note the '''InputAttributeDefintion''' field is used instead of the old '''Dependency''' concept in Shib3. Here are three sample data connectors, two are built-in 'static' and 'HTTP', while 'Simple' is the one GTRI created that serves from the filesystem:

Jeff.Krug: /* Dataconnectors */

2022-04-19T15:28:23Z

Dataconnectors

← Older revision		Revision as of 15:28, 19 April 2022
Line 334:		Line 334:
	]]>		]]>
	</URLTemplate>		</URLTemplate>

	<BodyTemplate MIMEType="application/json">		<BodyTemplate MIMEType="application/json">
	<![CDATA[		<![CDATA[
Line 340:		Line 339:
	]]>		]]>
	</BodyTemplate>		</BodyTemplate>

	<ResponseMapping>		<ResponseMapping>
	<Script>		<Script>
	<![CDATA[		<![CDATA[
	var logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");		var logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");

	var HashSet = Java.type("java.util.HashSet");		var HashSet = Java.type("java.util.HashSet");
	var HttpClientSupport = Java.type("net.shibboleth.utilities.java.support.httpclient.HttpClientSupport");		var HttpClientSupport = Java.type("net.shibboleth.utilities.java.support.httpclient.HttpClientSupport");
	var IdPAttribute = Java.type("net.shibboleth.idp.attribute.IdPAttribute");		var IdPAttribute = Java.type("net.shibboleth.idp.attribute.IdPAttribute");
	var StringAttributeValue = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");		var StringAttributeValue = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");

	// Limits length to 64k		// Limits length to 64k
	var body = HttpClientSupport.toString(response.getEntity(), "UTF-8", 65536);		var body = HttpClientSupport.toString(response.getEntity(), "UTF-8", 65536);

	logger.info("Query Response = " + body);		logger.info("Query Response = " + body);

	var result = JSON.parse(body);		var result = JSON.parse(body);

	//logger.info("Parsed JSON Completed = " + result.completed);		//logger.info("Parsed JSON Completed = " + result.completed);

	var attr = new IdPAttribute("CFRCertified");		var attr = new IdPAttribute("CFRCertified");
	var values = new HashSet();		var values = new HashSet();
Line 372:		Line 364:
	</Script>		</Script>
	</ResponseMapping>		</ResponseMapping>

	<ResultCache expireAfterWrite="PT5M"/>		<ResultCache expireAfterWrite="PT5M"/>
	</DataConnector>		</DataConnector>

Jeff.Krug: /* Dataconnectors */

2022-04-19T15:27:51Z

Dataconnectors

← Older revision		Revision as of 15:27, 19 April 2022
Line 326:		Line 326:
	</DataConnector>		</DataConnector>

			<DataConnector id="iirHTTP" xsi:type="HTTP"
	<DataConnector id="iirHTTP" xsi:type="HTTP"
	httpClientRef="shibboleth.NonCachingHttpClient">		httpClientRef="shibboleth.NonCachingHttpClient">
	<InputAttributeDefinition ref="niefEmail" />		<InputAttributeDefinition ref="niefEmail" />

Jeff.Krug: /* Sample Attribute Resolver */

2022-04-19T15:27:34Z

Sample Attribute Resolver

@@ Line 306: / Line 306: @@
          <InputDataConnector ref="File" attributeNames="sleo"/>
      </AttributeDefinition>
 == Metadata Providers ==

Jeff.Krug: /* Sample Attribute Resolver */

2022-04-19T15:24:44Z

Sample Attribute Resolver

← Older revision		Revision as of 15:24, 19 April 2022
Line 253:		Line 253:

	== Sample Attribute Resolver ==		== Sample Attribute Resolver ==
	This sample attribute resolver uses the NIEF Attribute Definitions above. This requires specific attribute ids, that is how the attribute definition is applied to the attribute:		This sample attribute resolver uses the NIEF Attribute Definitions above. The "Simple" data connector type is a custom data connector that reads attributes from files on the filesystem. The dataconnectors are also specified in this same file, but that is not included in this sample. This requires specific attribute ids, that is how the attribute definition is applied to the attribute:
	<!-- Usually you need the userID resolved during authentication as an input to other data connectors />		<!-- Usually you need the userID resolved during authentication as an input to other data connectors />
	<AttributeDefinition id="uid" xsi:type="PrincipalName" />		<AttributeDefinition id="uid" xsi:type="PrincipalName" />

Jeff.Krug: /* Sample Attribute Resolver */

2022-04-19T15:22:50Z

Sample Attribute Resolver

@@ Line 254: / Line 254: @@
 == Sample Attribute Resolver ==
 This sample attribute resolver uses the NIEF Attribute Definitions above.  This requires specific attribute ids, that is how the attribute definition is applied to the attribute:
+    <!-- Usually you need the userID resolved during authentication as an input to other data connectors />
 == Metadata Providers ==

Jeff.Krug: /* Metadata Providers */

2022-04-19T15:21:05Z

Metadata Providers

← Older revision		Revision as of 15:21, 19 April 2022
Line 251:		Line 251:

	\|}		\|}

			== Sample Attribute Resolver ==
			This sample attribute resolver uses the NIEF Attribute Definitions above. This requires specific attribute ids, that is how the attribute definition is applied to the attribute:


	== Metadata Providers ==		== Metadata Providers ==

Jeff.Krug: /* Metadata Providers */

2021-08-05T16:36:18Z

Metadata Providers

← Older revision		Revision as of 16:36, 5 August 2021
Line 254:		Line 254:
	== Metadata Providers ==		== Metadata Providers ==
	The following are sample metadata providers that are useful for systems that are working with NIEF. The first is a sample of the NIEF Production metadata provider and the second is an example of the NIEF Testbed provider. In both cases the associated certificate would need to be downloaded and put into the credentials directory for this provider to work:		The following are sample metadata providers that are useful for systems that are working with NIEF. The first is a sample of the NIEF Production metadata provider and the second is an example of the NIEF Testbed provider. In both cases the associated certificate would need to be downloaded and put into the credentials directory for this provider to work:
	* [[https://nief.org/trust-fabric/nief-ca.crt\|NIEF CA Cert]]		* [[https://nief.org/trust-fabric/nief-ca.crt NIEF CA Cert]]
	* [[https://ref.gfipm.net/ref-gfipm-ca.crt\|NIEF Testbed Cert]]		* [[https://ref.gfipm.net/ref-gfipm-ca.crt NIEF Testbed Cert]]

	=== NIEF Metadata Provider (Production) ===		=== NIEF Metadata Provider (Production) ===

Jeff.Krug: /* Metadata Providers */

2021-08-05T16:35:41Z

Metadata Providers

← Older revision		Revision as of 16:35, 5 August 2021
Line 254:		Line 254:
	== Metadata Providers ==		== Metadata Providers ==
	The following are sample metadata providers that are useful for systems that are working with NIEF. The first is a sample of the NIEF Production metadata provider and the second is an example of the NIEF Testbed provider. In both cases the associated certificate would need to be downloaded and put into the credentials directory for this provider to work:		The following are sample metadata providers that are useful for systems that are working with NIEF. The first is a sample of the NIEF Production metadata provider and the second is an example of the NIEF Testbed provider. In both cases the associated certificate would need to be downloaded and put into the credentials directory for this provider to work:
	* [~~NIEF CA Cert\|~~https://nief.org/trust-fabric/nief-ca.crt]		* [[https://nief.org/trust-fabric/nief-ca.crt\|NIEF CA Cert]]
	* [~~NIEF Testbed Cert\|~~https://ref.gfipm.net/ref-gfipm-ca.crt]		* [[https://ref.gfipm.net/ref-gfipm-ca.crt\|NIEF Testbed Cert]]

	=== NIEF Metadata Provider (Production) ===		=== NIEF Metadata Provider (Production) ===