Page Comparison

File(s): conf/relying-party.xml, conf/idp.properties

Format: Native Spring

Overview

The relying-party.xml file is used to specify the functional features (SAML and otherwise) you want the IdP to support (these are termed "profiles"), and to customize IdP or profile settings based on the identity, or a few other characteristics, of a relying party service.

You can modify this file to:

• control which profiles are supported for particular partners (or for anonymous requests)

• alter default profile or global settings

• define and attach custom security configurations at various levels, such as:

  • turning off encryption of assertions and other content

  • changing which layer signing is performed (responses vs. assertions)

  •  supporting multiple signing credentials

  • customizing algorithms

The goal of any deployment is to reduce the number of customizations used, so the ideal is to rarely have to modify this configuration. Further, there are more modern techniques that allow many or most uses of this file to be replaced by MetadataDrivenConfiguration; that is, instead of creating explicit rules in this file, it's usually cleaner in the long run to add information to SP metadata to effect the change desired. Over time, it becomes easier to get a feel for when it's easier to use metadata and when it's easier to use overrides.

...

The absolute rule is that the file MUST contain three named beans:

• shibboleth.UnverifiedRelyingParty

• shibboleth.DefaultRelyingParty

• shibboleth.RelyingPartyOverrides

All three are defined for you by default.

The first two must define beans that derive from the RelyingPartyConfiguration class, but this is automatically done by inheriting (via the parent attribute) from the bean named RelyingParty.

...

The "default" RP bean applies to requests from peers that do not fit the conditions attached to any overrides, and are thus handled with default settings. By default, this relies on a variety of built-in settings, and activates a number of the usual profiles, though the exact list may vary over time with particular releases (things that used to be common may become rare).

The last bean is a List<RelyingPartyConfiguration> for any overrides. Those beans will generally be of special types that determine their applicability, or will generically contain an activationCondition property that determines whether one applies to a request or not.

...

To simplify this in the most common scenarios, we have included additional parent beans that can be inherited from to more easily express these conditions. Right now, we have these built-in helpers:

• RelyingPartyByName

• RelyingPartyByGroup

• RelyingPartyByEntitiesDescriptor ^4.1

• RelyingPartyByTag

• RelyingPartyByMappedTag

Examples

<!-- Example matching one SP -->
<bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org/sp">
    <property name="profileConfigurations">
        <list>
		<!-- Your refs or beans here. -->
        </list>
    </property>
</bean>

<!-- Example matching two SPs -->
<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://sp.example.org/sp', 'https://another.example.org/sp'}}">
    <property name="profileConfigurations">
        <list>
		<!-- Your refs or beans here. -->
        </list>
    </property>
</bean>

<!-- Example matching three (or more) SPs -->
<bean parent="RelyingPartyByName">
	<constructor-arg name="relyingPartyIds">
		<list>
			<value>https://sp.example.org/sp</value>
			<value>https://another.example.org/sp</value>
			<value>https://still.another.example.org/sp</value>
		</list>
	</constructor-arg>
    <property name="profileConfigurations">
        <list>
		<!-- Your refs or beans here. -->
        </list>
    </property>
</bean

(Note that the second example above uses a Spring Expression Language inline list. This can get arbitrarily long, so the third example shows this in a more readable syntax for longer lists.)

The following example notwithstanding, it's not advisable to create policy based on groups because those hierarchies are very dependent on metadata aggregation and publishing approaches that are much less common today.

<bean parent="RelyingPartyByGroup" c:groupNames="urn:mace:incommon">
	<property name="profileConfigurations">
		<list>
		<!-- Your refs or beans here. -->
		</list>
	</property>
</bean>

There is also support for group matching based on a SAML metadata feature called an <AffiliationDescriptor>, and you are able to create locally (or even remotely) expressed group memberships using that technique, by supplying supplemental metadata to the system. If you want to optimize by ignoring the possibility of  <AffiliationDescriptor> use, the RelyingPartyByEntitiesDescriptor bean has been added (as of V4.1) to bypass that step and suppress some logging that shows up during the affiliation lookup.

An alternative grouping strategy is based on <EntityAttributes> metadata extension tags. The tag-based approach is a generally recommended way of doing simple overrides that might apply to a large number of systems, and is a bridge between the "explicit" syntax and the more generic MetadataDrivenConfiguration approach.

<bean parent="RelyingPartyByTag">
	<constructor-arg name="candidates">
		<list>
			<bean parent="TagCandidate" c:name="http://macedir.org/entity-category"
				p:values="http://refeds.org/category/research-and-scholarship"/>
		</list>
	</constructor-arg>
	<property name="profileConfigurations">
		<list>
		<!-- Your refs or beans here. -->
		</list>
	</property>
</bean>

In addition to the original bean, the RelyingPartyByMappedTag bean allows you to optimize tag-based overrides by relying on the decoding of tags in the metadata into internal IdPAttribute objects via the AttributeRegistryConfiguration. Even without dedicated rules, the system can auto-decode URI-named SAML Attribute extensions into IdPAttributes with a corresponding name "as is", so generally the mapped variant should work the same way and will be faster.

Finally, the most general example involves defining your own bean and a custom condition. An example using a regular expression:

<bean id="exampleOrgRegex" class="java.util.regex.Pattern" factory-method="compile"
	c:_0="^https://sp[\d].example\.org/shibboleth$" />

<bean id="exampleOrgRegexPredicate"
	class="com.google.common.base.Predicates" factory-method="contains"
	c:_0-ref="exampleOrgRegex" />

<bean id="custom.RelyingPartyCondition"
	class="net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate"
	c:_0-ref="exampleOrgRegexPredicate" />

<bean id="CustomRelyingParty" parent="RelyingParty" p:activationCondition-ref="custom.RelyingPartyCondition">
	<property name="profileConfigurations">
		<list>
			<!-- Your refs or beans here. -->
		</list>
	</property>
</bean>

Multiple Overrides

If more than one override is defined, then it is possible for the activation conditions of multiple overrides to be satisfied by a request. Overrides have "first one wins" match semantics whose ordering is determined by their position in the shibboleth.RelyingPartyOverrides list bean. This leads to a rule of thumb for overrides: more general matches (i.e. by group) should be placed after more specific matches (i.e. by name).

...

Every relying party configuration (default or override) has a profileConfigurations property whose value is a list of ProfileConfiguration beans that determine which profiles can be used. Any profile not explicitly listed will be disabled and requests for it will fail internally with an error.

Profiles are activated within relying party configurations in most cases by referencing beans defined within the system that apply the default settings for each profile. This wouldn't apply to custom profiles defined in extensions, but it does apply to the built-in feature set. We've pre-defined beans for the built-in profiles as follows:

• Shibboleth.SSO

• SAML1.AttributeQuery

• SAML1.ArtifactResolution

• SAML2.SSO

• SAML2.ECP

• SAML2.AttributeQuery

• SAML2.ArtifactResolution

• SAML2.Logout

• Liberty.SSOS (this undocumented feature supports SAML-based security delegation and has been provisionally deprecated in this release)

They ones that are active by default are included in the shibboleth.DefaultRelyingParty bean's profileConfigurations property, by reference. You can turn them on or off using comments or by deleting them.

...

Use of scripts to derive profile settings

<bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />

<!-- Whether to run attribute release interceptor. -->
<bean id="InterceptorScript" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
    <constructor-arg>
        <value>
		<![CDATA[
		interceptors = null;
		rpid = "";
		rpCtx = input.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext");
		if (rpCtx != null) {
			rpid = rpCtx.getRelyingPartyId();
        }

		if (rpid.equals("https://sp1.example.org/sp") ||
			rpid.equals("https://sp2.example.org/sp") ||
			rpid.equals("https://sp3.example.org/sp")) {

			listType =  Java.type("java.util.ArrayList");
			interceptors = new listType(1);
			interceptors.add("attribute-release");
		}

		interceptors;
		]]>
        </value>
    </constructor-arg>
</bean>

<!-- Map of security configurations for use by next script. -->
<util:map id="SecurityConfigMap">
	<entry key="SHA2" value-ref="shibboleth.DefaultSecurityConfiguration"/>
	<entry key="SHA1" value-ref="shibboleth.SecurityConfiguration.SHA1" />
</util:map>

<!-- Whether to use SHA-1. -->
<bean id="SecurityConfigScript" parent="shibboleth.ContextFunctions.Scripted"
	factory-method="inlineScript"
	p:customObject-ref="SecurityConfigMap">
    <constructor-arg>
        <value>
		<![CDATA[
		rpid = "";
		rpCtx = input.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext");
		if (rpCtx != null) {
			rpid = rpCtx.getRelyingPartyId();
        }

		securityConfig = custom["SHA2"];

		if (rpid.equals("https://sp2.example.org/sp") ||
			rpid.equals("https://sp3.example.org/sp") ||
			rpid.equals("https://sp4.example.org/sp")) {

			securityConfig = custom["SHA1"];
		}

		securityConfig;
		]]>
        </value>
    </constructor-arg>
</bean>

<!-- Apply the scripts to derive settings. -->
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
	<property name="profileConfigurations">
		<list>
			<bean parent="Shibboleth.SSO"
				p:postAuthenticationFlowsLookupStrategy-ref="InterceptorScript"
				p:securityConfigurationLookupStrategy-ref="SecurityConfigScript" />
			<bean parent="SAML2.SSO"
				p:postAuthenticationFlowsLookupStrategy-ref="InterceptorScript"
				p:securityConfigurationLookupStrategy-ref="SecurityConfigScript" />
			<ref bean="SAML2.ECP"
				p:securityConfigurationLookupStrategy-ref="SecurityConfigScript" />
			<ref bean="SAML2.Logout"
				p:securityConfigurationLookupStrategy-ref="SecurityConfigScript" />
		</list>
	</property>
</bean>

Obviously the example above is somewhat contrived. It's longer than just creating three overrides, but it illustrates the general idea and once you get comfortable using scripts, it isn't as bad as it looks. It's also possible to put scripts in separate files, which makes the XML much shorter.

This becomes much more powerful when combined with other techniques, particularly the use of tag-based conditions based on <EntityAttribute> extensions in SAML metadata, which can be applied by metadata registrars or locally using a metadata filter.

A built-in way of doing this is described in the MetadataDrivenConfiguration topic, and this is the generally-advisable means of handling complex configuration of behavior now.

If custom profile defaults are needed for several categories of relying party, it is helpful to define top-level profile beans and reference them in the relying parties instead of the system default beans. This approach reduces duplication and produces a more readable configuration. A concrete example is instructive: suppose that an IdP needs to declare custom NameID precedence for SSO profiles for the default relying party and several overrides. The following configuration excerpt demonstrates the approach applied to that case.

languagexmltitle

Custom Profile Default Beans Example

    <bean id="Shibboleth.SSO.custom" parent="Shibboleth.SSO"
          p:nameIDFormatPrecedence="#{{
            'urn:mace:shibboleth:1.0:nameIdentifier',
            'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'}}" />
    <bean id="SAML2.SSO.custom" parent="SAML2.SSO"
          p:nameIDFormatPrecedence="#{{
            'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
            'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
            'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'}}" />
 
    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <util:list>
                <ref bean="Shibboleth.SSO.custom" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <ref bean="SAML2.SSO.custom" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
            </util:list>
        </property>
    </bean>
 
    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName"
              c:relyingPartyIds="#{{'https://a.example.com/shibboleth', 'https://b.example.com/shibboleth'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.custom" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>
        <bean parent="RelyingPartyByName"
              c:relyingPartyIds="#{{'https://x.example.com/shibboleth', 'https://y.example.com/shibboleth'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO.custom"
                          p:signAssertions="true"
                          p:signResponses="false" />
                    <bean parent="SAML2.SSO.custom"
                          p:signAssertions="true"
                          p:signResponses="false" />
                </list>
            </property>
        </bean>
    </util:list>

Reference