More advanced support for populating <saml2:AuthnContext> content based on arbitrary request state (e.g. use of SAML Attributes from a proxied IdP)
The nameIDFormatPrecedence property is a common way of controlling the type of SAML NameIdentifier / NameID included in a response, a common requirement of many commercial services. It is in fact the only way to force the use of the ill-advised "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" Format, which it must be noted is very rarely needed, despite frequent mis-documentation to the contrary.
In most cases, it is better to control the Format selected by including a <NameIDFormat> element in the SP's metadata. In the event that you don't control the metadata, you can inject the required element by applying a metadata filter.
Examples of nameIDFormatPrecedence property
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
Both constants below evaluate to the string "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
and are interchangeable, they're just illustrations of different ways to reference the same string.
<!-- Use "unspecified" NameIdentifier with Shibboleth SSO profile. -->
<util:constant static-field="org.opensaml.saml.saml1.core.NameIdentifier.UNSPECIFIED" />
<!-- Use "unspecified" NameID with SAML 2 SSO profile. -->
<util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.UNSPECIFIED" />
<!-- Return formats from a function bean (not shown). -->
<bean parent="Shibboleth.SSO" p:nameIDFormatPrecedenceLookupStrategy-ref="FormatsFunction" />
The skipEndpointValidationWhenSigned option is attractive in many enterprise scenarios if you prefer to maintain some degree of security but avoid registration of metadata containing every individual SP endpoint, which adds a lot of overhead in massively vhosted-environments. It can also add a degree of insulation from SP changes, but in practice systems that are likely to change endpoint locations but don't support metadata-based change control are likely to misunderstand the need to keep entityIDs stable also.
The ignoreScoping setting is provided to work around interoperability issues with broken SPs.
Several other new settings are used when proxying and provide various kinds of policy controls familiar to SP operators, as well as new features to support remapping of potentially non-interoperable AuthnContext values. By default, the IdP operates in a fairly automatic fashion when proxying, such that any <saml2p:RequestedAuthnContext> element from an SP will be echoed essentially as-is to any upstream Identity Provider, and the data found in the incoming assertion will be echoed as-is back downstream. Since proxying is often used to firewall against interoperability problems and crosswalk between different communities of practice, functions can be plugged in to perform more flexible mapping of values, and some pre-existing machinery is in place to support this declaratively, as described in the AuthenticationConfiguration page. An additional hook was added in V4.1 that allows a similar function to be injected but with access to the entire request state to do more advanced things.
There are also a variety of settings related to delegation that are not shown above but can be found in the relevant API documentation.