{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/intercept/profile-intercept.xml","type":"text","marks":[{"type":"em"}]},{"text":" (V4.0),","type":"text"},{"text":" conf/relying-party.xml","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"5bbc9cce-8a5a-48f9-8995-1627ac3ccb31"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"75be0f58-9a37-4fa4-b568-c3740ca9602f"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"An interceptor is a Spring Web Flow that can be run as a subflow at specific points during the processing of a request to the IdP to do work. It allows behavior to be customized without replacing core code.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are currently three different \"interception\" points in the profile flows:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Inbound message processing","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Post-authentication during SSO profiles","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Outbound message processing","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The inbound and outbound hooks are not commonly used by deployers. In contrast, the post-authentication hook is a very fruitful injection point for supporting many useful features. Several predefined examples come with the software, and can be used as examples to develop your own, though this is a development task, not just a matter of configuration.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Defining Interceptors","type":"text"}]},{"type":"paragraph","content":[{"text":"There are significant differences in the OOB approach to configuration for new installs of V4.1 compared to V4.0 or upgraded systems. The tabs below (and elsewhere in the page) provide the relevant information for each version, and where applicable information on taking advantage of new approaches after upgrading.","type":"text"}]},{"type":"expand","attrs":{"title":"V4.0"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"intercept/profile-intercept.xml","type":"text","marks":[{"type":"em"}]},{"text":" file is where all supported interceptor flows are (usually minimally) described to the system.","type":"text"}]},{"type":"paragraph","content":[{"text":"The file contains a Spring list bean named ","type":"text"},{"text":"shibboleth.AvailableInterceptFlows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" Descriptors are of a specific class, ","type":"text"},{"text":"ProfileInterceptorFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor"}}]},{"text":", and generally the other options are handled with properties or with other XML configuration files.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"id","type":"text","marks":[{"type":"code"}]},{"text":" property of each descriptor is ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" arbitrary. It MUST be prefixed by \"intercept/\" and it corresponds to a web flow definition. The predefined beans correspond to built-in flows. Creating a new flow involves not only describing the flow in this list, but ensuring the ","type":"text"},{"text":"id","type":"text","marks":[{"type":"code"}]},{"text":" matches a flow definition created inside","type":"text"},{"text":" flows/intercept/","type":"text","marks":[{"type":"em"}]},{"text":". Specifically, creating the custom flow \"intercept/foo\" requires that the flow definition file be named ","type":"text"},{"text":"flows/intercept/foo/foo-flow.xml","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"V4.1+"},"content":[{"type":"paragraph","content":[{"text":"V4.1 introduces ","type":"text"},{"text":"Modules","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1294073981"}}]},{"text":", and most of the individual interceptor flows have been converted into modules that can be enabled and disabled. This approach is addressed within the pages that document all the flows.","type":"text"}]},{"type":"paragraph","content":[{"text":"Every interceptor flow known to the system auto-registers itself and generally any other settings are documented on those individual pages.","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"For reference or for those whose understanding may be aided by seeing the actual wiring, you can see the XML ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml;h=a2b6cc35579120c0957a6278d3c751032bc69ea7;hb=HEAD"}}]},{"text":", as well as in the Reference section of each individual flow's documentation page, but it's rarely essential.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Upgrading from V4.0 and Earlier","type":"text"}]},{"type":"paragraph","content":[{"text":"The information above focuses on the \"as-delivered\" V4.1 defaults, which are changed from earlier versions, and apply out of the box only to new installs. Upgraded systems, while they may contain combinations of old and new files, by design function the same as they used to for compatibility, and the new bits are generally ignored/overridden by the older settings.","type":"text"}]},{"type":"paragraph","content":[{"text":"With V4.1, the use of XML to configure many basic features has been minimized and the original ","type":"text"},{"text":"intercept/profile-intercept.xml ","type":"text","marks":[{"type":"em"}]},{"text":"file has been removed from new installations (but is still processed when present).","type":"text"}]},{"type":"paragraph","content":[{"text":"With this release, all beans of type ","type":"text"},{"text":"ProfileInterceptorFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor"}}]},{"text":" are automatically recognized, obviating the need to define them by hand, which was the main purpose of the XML file. Instead, all of the built-in interceptor flows are wired up internally, and any settings required are (and, for the most part already were) handled with properties in the ","type":"text"},{"text":"conf/idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" file.","type":"text"}]},{"type":"paragraph","content":[{"text":"Any flow descriptor bean inside a list named ","type":"text"},{"text":"shibboleth.AvailableInterceptFlows","type":"text","marks":[{"type":"strong"}]},{"text":" with a particular p","type":"text"},{"text":":id","type":"text","marks":[{"type":"code"}]},{"text":" set will supersede the internally wired bean for that flow (and the log notes this at startup). A bean defined stand-alone outside the named list will not reliably replace the internal version.","type":"text"}]},{"type":"paragraph","content":[{"text":"For those wishing to migrate from the older approach to the newer approach (this is ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" required), removing ","type":"text"},{"text":"intercept/profile-intercept.xml","type":"text","marks":[{"type":"em"}]},{"text":" and setting any properties corresponding to non-default settings applied in the XML will provide equivalent behavior.","type":"text"}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"The following interceptor flows are provided with the software:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Attribute Release Consent","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631715"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Terms of Use Consent","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631715"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Context Checking","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631716"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Warning","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1289683459"}}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Expiring Password","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631717"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Impersonate","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631718"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"External","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1272054093"}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enabling Interceptors","type":"text"}]},{"type":"paragraph","content":[{"text":"The three interception points above correspond to three properties that can be specified on the profile configuration beans in the ","type":"text"},{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631678"}}]},{"text":". Each property is a list of intercept flow IDs (excluding the \"intercept/\" prefix) to run.","type":"text"}]},{"type":"paragraph","content":[{"text":"All profile configurations include a pair of properties, ","type":"text"},{"text":"inboundInterceptorFlows","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"outboundInterceptorFlows","type":"text","marks":[{"type":"code"}]},{"text":", for specifying inbound and outbound interceptors. The profile beans typically auto-declare the right inbound interceptor flow to run to provide the appropriate security checks; these interception points should generally be left to their default values.","type":"text"}]},{"type":"paragraph","content":[{"text":"Authentication profile configurations (e.g. CAS, SAML Browser SSO and ECP) include a ","type":"text"},{"text":"postAuthenticationFlows","type":"text","marks":[{"type":"code"}]},{"text":" property for specifying the ordered list of interceptors to run after most of the work of the system is done but before any outbound message/response has been generated. They run after the user has logged in and after any user attributes have been resolved and filtered; essentially all that's left is the production of a response, so this is an opportunity to affect the result that will be produced (or prevent one altogether).","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example enabling intercepts for the SAML SSO profiles","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" \n \n \n \n \n \n \n \n \n \n \n \n \n \n ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Developing Interceptor Flows","type":"text"}]},{"type":"paragraph","content":[{"text":"Refer to the ","type":"text"},{"text":"ProfileHandling","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631868"}}]},{"text":" developer material for more technical details on developing interceptor flows.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Beans","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"2bce4384-a867-42e6-a643-456bbc2a7132"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[356.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[612.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AvailableInterceptFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[356.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"ProfileInterceptorFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[612.0]},"content":[{"type":"paragraph","content":[{"text":"List of flow descriptors enumerating the interceptor flows available to the system (supplanted in V4.1 by autowiring of ","type":"text"},{"text":"ProfileInterceptorFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor"}}]},{"text":" beans, but you may need to create this bean if you wish to extend/alter the system-defined beans)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[342.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.InterceptFlow","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[356.0]},"content":[{"type":"paragraph","content":[{"text":"ProfileInterceptorFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[612.0]},"content":[{"type":"paragraph","content":[{"text":"Abstract parent bean for defining new flow descriptor beans","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}