SAML2ProxyTransformPostLoginC14NConfiguration

File(s): conf/c14n/subject-c14n.xml, conf/c14n/subject-c14n.properties (V4.1+)
Format: Native Spring, Properties (V4.1+)

Overview

The c14n/SAML2ProxyTransform post-login subject c14n flow does an extraction of a NameIDPrincipal from the Java Subject and returns the value as the canonical principal name for the subject. It also supports a small set of optional transforms (and as of V4.1+ case folding) to apply to the name.

The primary use case for this feature is the SAML login flow, i.e., SAML proxying. It allows a simple import of the asserted <saml2:NameID> element value from the proxied IdP as the normalized subject name. This is essentially the same functionality as the non-proxy variant of this feature described under the NameIDConsumptionConfiguration topic, but is separate so that the control beans of the two features (the ones discussed below) don't need to overlap.

This flow will succeed if and only if the input Java Subject contains exactly one NameIDPrincipal in its Principal collection.

General Configuration

Use conf/c14n/subject-c14n.xml (and in V4.1+ possibly conf/c14n/subject.properties) to configure this flow.

The most important bean is shibboleth.ProxyNameTransformPredicate, which controls the circumstances under which the importing flow will be allowed to run. The bean itself must be a Predicate object. The example configuration demonstrates how to create a condition that requires the issuer be one of a listed set of named entities. But any Predicate can be used, such as a script. With some proxies, it's assumed that control over the metadata and allowable authenticating IdPs is sufficient to allow broad acceptance of whatever NameID value they happen to supply.

The shibboleth.ProxyNameTransformFormats bean is a list of the NameID Format(s) that you want to support. The pre-existing list contains a number of Formats defined by SAML. You may need to add to it if you or some other party needs to exchange a custom Format.

The flow supports some simple transform capability. The shibboleth.ProxyNameTransforms bean is a list of regular expression and replacement string pairs that can transform the input value into a different username value rather than importing it directly. V4.1+ also allows for case folding via a couple of properties.

In the most unusual cases, V4.1 + adds support for injecting a custom object of your own creation that implements the NameIDDecoder interface to fully customize the decoding process. The bean name shibboleth.SAML2ProxyTransform.NameIDDecoder is reserved for this purpose.

Reference

Properties related to this feature in conf/c14n/subject-c14n.properties follow:

Name

Type

Default

Description

Name

Type

Default

Description

idp.c14n.saml.proxy.lowercase

Boolean

false

Whether to lowercase the incoming NameID value prior to applying any transforms

idp.c14n.saml.proxy.uppercase

Boolean

false

Whether to upcase the incoming NameID value prior to applying any transforms

The beans related to this feature in conf/c14n/subject-c14n.xml follow:

Bean ID

Type

Description

Bean ID

Type

Description

shibboleth.ProxyNameTransformFormats                        

List<String>

List of NameID Format values to run the flow against

shibboleth.ProxyNameTransformPredicate

Predicate<ProfileRequestContext>

Activation condition for flow

shibboleth.ProxyNameTransforms

List<String,String>

List of regular expression and replacement string pairs to apply to the NameID value

shibboleth.SAML2ProxyTransform.NameIDDecoder 4.1

NameIDDecoder

Custom decoder to use to implement the "c14n/SAML2ProxyTransform" flow's behavior