SAML2ProxyTransformPostLoginC14NConfiguration

File(s): conf/c14n/subject-c14n.xml, conf/c14n/subject-c14n.properties (V4.1+)
Format: Native Spring, Properties (V4.1+)

Overview

The c14n/SAML2ProxyTransform post-login subject c14n flow does an extraction of a NameIDPrincipal from the Java Subject and returns the value as the canonical principal name for the subject. It also supports a small set of optional transforms (and as of V4.1+ case folding) to apply to the name.

The primary use case for this feature is the SAML login flow, i.e., SAML proxying. It allows a simple import of the asserted <saml2:NameID> element value from the proxied IdP as the normalized subject name. This is essentially the same functionality as the non-proxy variant of this feature described under the NameIDConsumptionConfiguration topic, but is separate so that the control beans of the two features (the ones discussed below) don't need to overlap.

This flow will succeed if and only if the input Java Subject contains exactly one NameIDPrincipal in its Principal collection.

General Configuration

Use conf/c14n/subject-c14n.xml (and in V4.1+ possibly conf/c14n/subject.properties) to configure this flow.

The most important bean is shibboleth.ProxyNameTransformPredicate, which controls the circumstances under which the importing flow will be allowed to run. The bean itself must be a Predicate object. The example configuration demonstrates how to create a condition that requires the issuer be one of a listed set of named entities. But any Predicate can be used, such as a script. With some proxies, it's assumed that control over the metadata and allowable authenticating IdPs is sufficient to allow broad acceptance of whatever NameID value they happen to supply.

The shibboleth.ProxyNameTransformFormats bean is a list of the NameID Format(s) that you want to support. The pre-existing list contains a number of Formats defined by SAML. You may need to add to it if you or some other party needs to exchange a custom Format.

The flow supports some simple transform capability. The shibboleth.ProxyNameTransforms bean is a list of regular expression and replacement string pairs that can transform the input value into a different username value rather than importing it directly. V4.1+ also allows for case folding via a couple of properties.

In the most unusual cases, V4.1 + adds support for injecting a custom object of your own creation that implements the NameIDDecoder interface to fully customize the decoding process. The bean name shibboleth.SAML2ProxyTransform.NameIDDecoder is reserved for this purpose.

Reference