{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/authn/*, conf/c14n/*","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, Properties","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"0ecf7202-2bc1-485e-84b2-4f1ff1d50da7"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"f8695960-7a65-43bf-889e-512b5c011f78"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The files in ","type":"text"},{"text":"conf/authn/","type":"text","marks":[{"type":"strong"}]},{"text":" collectively configure authentication both generally and the specific mechanisms that are built-in to the software. Authentication is heavily based on Spring Web Flow; selection of the mechanisms to invoke and each individual mechanism are implemented as \"subflows\" that run inside of the top-level web flows that service requests.","type":"text"}]},{"type":"paragraph","content":[{"text":"Login subflows make use of SWF's support for presentation views and state transitions instead of a servlet-based design. However, because of SWF's handling of URLs, there are cases in which use of a subflow exclusively is problematic, and so a defined ","type":"text"},{"text":"External","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369"}}]},{"text":" method for branching out to a servlet design is also provided. Some methods are built on top of that same approach when necessary.","type":"text"}]},{"type":"paragraph","content":[{"text":"Complex SP-driven mechanism selection criteria are supported; assuming prior configuration, all of the SAML 2 operators (exact, minimum, maximum, better) for requesting authentication context types can be supported, though exact matching is obviously much cleaner and is preferred.","type":"text"}]},{"type":"paragraph","content":[{"text":"While fully decoupled from the authentication layer, ","type":"text"},{"text":"session management","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506072"}}]},{"text":" is obviously a related topic. Most session management configuration is automatic, and the properties that can override the defaults are documented in the ","type":"text"},{"text":"SessionConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506072"}}]},{"text":" topic. It's possible to fully disable the session mechanism and turn off SSO globally with a single property. The default session mechanism is a client-side storage option using encrypted HTML Local Storage or cookies. This mechanism depends on the configuration of a secret key shared by all IdP servers.","type":"text"}]},{"type":"paragraph","content":[{"text":"Authentication configuration is divided into general and mechanism-specific parts. Separate topics exist for each mechanism included with the software and certain other subtopics.","type":"text"}]},{"type":"paragraph","content":[{"text":"You should also review the ","type":"text"},{"text":"AuthenticationFlowSelection","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505253"}}]},{"text":" topic for an explanation of how the system actually decides which mechanism to use if you enable more than one at a time. Most modern deployments tend to enable only a single mechanism, or use the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" flow to combine other methods, but it's still important to understand the underlying design.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"Authentication","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511904"}}]},{"text":" topic contains a more extensive discussion of the design of this layer, and how to use and extend it (e.g. how to build a custom login flow of your own design).","type":"text"}]},{"type":"paragraph","content":[{"text":"This is the longest and most complex part of the documentation and it should be, because authentication is the most important thing the IdP does.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Each mechanism for authentication is called an authentication flow (or login flow). Most individual login flows have been converted into modules that can be enabled and disabled. This is addressed within the pages that document all the flows.","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"There are significant differences in the OOB approach to configuration for new installs of V5 compared to systems upgraded from before V4.1 that remain largely unmodified since that timeframe. The V5 documentation focuses on the newer style of configuration and omits the legacy material, though it remains backwardly compatible. Older reference material can still be found in the original V4 documentation.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Each flow has a corresponding bean defined inside the system. These beans are of a specific class, ","type":"text"},{"text":"AuthenticationFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AuthenticationFlowDescriptor"}}]},{"text":", and include a number of settings that influence whether a mechanism can be used for specific requests and control other behavior.","type":"text"}]},{"type":"paragraph","content":[{"text":"The primary means of configuring authentication, and particular login flows, is via the file ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":". Most of the settings in this file are commented out and defaulted, so setting the ones you need generally involves uncommenting them. There are also many more advanced properties possible to define that are not present in the default file and are described in the various Reference sections for each login flow. Essentially, any bean property that used to be settable via the (now legacy) ","type":"text"},{"text":"general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":" file are typically settable now with a property.","type":"text"}]},{"type":"paragraph","content":[{"text":"Even though a login flow exists, it is not necessarily available for use at runtime. The overall list of enabled flows is controlled using the ","type":"text"},{"text":"idp.authn.flows ","type":"text","marks":[{"type":"strong"}]},{"text":"property that expresses the flows to enable as a regular expression (usually of the form \"Method1|Method2|Method3\"). Any flow not enabled will be ignored, except in the case of direct use from within the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" flow.","type":"text"}]},{"type":"paragraph","content":[{"text":"Every login flow known to the system auto-registers itself with defaults that can be overridden by setting corresponding properties, generally with the naming convention \"idp.authn.Method.setting\".","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"For reference or for those whose understanding may be aided by seeing the actual wiring, you can see the XML that allows all the properties to slot in ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml;h=042a20d07571df98662e618a0e5c28bb443d1ca0;hb=HEAD"}}]},{"text":", and in the Reference section of each individual login flow's documentation page, but it's not essential to using the properties or understanding what they do.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Generally the settings that are supported by properties have simple syntaxes that lend themselves to property use, or will identify the name of a bean that provides more complex behavior. A notable exception to this simple syntax are the \"supportedPrincipals\" properties, which are used to attach SAML (or other) representations of authentication \"classes\" to the login flows so that the system is able to abstractly recognize when a particular login flow can be used to satisfy a particular request (e.g., how to tell that a request for certificate-based authentication should not attempt to use the Password flow).","type":"text"}]},{"type":"paragraph","content":[{"text":"To avoid the need for Java beans, a string-based parsing trick is used to consume this property in the form of a comma-delimited list of strings, typically expressed as a multi-line property for readability. The syntax for this should be apparent from the commented examples, but each value is a prefix (typically \"saml2\" or \"saml1\") and a principal value separated by a slash. This will attach the corresponding ","type":"text"},{"text":"AuthnContextClassRefPrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal"}}]},{"text":" or ","type":"text"},{"text":"AuthenticationMethodPrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal"}}]},{"text":" beans in the configuration.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"As a caution, if you add a custom flow or make use of one of the technology-independent flows in a way that is not password-based, don't forget to override the corresponding ","type":"text"},{"text":"supportedPrincipals","type":"text","marks":[{"type":"code"}]},{"text":" property, or you will create problems for any SPs that are attempting to request stronger authentication methods. It's very easy to accidentally \"lie\" to the world by misconfiguring the IdP, because the software can't read your mind to understand your intentions, and it only knows what you tell it. A more detailed explanation of how the selection process works is ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505253"}}]},{"text":".","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Note that if you associate more than one supportedPrincipal value with a flow, the IdP will ordinarily pick one at random to use as a SAML \"result\" when it builds an assertion, assuming the SP didn't request a specific one. If you need to guarantee that a particular one will be expressed as a default, you can assign \"weights\" to them in a map bean that's defined in the ","type":"text"},{"text":"authn-comparison.xml","type":"text","marks":[{"type":"em"}]},{"text":" file named ","type":"text"},{"text":"shibboleth.AuthenticationPrincipalWeightMap","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Finally, note that in the rare case that multiple flows are enabled without making use of the MFA flow to control order, the various properties with the \"order\" suffix can be used to attach a non-default order value to particular flows, with lower values sorted before higher. You usually won't need to bother with this.","type":"text"}]},{"type":"expand","attrs":{"title":"Upgrading from V4.0 and Earlier"},"content":[{"type":"paragraph","content":[{"text":"The information above focuses on the \"as-delivered\" V5 defaults, which are considerably changed from earlier versions, and apply out of the box only to new installs. Upgraded systems, while they may contain combinations of old and new files, by design function the same as they used to for compatibility, and the new bits are generally ignored/overridden by the older settings.","type":"text"}]},{"type":"paragraph","content":[{"text":"Since V4.1, the use of XML to configure many basic features has been minimized and replaced by simpler properties, with a new file (","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":") added. Most of the properties in this file are commented out and largely ignored because they are superseded by the beans in the original ","type":"text"},{"text":"authn/general-authn.xml ","type":"text","marks":[{"type":"em"}]},{"text":"file, which has been removed from new installations (but is still processed when present).","type":"text"}]},{"type":"paragraph","content":[{"text":"A handful of authentication-related properties that were in ","type":"text"},{"text":"idp.properties","type":"text","marks":[{"type":"em"}]},{"text":" in older releases have been moved to the new ","type":"text"},{"text":"authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" file in this version for better locality of reference, but they are commented and ","type":"text"},{"text":"authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" is not automatically processed by upgraded configurations, preventing any conflicts.","type":"text"}]},{"type":"paragraph","content":[{"text":"With this release, all beans of type ","type":"text"},{"text":"AuthenticationFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AuthenticationFlowDescriptor"}}]},{"text":" are automatically recognized, obviating the need to define them by hand, which was the main purpose of the old XML file. Instead, all of the built-in login flows are wired up internally with properties used to control settings rather than XML.","type":"text"}]},{"type":"paragraph","content":[{"text":"For compatibility and for those who favor XML, any flow descriptor bean inside a list named ","type":"text"},{"text":"shibboleth.AvailableAuthenticationFlows","type":"text","marks":[{"type":"strong"}]},{"text":" with a particular ","type":"text"},{"text":"p:id","type":"text","marks":[{"type":"code"}]},{"text":" will supersede the internally wired bean for that flow (and the log notes this at startup). A bean defined stand-alone outside the named list will not reliably replace the internal version.","type":"text"}]},{"type":"paragraph","content":[{"text":"For those wishing to migrate from the older approach to the newer approach (though this is ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" required), removing ","type":"text"},{"text":"authn/general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":", setting ","type":"text"},{"text":"idp.searchForProperties","type":"text","marks":[{"type":"strong"}]},{"text":" to \"true\" in ","type":"text"},{"text":"idp.properties,","type":"text","marks":[{"type":"em"}]},{"text":" and setting any properties corresponding to non-default settings applied in the XML will provide equivalent behavior (and hopefully be easier to understand and adjust down the road).","type":"text"}]},{"type":"paragraph","content":[{"text":"Another generally minor function of the XML file was to establish the order by which the IdP would attempt to use any methods applicable to a request. If this matters, a property for each method with the \"order\" suffix (e.g., ","type":"text"},{"text":"idp.authn.Password.order","type":"text","marks":[{"type":"strong"}]},{"text":") can be set to a value other than the default to sort methods relative to each other. Lower values are tried first.","type":"text"}]},{"type":"paragraph","content":[{"text":"As a minor note, the bean named ","type":"text"},{"text":"shibboleth.AuthenticationPrincipalWeightMap","type":"text","marks":[{"type":"strong"}]},{"text":" was moved from ","type":"text"},{"text":"general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":" (which was removed) to ","type":"text"},{"text":"authn-comparison.xml","type":"text","marks":[{"type":"em"}]},{"text":" (which remains). It doesn't matter which file it's in (and any given system when appropriate install/upgrade procedures are followed will only contain one instance of it).","type":"text"}]},{"type":"paragraph","content":[{"text":"The changes in the default version of ","type":"text"},{"text":"authn-comparison.xml","type":"text","marks":[{"type":"em"}]},{"text":" also include the removal of a number of beans in favor of system-supplied definitions, and using the original file will lead to a number of INFO-level messages related to overriding of comparison logic. If you haven't made changes to this file (which is common), you can simply swap in the newly distributed version to eliminate the messages.","type":"text"}]},{"type":"paragraph","content":[{"text":"In addition to the properties that essentially supplant the ","type":"text"},{"text":"general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":" file, there are other properties (again mostly commented) that replace many of the simple settings from the myriad XML files that used to be required to configure the individual login flows. While they are covered in more detail in those topics, as a general matter the intent is to minimize the need for some of those files, and the aforementioned ","type":"text"},{"text":"Module","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510765"}}]},{"text":" change removes most of them from the default install. The properties only apply when the original XML-defined beans they replace are absent.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Login Flows","type":"text"}]},{"type":"paragraph","content":[{"text":"Login flows provided with the software are listed below with links to their associated documentation:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RemoteUser","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505836"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RemoteUserInternal","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505889"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X509","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506319"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"X509Internal","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506380"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SPNEGO / Kerberos","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506148"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"IPAddress","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505489"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"External","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505438"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":" (i.e. Proxying to other SAML IdP(s))","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Multi-Factor","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Post-Login Subject Canonicalization","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful login takes place, the IdP needs to be able to establish an \"official\" username to represent the subject throughout the system in order to disambiguate subjects from each other. Chiefly this is needed so that the IdP can detect when the identity of the subject has changed/switched, usually because of the use of shared computers. It also allows you to build an ","type":"text"},{"text":"AttributeResolverConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":" that can count on the form of the subject's name when looking up entries in directories or databases, essentially offloading some of the complexity that would otherwise end up in the attribute resolver logic/configuration (e.g., more complex LDAP search filters or SQL).","type":"text"}]},{"type":"paragraph","content":[{"text":"This particular use of ","type":"text"},{"text":"subject canonicalization","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509628"}}]},{"text":" (i.e., c14n) is referred to as post-login c14n and the chief input is an instance of a Java ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":", which is a fairly open-ended class that can contain any number of custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects and collections of public and/or private credentials. The IdP generally doesn't make much use of the credential collections, but does populate the ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" collection and uses that heavily.","type":"text"}]},{"type":"paragraph","content":[{"text":"With many login flows, the Subject is often fairly simple and often contains a single ","type":"text"},{"text":"UsernamePrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.UsernamePrincipal"}}]},{"text":" that carries a username set by the login flow, often directly or based on something entered by a user. In the simple case, the \"right\" canonical value may just be that name, and nothing needs to be configured, it will simply happen automatically. In less common cases, you may need to configure a more advanced c14n method to do your bidding.","type":"text"}]},{"type":"paragraph","content":[{"text":"The overall configuration of these methods and how they are executed after authentication varies by IdP version, and so is discussed in a couple of subtopics.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"V5.2+","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4253450242"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"V5.0 - V5.1 (and older versions)","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4252467208"}}]}]}]}]},{"type":"paragraph","content":[{"text":"The post-login c14n flows provided with the software are listed below:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"simple","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506117"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"x500","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506280"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"attribute","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505212"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML2ProxyTransform","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505934"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"function","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/4256694273"}}]},{"text":" ","type":"text"},{"text":"5.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]}]},{"type":"paragraph","content":[{"text":"The first two are fairly elementary to use, while the third requires additional configuration to operate sensibly, and the fourth is for specialized use when proxying authentication to a different SAML IdP (and, even then, is often unneeded unless you intend to leverage an incoming ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element as the basis of c14n). The last one is an extension point allowing simpler development of custom methods.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Subject Decorators","type":"text"}]},{"type":"paragraph","content":[{"text":"There is another hook that can be used to plug in Java or ","type":"text"},{"text":"scripting","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509499"}}]},{"text":" code to perform customization of the Java ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":" by a flow ","type":"text"},{"text":"before","type":"text","marks":[{"type":"strong"}]},{"text":" the c14n step occurs. The advantage of this hook is that it's sometimes easier to write that bit of code and have it produce, for example, a ","type":"text"},{"text":"UsernamePrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.UsernamePrincipal"}}]},{"text":", than to create a new c14n feature from scratch, though this is less true in V5.2+.","type":"text"}]},{"type":"paragraph","content":[{"text":"This hook is usable by defining a bean with the signature ","type":"text"},{"text":"BiConsumer","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.BiConsumer"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":">, and identifying it in ","type":"text"},{"text":"conf/authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" via a property of the form ","type":"text"},{"text":"idp.authn..subjectDecorator","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Topics","type":"text"}]},{"type":"expand","attrs":{"title":"Administrative Logout"},"content":[{"type":"paragraph","content":[{"text":"The IdP includes a feature allowing revocation of existing authentication results, which is our implementation of “administrative logout”, the ability of somebody who isn’t the subject to “log a subject out of the IdP” for administrative reasons. See the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506431"}},{"text":" topic for details on this.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Proxying"},"content":[{"type":"paragraph","content":[{"text":"The IdP includes support for login methods that rely on another IdP to actually authenticate the subject, with the results used to produce the eventual responses to the proxying IdP's own services. This is a common feature of most other SAML software but is newer to Shibboleth.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are a number of different low-level features included to better support this use case as well as to ensure that the default behavior aligns to the SAML 2.0 standard, which includes a number of precise rules for proxying and for limiting and even preventing proxying behavior.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"You will find that virtually no software beyond Shibboleth supports these proxying controls and that they will be in violation of the standard with regard to how they work if you make use of them. This is familiar territory to Shibboleth deployers.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"As a rule, the IdP doesn't explicitly assume that a given login flow is or isn't a form of proxy authentication. It defaults to certain assumptions but relies on the deployer to tell it when proxying is involved by adjusting ","type":"text"},{"text":"authn/authn.properties.","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"The topic of Proxying goes a fair bit beyond authentication considerations, but some of the considerations are summarized here. The rest are mostly in the areas of ","type":"text"},{"text":"SubjectCanonicalizationConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509628"}}]},{"text":", ","type":"text"},{"text":"AttributeResolverConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":", and ","type":"text"},{"text":"AttributeFilterConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199501794"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"IdP Discovery","type":"text"}]},{"type":"paragraph","content":[{"text":"When proxying, the IdP supports calling out to a ","type":"text"},{"text":"standardized","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.oasis-open.org/security/IdpDiscoSvcProtonProfile"}}]},{"text":" discovery service. Discovery can be enabled for login flows designed to allow for proxying by enabling the corresponding flow-specific \"discoveryRequired\" property in ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" and setting the ","type":"text"},{"text":"idp.authn.discoveryURL","type":"text","marks":[{"type":"strong"}]},{"text":" property to the location of the discovery service.","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful discovery result will make the value returned available via ","type":"text"},{"text":"AuthenticationContext.getAuthenticatingAuthority()","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.context.AuthenticationContext"}}]},{"text":" and will be automatically used by login flows designed to take advantage of it.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scoping","type":"text"}]},{"type":"paragraph","content":[{"text":"Another point of policy is honoring the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element if included by an SP in its request. This allows an SP to disallow proxying, or control the length of the proxy chain. The IdP doesn't normally enforce this for most login flows because it assumes that it ","type":"text"},{"text":"isn't","type":"text","marks":[{"type":"strong"}]},{"text":" proxying. Out of the box, only the new ","type":"text"},{"text":"SAML","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":" login flow is designated to enforce this control, but the ","type":"text"},{"text":"proxyScopingEnforced","type":"text","marks":[{"type":"code"}]},{"text":" property can be enabled for a login flow when applicable. Of course, this also means you can bypass the control when really proxying by turning it off. Doing so is a standards violation and a generally slimy thing to do.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Forced Authentication","type":"text"}]},{"type":"paragraph","content":[{"text":"Another assumption the system makes is that a request asking for forced authentication (the ","type":"text"},{"text":"ForceAuthn","type":"text","marks":[{"type":"code"}]},{"text":" flag in SAML or similar features in other protocols) should be relayed to a proxied IdP. This is the default, but can be overridden on a per-IdP basis via ","type":"text"},{"text":"Profile Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508270"}}]},{"text":" by explicitly turning off the setting.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Authentication Type Mapping","type":"text"}]},{"type":"paragraph","content":[{"text":"Finally, a potentially complex issue arises when it comes to passing SAML ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" values and comparable constructs in other protocols back and forth across the proxy boundary. In many cases, the values used on the inside and outside are different. The IdP provides pluggable hooks for this, but defaults to allowing the use of pre-defined map beans to express the relationships in both directions. The beans are defined in ","type":"text"},{"text":"conf/authn/authn-comparison.xml","type":"text","marks":[{"type":"em"}]},{"text":" (if you upgraded, compare your copy to the distributed version to see the new settings):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PrincipalProxyRequestMappings","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"These are rules for turning the values that apply to, or are contained in, SP requests into new values to express in a request issued to a proxied IdP.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"shibboleth.PrincipalProxyResponseMappings","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"These are rules for turning the values that appear in proxied IdP responses into new values to capture in the resulting subject's authentication record and subsequently potentially used in responses to SPs.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"In both cases:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Omitting an explicit mapping rule will result in the value being copied unmodified.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A key with an empty list as a value will be suppressed and not included at all.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Explicit mappings will turn an instance of the key into one or more values.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This is hopefully sufficient for most basic proxying scenarios, and is adapatable to all supported protocols now and in the future.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this does not currently extend to the practice of expressing this information using SAML Attributes. This overlaps with the function of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element and does not have any supporting guidance in the standard that would indicate it's an appropriate thing to do, as Attributes are about the Subject of an Assertion, not about the act of authentication that led to one. There are more ","type":"text"},{"text":"advanced mechanisms","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508402"}}]},{"text":" in place to allow the mapping process to be arbitrarily controlled.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Custom Lifetime/Timeout Policy (V5.2+)"},"content":[{"type":"paragraph","content":[{"text":"The “result” from executing each login flow is only “active” for an amount of time that is normally regulated by a lifetime and an inactivity timeout setting that is global for all results of a particular login flow. It can be changed per flow, but is normally statically defined for all that flow’s results. V5.2 introduces the ability to inject functions (scripted or otherwise) that can override a flow’s default lifetime or timeout value for a particular result. This is best used as a form of risk-based authentication (a limited form of course) such as using different values based on the client’s network or perhaps based on the user’s identity.","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuring these functions is generally done with new properties added for each login flow, of the form ","type":"text"},{"text":"idp.authn.","type":"text","marks":[{"type":"strong"}]},{"text":"Flow","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".lifetimeStrategy","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"idp.authn.","type":"text","marks":[{"type":"strong"}]},{"text":"Flow","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".inactivityTimeoutStrategy","type":"text","marks":[{"type":"strong"}]},{"text":", containing the bean ID of the function to run. The reference pages for each login flow have been updated with them.","type":"text"}]},{"type":"paragraph","content":[{"text":"The most noteworthy aspect of this feature pertains to the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" flow and its impact there, so further discussion can be found there.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Custom Events"},"content":[{"type":"paragraph","content":[{"text":"More typically in the ","type":"text"},{"text":"Password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]},{"text":" or ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" flows, but also generally, it's possible for login flows to return custom Spring Web Flow events in addition to the events that are hardwired into the system. This typically arises as a result of mapping a specific error message to an event by means of a \"classified message\" map, or in advanced cases might be triggered by a button or other user input on a login form to cause some other login method to execute.","type":"text"}]},{"type":"paragraph","content":[{"text":"To support this, it's not sufficient to just signal or map a message to the event; you must also define the event to the system by editing ","type":"text"},{"text":"conf/authn/authn-events-flow.xml","type":"text","marks":[{"type":"em"}]},{"text":". There are two steps needed: adding an ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" for the event and adding a ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" rule to authorize the event as a signal to cause the flow to terminate with that state. The file includes commented examples, and a sample is shown below that authorizes \"MyCustomEvent\" to be surfaced:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Authorizing custom login flow events in conf/authn/authn-events-flow.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" \n\n \n \n \n ","type":"text"}]},{"type":"paragraph","content":[{"text":"In many cases, you also want this custom event to result in a custom error message/page at the IdP rather than a response to the SP. This isn't the default for most events, but you can modify the ","type":"text"},{"text":"shibboleth.LocalEventMap","type":"text","marks":[{"type":"strong"}]},{"text":" bean in ","type":"text"},{"text":"conf/errors.xml","type":"text","marks":[{"type":"em"}]},{"text":" to change the behavior, and add custom error messages for the standard error view to ","type":"text"},{"text":"messages/messages.properties","type":"text","marks":[{"type":"em"}]},{"text":". See ","type":"text"},{"text":"ErrorHandlingConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506653"}}]},{"text":" for details.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"Because there are a variety of different login methods, most of the actual configuration is documented in the relevant topics covering those methods, but there are a few general properties used, and a larger set of properties that control the management of sessions, which are of course related to authentication.","type":"text"}]},{"type":"paragraph","content":[{"text":"The most important property to note is the ","type":"text"},{"text":"idp.authn.flows","type":"text","marks":[{"type":"strong"}]},{"text":" property. This is a regular expression that identifies the login flows to enable. The expression applies only to the suffix of each flow ID (omitting the authn/ prefix), and the simplest way to express this is with a pipe (|) separated list of the flow names, e.g., flow1|flow2|flow3","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this property defaults to \"Password\" simply to ensure the system can minimally operate out of the box and because that's the most common method.","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"d224c84b-e05e-4cbf-9806-8354fc219350"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.flows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Regular Expression","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Password","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Regular expression that identifies the login flows to globally enable","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.defaultLifetime","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"PT60M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Default amount of time to allow reuse prior authentication flows, measured since first usage","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.defaultTimeout","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"PT30M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Default inactivity timeout to prevent reuse of prior authentication flows, measured since last usage","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.proxyRestrictionsEnforced","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to enforce restrictions placed on further proxying of assertions from upstream IdPs when relying on proxied authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.favorSSO","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to prioritize prior authentication results when an SP requests more than one possible matching method","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.rpui","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to populate information about the relying party into the tree for user interfaces during login and interceptors","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.identitySwitchIsError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to fail requests if a user identity after authentication doesn't match the identity in a pre-existing session","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.discoveryURL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Provides a static discovery URL to use for external discovery; this property replaces the need for the XML-defined bean used in V4.0 for this purpose","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.audit.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Toggles ","type":"text"},{"text":"authentication audit logging ","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509698"}}]},{"text":"globally","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.overrideRequestedAuthnContext","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to override an explicit ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element in an SP’s request with a configuration-imposed rule via the ","type":"text"},{"text":"defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" profile configuration setting. Note this is a violation of the SAML standard and is also a global setting applying to all SPs that may have such a profile configuration set.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.usernameCookieName ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"If set, enables support for caching of a username after successful login in certain cases in an encrypted cookie (using the name provided). Of the built-in login methods, only the ","type":"text"},{"text":"Password","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505587"}}]},{"text":" flow supports this.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[357.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.usernamePrecedence ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited list","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"“form“,","type":"text"},{"type":"hardBreak"},{"text":"”session”,","type":"text"},{"type":"hardBreak"},{"text":"”coookie”","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[698.0]},"content":[{"type":"paragraph","content":[{"text":"List of “sources” for username recovery for form population, supports “form”, “session”, and “cookie”, defaulting to that order","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans (General)"},"content":[{"type":"paragraph","content":[{"text":"Beans related to general authentication configuration follow:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"daf7f02e-7b09-4086-a812-a753c9e321f1"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AvailableAuthenticationFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":"<","type":"text"},{"text":"AuthenticationFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AuthenticationFlowDescriptor"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"List of descriptors enumerating the supported authentication flows that can be used. (You may need to create this bean if you wish to extend/alter the system-defined beans, but this is very unusual.)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuthenticationPrincipalWeightMap","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":",","type":"text"},{"text":"Integer","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.Integer"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Map of weights to assign to particular custom Principal objects so that flows can pick an appropriate default Principal to associate with their result (see comment in file for more detail)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuthenticationFlow","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"AuthenticationFlowDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AuthenticationFlowDescriptor"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new flow descriptors, generally only needed by extension developers or those wishing to override the system-defined XML","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SAML2AuthnContextClassRef","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"AuthnContextClassRefPrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for attaching SAML 2.0 AuthnContextClassRef constants to flows","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SAML2AuthnContextDeclRef","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"AuthnContextDeclRefPrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for attaching SAML 2.0 AuthnContextDeclRef constants to flows","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SAML1AuthenticationMethod","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"AuthenticationMethodPrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for attaching SAML 1.1 AuthenticationMethod constants to flows","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.FixedAuthenticationEventStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[327.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[555.0]},"content":[{"type":"paragraph","content":[{"text":"Function for producing a Spring WebFlow Event to signal from login flow validation actions to artifically test error or warning customizations.","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans (IdP Discovery)"},"content":[{"type":"paragraph","content":[{"text":"The following beans are used to configure IdP Discovery when proxying.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"c8bedf92-0f28-428e-ae14-2cf7c1d5f8c5"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[409.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[358.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[409.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.discoveryURLStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[358.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"Function to apply to produce a Discovery Service URL to use instead of relying on a property for a static value","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[409.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.discoveryRequestFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[358.0]},"content":[{"type":"paragraph","content":[{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.BiFunction"}}]},{"text":"<","type":"text"},{"type":"hardBreak"},{"text":" RequestContext,","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"type":"hardBreak"},{"text":" >","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"BiFunction that overrides the built-in mechanism that generates the redirect to the Discovery Service with a deployer-supplied version","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[409.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.entityIDForDiscoveryStrategy ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[358.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"paragraph","content":[{"text":"Function to produce the entityID to use in the request to the DS in the event a default determination is not sufficient","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans (Flow Selection)"},"content":[{"type":"paragraph","content":[{"text":"The following beans are used to configure comparison rules for custom Principals to support rules for login flow selection when requests specify particular methods, as described in ","type":"text"},{"text":"AuthenticationFlowSelection","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505253"}}]},{"text":". It is quite rare to need to modify them.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"ff31ca67-814e-43ae-8523-773d01aa455a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.AuthnComparisonRules","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map?module=java.sql"}}]},{"text":" used as constructor argument to ","type":"text"},{"text":"PrincipalEvalPredicateFactoryRegistry","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Map of comparison rules","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SAMLAuthnMethodExact","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACClassRefExact","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACDeclRefExact","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.SAMLACClassRefMinimum","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACDeclRefMinimum","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACClassRefMaximum","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.SAMLACDeclRefMaximum","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACClassRefBetter","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.SAMLACDeclRefBetter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"Class","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.Class"}}]},{"text":", ","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Pairs of custom Principal types and matching operators for all the SAML 1.1 and 2.0 principal and comparison types supported, used as keys for the ","type":"text"},{"text":"shibboleth.AuthnComparisonRules","type":"text","marks":[{"type":"strong"}]},{"text":" map","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ExactMatchFactory","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.InexactMatchFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"PrincipalEvalPredicateFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Template beans for values of the ","type":"text"},{"text":"shibboleth.AuthnComparisonRules","type":"text","marks":[{"type":"strong"}]},{"text":" map","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.BetterClassRefMatchFactory","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.MinimumClassRefMatchFactory","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.MaximumClassRefMatchFactory","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.BetterDeclRefMatchFactory","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.MinimumDeclRefMatchFactory","type":"text"},{"type":"hardBreak"},{"text":"shibboleth.MaximumDeclRefMatchFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"PrincipalEvalPredicateFactory","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Beans supplying matching rules for implementing SAML 2.0 \"inexact\" comparisons of AuthnContextClassRef or AuthnContextDeclRef constants","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.IgnoredContexts","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"A collection of SAML 2.0 AuthnContextClassRef or AuthnContextDeclRef values to ignore if found in an message","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PrincipalProxyRequestMappings","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal?module=java.sql"}}]},{"text":",","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":">>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Mapping rules for transforming values in requests into new values in proxied requests","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[379.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PrincipalProxyResponseMappings","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal?module=java.sql"}}]},{"text":",","type":"text"},{"text":"Collection","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Collection?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":">>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[557.0]},"content":[{"type":"paragraph","content":[{"text":"Mapping rules for transforming values in proxied responses into new values","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"V4 Compatibility","type":"text"}]},{"type":"paragraph","content":[{"text":"Authentication is substantially compatible with V4 except for the removal of some advanced features that were replaced by the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" login flow and the LDAP login flow’s configuration. The LDAP wiring that was exposed in older versions is no longer compatible in most cases and has to be removed, essentially be starting over configuring LDAP settings from scratch.","type":"text"}]},{"type":"paragraph","content":[{"text":"The other major differences between V4 and V5 are reflected in the 4.0 to 4.1 transition and are not new to V5.","type":"text"}]},{"type":"paragraph"}],"version":1}