{"type":"doc","content":[{"type":"expand","attrs":{"title":"Table of Contents"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"c0cd0bbb-7dc5-4838-945b-261b13a018a6"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"dbd1b8f6-10d1-4899-ae9b-b99463205d39"}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"One of the challenges of dealing with interoperability issues with SPs is maintaining all the custom configuration rules needed to drive the IdP's behavior in all kinds of different ways. Traditionally most of these kinds of settings were concentrated in the ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":" file and involve defining \"overrides\" for SPs or groups of SPs, often through manually maintained lists of entityIDs.","type":"text"}]},{"type":"paragraph","content":[{"text":"As discussed in the ","type":"text"},{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508044"}}]},{"text":" topic in the section on dynamically-driven profile configuration, the IdP supports the ability to produce these settings on the fly at runtime, which creates opportunities for more flexible configuration, at some cost in complexity.","type":"text"}]},{"type":"paragraph","content":[{"text":"The best way to leverage the features described in that section involves the use of metadata \"tags\" (a shorthand name for the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" SAML metadata extension) to embed signals in metadata that can drive configuration. In the longer term, any hope for a simplified approach to configuration or even a GUI rests on a strategy of this general type.","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP supports a built-in layer of code and Spring wiring to enable the use of the metadata-driven approach to configuration in a systematic way that provides a set of conventions for tag names and values to use to drive a significant range of configuration settings. With a few up-front adjustments to the ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":" file, it's possible to enable comprehensive support for metadata-driven configuration that can be freely intermixed in most cases with more static settings as required.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Bear in mind that enabling this feature requires a total degree of trust and control over one's sources of metadata, because the information in the metadata can have a wide-ranging impact on the behavior of the IdP, by design. It essentially offloads pieces of your configuration to the metadata, with all that that entails.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Support for this feature has been added to the runtime environment in a way that avoids overhead (and risk) if not used but allows for straightforward enablement on a per-profile basis. The existing parent beans used for defining relying party defaults, overrides, and profile configurations all have analogs with a \".MDDriven\" suffix in their names. Changing the existing parent or referenced bean name by adding the suffix and reloading the configuration will cause the runtime to evaluate most of the commonly-used configuration settings by checking for appropriately-named \"tags\" in the SP's metadata before falling back to the default, or statically configured, value if no tag is found.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, if you would like to enable tag-driven configuration for SAML 2.0 Browser SSO, you can replace any reference to the ","type":"text"},{"text":"SAML2.SSO","type":"text","marks":[{"type":"strong"}]},{"text":" bean with ","type":"text"},{"text":"SAML2.SSO.MDDriven,","type":"text","marks":[{"type":"strong"}]},{"text":" as in this example:","type":"text"}]},{"type":"expand","attrs":{"title":"Enable tag-driven features in relying-party.xml"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Attribute / Property Convention","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"bridge\" between the metadata and this feature is the naming and syntax of the attribute tags used to control the configuration properties in the IdP. As an implementation strategy this could be \"brute forced\" with arbitrary mapping dictionaries, but the supplied implementation takes the approach of automating a mapping between the names of settings and the identifiers used internally for the various profiles, and the names of the corresponding SAML Attributes in metadata for those profile/setting combinations.","type":"text"}]},{"type":"paragraph","content":[{"text":"Each setting has a \"base\" name matching its Java bean property name as would be used if the setting were explicitly configured in Spring. For example, the property set via ","type":"text"},{"text":"p:defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" is named \"defaultAuthenticationMethods\".","type":"text"}]},{"type":"paragraph","content":[{"text":"The corresponding SAML Attribute for a setting is named by suffixing the \"base\" name of the setting to a profile URL that is defined by the Shibboleth software for each of the supported profiles.","type":"text"}]},{"type":"paragraph","content":[{"text":"The URLs are as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"b5f16b51-c809-405e-bf7b-0974326a3e77"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Profile","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"Profile URL","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"Shibboleth.SSO","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508725"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml1/sso/browser","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML1.AttributeQuery","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508483"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml1/query/attribute","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML1.ArtifactResolution","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508450"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml1/query/artifact","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.SSO","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508680"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml2/sso/browser","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.ECP","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508598"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml2/sso/ecp","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.AttributeQuery","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508559"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml2/query/attribute","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.ArtifactResolution","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508520"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml2/query/artifact","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.Logout","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508637"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"http://shibboleth.net/ns/profiles/saml2/logout","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.LoginConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506470"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"https://www.apereo.org/cas/protocol/login","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.ProxyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506470"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"https://www.apereo.org/cas/protocol/proxy","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[227.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.ValidateConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506470"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"https://www.apereo.org/cas/protocol/serviceValidate","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"It follows that the ","type":"text"},{"text":"includeAttributeStatement","type":"text","marks":[{"type":"code"}]},{"text":" property of the \"Shibboleth.SSO\" profile configuration can be set via a metadata Attribute named \"","type":"text"},{"text":"http://shibboleth.net/ns/profiles/saml1/sso/browser/includeAttributeStatement","type":"text","marks":[{"type":"code"}]},{"text":"\"","type":"text"}]},{"type":"paragraph","content":[{"text":"As an additional convention, a setting can be configured for all profiles simultaneously by prefixing it with the URL \"","type":"text"},{"text":"http://shibboleth.net/ns/profiles","type":"text","marks":[{"type":"code"}]},{"text":"\"","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"We reserve the right to define behavior for any current or future SAML Attributes named in the ","type":"text"},{"text":"shibboleth.net","type":"text","marks":[{"type":"code"}]},{"text":" domain or any other URI we own and control, so if any developers wish to develop general purpose extensions or behavior based on such tags, you should either rely on your own tag names or seek permission from the project.","type":"text"}]}]},{"type":"expand","attrs":{"title":"SAML Attribute NameFormat Usage"},"content":[{"type":"paragraph","content":[{"text":"While the SAML Attribute ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"code"}]},{"text":" is handled as above, the ","type":"text"},{"text":"NameFormat","type":"text","marks":[{"type":"code"}]},{"text":" of all supported properties is presumed to be ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:attrname-format:uri","type":"text","marks":[{"type":"code"}]},{"text":" to prevent conflicts.","type":"text"}]},{"type":"paragraph","content":[{"text":"There is a property in ","type":"text"},{"text":"conf/services.xml","type":"text","marks":[{"type":"em"}]},{"text":" that is shipped enabled, but internally off by default for compatibility. When ","type":"text"},{"text":"idp.service.relyingparty.ignoreUnmappedEntityAttributes","type":"text","marks":[{"type":"strong"}]},{"text":" is true, which is suggested, the system will ignore any tags that have an improper ","type":"text"},{"text":"NameFormat","type":"text","marks":[{"type":"code"}]},{"text":" unless they are explicitly decoded with a custom rule in the ","type":"text"},{"text":"AttributeRegistryConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510514"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"A side effect of this setting is that the IdP will operate somewhat faster in locating (or not locating) tags for all of its settings using decoded and indexed data instead of having to inefficiently search the native XML-based data structures for a match. As a result, it is strongly advised that the proper ","type":"text"},{"text":"NameFormat","type":"text","marks":[{"type":"code"}]},{"text":" be used and the property enabled.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Type Conversion"},"content":[{"type":"paragraph","content":[{"text":"The supplied implementations support various built-in type conversions supporting a natural mapping between simple XML syntax and Java data types. Different kinds of settings support particular XML syntaxes as described below.","type":"text"}]},{"type":"paragraph","content":[{"text":"The only XML syntaxes supported are \"simple content\" models involving an ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" containing only text content, but it is possible to apply specific ","type":"text"},{"text":"xsi:type","type":"text","marks":[{"type":"code"}]},{"text":" designations that trigger more precise handling (such as enforcing numeric or boolean data). Note that using ","type":"text"},{"text":"xsi:type","type":"text","marks":[{"type":"code"}]},{"text":" in this fashion requires declaring an appropriate namespace and prefix for the XSD namespace, ","type":"text"},{"text":"http://www.w3.org/2001/XMLSchema","type":"text","marks":[{"type":"code"}]},{"text":", which is conventionally bound to the ","type":"text"},{"text":"xsd","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"xs","type":"text","marks":[{"type":"code"}]},{"text":" prefixes.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"6e021c9c-f29d-4298-9999-73c941435a49"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Setting Data Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Supported XML Conversions","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Notes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer, dateTime, base64binary","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Booleans are mapped to the strings \"0\" or \"1\".","type":"text"}]},{"type":"paragraph","content":[{"text":"Dates are mapped into the Unix epoch, then converted to String.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Strings are processed as a valid XML boolean value (0, 1, true, false) or treated as false.","type":"text"}]},{"type":"paragraph","content":[{"text":"Non-zero integers are true, zero is false.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Strings are decoded via Integer.decode() method.","type":"text"}]},{"type":"paragraph","content":[{"text":"Booleans are mapped to 0 or 1.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Long","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer, dateTime","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Strings are decoded via Long.decode() method.","type":"text"}]},{"type":"paragraph","content":[{"text":"Booleans are mapped to 0 or 1.","type":"text"}]},{"type":"paragraph","content":[{"text":"Dates are mapped to the Unix epoch, then converted to a Long.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Double","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Strings are decoded via Double.valueOf() method.","type":"text"}]},{"type":"paragraph","content":[{"text":"Booleans are mapped to 0.0 or 1.0.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Strings are converted from the ISO Duration notation used throughout the software.","type":"text"}]},{"type":"paragraph","content":[{"text":"Integers are treated as a millisecond duration.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer, dateTime, base64binary","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Supports multiple ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements, and each value is converted to a String and then used to construct an object of the type specified for the property via a String-based single-argument constructor.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Set","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string, boolean, integer, dateTime, base64binary","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Supports multiple ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements, and each value is converted to a String and then used to construct an object of the type specified for the property via a String-based single-argument constructor.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Bean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[207.0]},"content":[{"type":"paragraph","content":[{"text":"Untyped, string","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Converted to a String used as a name of a Spring bean to build or access","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Applying Tags","type":"text"}]},{"type":"paragraph","content":[{"text":"There are two ways to apply tags to metadata: directly and indirectly.","type":"text"}]},{"type":"paragraph","content":[{"text":"The direct method applies to cases in which you control the metadata or when the source of the metadata supports the inclusion of the necessary extensions. The tags simply appear within the metadata being loaded into the IdP using an ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension element:","type":"text"}]},{"type":"expand","attrs":{"title":"Direct embedding of configuration tags"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n http://example.org/ac/classes/mfa\n \n \n false\n \n \n \n \n\t \n \n","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The indirect method uses the ","type":"text"},{"text":"EntityAttributesFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507147"}}]},{"text":" to attach the tags at runtime after loading and verifying the metadata. This is useful for cases in which you want to rely on externally supplied metadata but still organize parts of your configuration around the metadata. One use for this is simply consistency: if you have both external and local metadata, you can drive the configuration with both.","type":"text"}]},{"type":"expand","attrs":{"title":"Indirect example of applying tags using a filter"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\n\t\n\t\tmd:SPSSODescriptor\n\t\n\t\n\t\t\n\t\t\thttp://example.org/ac/classes/mfa\n\t\t\n\t\t\n\t\t\tfalse\n\t\t\n\t\thttps://sp.example.org/sp\n\t\n","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Relying Party Configuration Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"The following examples illustrate possible ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" syntaxes that can be used to configure a variety of common features. The examples apply equally to either the direct or indirect methods of attaching the attributes to the metadata.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"signAssertions"},"legacyAnchorId":{"value":"MetadataDrivenConfiguration-signAssertions"}},"macroMetadata":{"macroId":{"value":"5045b2f2-0181-4e0f-8ded-7bbf276448d0"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"62f095f3-2847-4dcb-8e49-a62b2c86b388"}},{"text":"Signed Assertions vs. Responses","type":"text"}]},{"type":"paragraph","content":[{"text":"Enabling signed assertions for a particular SP is advisedly handled by setting the ","type":"text"},{"text":"WantAssertionsSigned","type":"text","marks":[{"type":"code"}]},{"text":" XML attribute in metadata, but isn't always possible and sometimes has to be combined with disabling signed responses (or just for efficiency).","type":"text"}]},{"type":"expand","attrs":{"title":"SAML 2 Browser SSO: Sign assertions and not responses"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\tfalse\n\n\n\ttrue\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"encryptAssertions"},"legacyAnchorId":{"value":"MetadataDrivenConfiguration-encryptAssertions"}},"macroMetadata":{"macroId":{"value":"119b108c-6d92-4d1c-a2a1-8b21a05ce497"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"638127f0-7be9-40d7-9235-99af3734149a"}},{"text":"Disabling Encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"Setting ","type":"text"},{"text":"idp.encryption.optional","type":"text","marks":[{"type":"strong"}]},{"text":" is usually a workaround for handling the majority of SPs without encryption support, but there are a couple of scenarios in which it's useful to be able to manually disable it. Some federations (InCommon for one, at least for the time being) have limitations such that SPs without encryption support are stuck registering keys they don't support. Some SPs support encryption but build in time-bombs by forcing flag day key rotations on all IdPs that cause outages or manual work. Or you may simply want to drive this more explicitly for only a subset of SPs and not as a global change.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that it may be helpful to make sure encryption also doesn't get used during logout, so the second tag may be useful.","type":"text"}]},{"type":"expand","attrs":{"title":"All profiles: turn off encryption"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\tfalse\n\n\n\tfalse\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"NameID Format Selection","type":"text"}]},{"type":"paragraph","content":[{"text":"Using ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements in metadata (which can also be added at runtime with the ","type":"text"},{"text":"NameIDFormatFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507246"}}]},{"text":") is the normal way to use metadata to select the Format to use, but the \"unspecified\" Format has to be triggered with a profile setting. That's not commonly needed, but it's easy to define a tag for in such cases (and if you prefer you can obviously designate any Format this way).","type":"text"}]},{"type":"expand","attrs":{"title":"All profiles: use the \"unspecified\" NameID Format"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\turn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n","type":"text"}]}]},{"type":"paragraph","content":[{"text":"One concern is that any two SPs using it are only coincidentally going to want the same data, so this isn't always solely a matter of Format selection. In such cases, it may be necessary to add ","type":"text"},{"text":"activationCondition","type":"text","marks":[{"type":"code"}]},{"text":" properties based on SP to specific ","type":"text"},{"text":"generators","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507855"}}]},{"text":" that are handling the same Format.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Bug Workarounds","type":"text"}]},{"type":"paragraph","content":[{"text":"Some of the other profile settings are workarounds for bugs, e.g., omitting the ","type":"text"},{"text":"NotBefore","type":"text","marks":[{"type":"code"}]},{"text":" attribute. This is not very common but easily tag-driven.","type":"text"}]},{"type":"expand","attrs":{"title":"All profiles: omit the NotBefore attribute"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\tfalse\n","type":"text"}]}]},{"type":"paragraph","content":[{"text":"A more obscure example would be an SP that requires additional ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" values in addition to its own entityID. This mainly demonstrates that some settings may be multi-valued.","type":"text"}]},{"type":"expand","attrs":{"title":"All profiles: add additional Audience values"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\thttps://example.org/bogusAudience1\n\thttps://example.org/bogusAudience2\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Forcing MFA","type":"text"}]},{"type":"paragraph","content":[{"text":"Handling SPs that require MFA but can't request it requires IdP-side configuration, usually involving a couple of settings. The URL below is just an example, it has to be replaced by whatever ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" constant is used in a deployment to signal MFA, or possibly more than one.","type":"text"}]},{"type":"expand","attrs":{"title":"All profiles: forcing MFA"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\thttp://example.org/ac/classes/mfa\n\n\n\n\t0x1\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Interceptor Flows","type":"text"}]},{"type":"paragraph","content":[{"text":"Triggering ","type":"text"},{"text":"consent","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509862"}}]},{"text":" based on the SP is pretty common.","type":"text"}]},{"type":"expand","attrs":{"title":"SAML and CAS SSO: enable attribute consent"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\tattribute-release\n","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"authorization","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927"}}]},{"text":" intereptor flow is another case, though the checking logic would have to be extended for each different service/scenario. In the example, both flows are enabled.","type":"text"}]},{"type":"expand","attrs":{"title":"SAML and CAS SSO: enable authorization checking and attribute consent"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\tcontext-check\n\tattribute-release\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n","type":"text"}]}]},{"type":"expand","attrs":{"title":"Attribute to enable SAML 1.1"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\ttrue\n","type":"text","marks":[{"type":"code"}]},{"text":" metadata element, which is usually impractical for a variety of reasons.","type":"text"}]},{"type":"paragraph","content":[{"text":"Less critically, note that this policy example demonstrates an optimization in that it applies the tag check in the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":"(s) and not up in the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":". This has the advantage of requiring less XML to express and is about the same or better in performance than running multiple policies. It's not as good for an attribute that might have 3-5 or more values, since that would force the cost of checking for the tag to be paid for each value.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n\t\n\n\t\n\t\t\n\t\n\n\t\n\t\t\n\t\n\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Beans","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"2439c757-e19b-43a1-b4e2-ba0ea24d7d98"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingParty.MDDriven ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for use in defining metadata-driven RelyingParty overrides by hand","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyByName.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for defining metadata-driven RelyingParty overrides based on matching by name","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyByGroup.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for defining metadata-driven RelyingParty overrides based on matching by ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" groups or SAML metadata-based ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" groups","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyByEntitiesDescriptor.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for defining metadata-driven RelyingParty overrides based on matching by ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" groups only","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyByTag.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for defining metadata-driven RelyingParty overrides based on matching ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension content","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyByMappedTag.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"RelyingPartyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A template bean for defining metadata-driven RelyingParty overrides based on matching ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension content mapped via the ","type":"text"},{"text":"AttributeRegistryConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510514"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"Shibboleth.SSO.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"BrowserSSOProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 1.1 SSO profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML1.AttributeQuery.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"AttributeQueryProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 1.1 Attribute Query profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML1.ArtifactResolution.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ArtifactResolutionProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 1.1 Artifact Resolution profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.SSO.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"BrowserSSOProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 2.0 SSO profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.ECP.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ECPProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 2.0 Enhanced Client/Proxy profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.Logout.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"SingleLogoutProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 2.0 Single Logout profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.AttributeQuery.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"AttributeQueryProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 2.0 Attribute Query profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2.ArtifactResolution.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ArtifactResolutionProfileConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for SAML 2.0 Artifact Resolution profile","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.LoginConfiguration.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"LoginConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.cas.config.impl.LoginConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for CAS login prototol","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.ProxyConfiguration.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ProxyConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.cas.config.impl.ProxyConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for CAS proxy login protocol","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"CAS.ValidateConfiguration.MDDriven","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ValidateConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.cas.config.impl.ValidateConfiguration"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Default metadata-driven configuration for CAS ticket validation protocol","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.DefaultMDProfileAliases","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"A built-in list of alternate URL \"prefixes\" to property names, this is used to automate the generation of property tag names that apply to all profiles at the same time.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDProfileAliases","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"An optional user-supplied list of additional URL prefixes to support custom property tag names","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenStringProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"StringConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.StringConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for string settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenBoolProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"BooleanConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.BeanConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for boolean settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenIntProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"IntegerConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.IntegerConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for integer settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenLongProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"LongConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.LongConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for long integer settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenDoubleProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"DoubleConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.DoubleConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for double settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenDurationProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"DurationConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.DurationConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for Duration settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenListProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"ListConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.ListConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for List settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenSetProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"SetConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.SetConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for Set settings","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[359.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.MDDrivenBeanProperty","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"BeanConfigurationLookupStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.config.BeanConfigurationLookupStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[622.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining new lookup strategies for arbitrary Spring bean settings","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}