{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/admin/admin.properties, conf/admin/hello-world.js, views/admin/hello.vm","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring, Velocity, Properties","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"3def47c9-e103-472a-8391-25da35bee479"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"da697a65-514e-4b58-a1f5-c28b3b35f651"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"hello\" or \"hello world\" flow is a feature provided to ease the initial deployment and testing of the core \"back-end\" behavior of the IdP, such as ","type":"text"},{"text":"authentication","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199505085"}}]},{"text":" and ","type":"text"},{"text":"attribute resolution","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":". Because it does not require an SP to function, it's possible to log in, resolve attributes, and dump the result to the user locally, which avoids the awkward \"just testing\" stage that has traditionally complicated the early use of the software.","type":"text"}]},{"type":"paragraph","content":[{"text":"Depending on installation choices, it's also possible to enable it out of the box along with a dummy username, password, and attribute configuration for initial evaluation.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling Module","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuring and using this feature requires that you first enable the \"idp.admin.Hello\" module if it isn't already enabled.","type":"text"}]},{"type":"codeBlock","content":[{"text":"(Windows)\nC:\\opt\\shibboleth-idp> bin\\module.bat -t idp.admin.Hello || bin\\module.bat -e idp.admin.Hello\n \n(Other)\n$ bin/module.sh -t idp.admin.Hello || bin/module.sh -e idp.admin.Hello","type":"text"}]},{"type":"paragraph","content":[{"text":"By default this feature is available at the relative path ","type":"text"},{"text":"/idp/profile/admin/hello","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"In addition, use of this module relies on the use of Javascript, so you will have to select and install one of our ","type":"text"},{"text":"scripting plugins","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDPPLUGINS"}}]},{"text":" for that purpose due to Java’s removal of Javascript support.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The flow is functional by default but some of its behavior can be adjusted via ","type":"text"},{"text":"admin/admin.properties","type":"text","marks":[{"type":"em"}]},{"text":". Note however that this file is ignored by upgraded systems unless steps noted in the ","type":"text"},{"text":"AdministrativeConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199510151"}}]},{"text":" topic are taken to allow it to be found and loaded. Absent this, the flow will operate with default values of each property.","type":"text"}]},{"type":"paragraph","content":[{"text":"If you prefer to customize this flow via XML or wish to apply settings not supported by properties, you can override the flow descriptor by creating your own bean (see the Flow Descriptor example in the Reference ","type":"text"},{"text":"below","type":"text","marks":[{"type":"link","attrs":{"href":"#HelloWorldConfiguration-FDXML"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"The defaults assume that the rule for accessing the flow is that the user must login first, attributes will be resolved, and that a map entry will be defined in ","type":"text"},{"text":"conf/access-control.xml","type":"text","marks":[{"type":"em"}]},{"text":" keyed under \"AccessByAdminUser\" that defines who can access the flow. The access control features are described under ","type":"text"},{"text":"AccessControlConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199501767"}}]},{"text":", and are obviously fully generic (even wide open if desired).","type":"text"}]},{"type":"paragraph","content":[{"text":"There's total flexibility on this, it's up to you to define the behavior. You can even set properties that typically are used in ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":" like ","type":"text"},{"text":"defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" to control what kind of authentication has to be done (e.g. requiring MFA) and many other general features of the software related to ","type":"text"},{"text":"authentication","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199508270"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Simulating Errors","type":"text"}]},{"type":"paragraph","content":[{"text":"This flow is so basic that it doesn't really have any required configuration in its own right, instead allowing testing of much of the rest of the configuration needed for a functioning IdP.","type":"text"}]},{"type":"paragraph","content":[{"text":"One optional feature is support for a server-side scriptlet file in ","type":"text"},{"text":"conf/admin/hello-world.js","type":"text","marks":[{"type":"em"}]},{"text":". If supplied, this is a script taking as input the ","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":" just prior to the completion of the flow. If the script returns a null value, the flow completes. If the script returns any other string value, the string will become an error \"event\" that completes the flow abnormally.","type":"text"}]},{"type":"paragraph","content":[{"text":"This allows the IdP's ","type":"text"},{"text":"ErrorHandlingConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199506653"}}]},{"text":" to be simulated by observing the result of processing a terminating error event.","type":"text"}]},{"type":"paragraph","content":[{"text":"It is also possible for the script to perform any other desired manipulation of the internal state of the IdP, which facilitates experimentation and exploration of the internals.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User Interface","type":"text"}]},{"type":"paragraph","content":[{"text":"The user interface for this flow is supplied by the template in ","type":"text"},{"text":"views/admin/hello.vm","type":"text","marks":[{"type":"em"}]},{"text":" and the default view illustrates a simple dump of information from the authentication and attribute resolution process.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"The general properties configuring this flow via ","type":"text"},{"text":"admin/admin.properties","type":"text","marks":[{"type":"em"}]},{"text":" are:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","localId":"caf50ad1-21e4-4421-bca1-b0bc71d3afe8"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.logging","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"Hello","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Audit log identifier for flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.accessPolicy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"AccessByAdminUser","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Name of access control policy for request authorization","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.authenticated","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Whether authentication should be performed prior to access control evaluation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.nonBrowserSupported","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow should allow for non-browser clients during authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.resolveAttributes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Whether attributes should be resolved prior to access control evaluation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.defaultAuthenticationMethods","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited list of protocol-specific ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" strings to require from authentication to this flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[330.0]},"content":[{"type":"paragraph","content":[{"text":"idp.Hello.postAuthenticationFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[190.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[683.0]},"content":[{"type":"paragraph","content":[{"text":"Comma separated list of ","type":"text"},{"text":"post authentication interceptor flows","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP5/pages/3199509815"}}]},{"text":" that should be run","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Flow Descriptor XML"},"content":[{"type":"paragraph","content":[{"text":"To replace the internally defined flow descriptor bean, the following XML is required:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n \n\n","type":"text"}]},{"type":"paragraph","content":[{"text":"No default version of the list bean is provided and it may simply be placed in ","type":"text"},{"text":"conf/global.xml","type":"text","marks":[{"type":"em"}]},{"text":" if needed.","type":"text"}]}]}],"version":1}