{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"52738076-5404-4984-ad4a-3b3ac52e26e6"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"7f6fa4c8-56ee-4d78-ad0b-53fc312ee8b2"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"A transcoding rule is a collection of properties describing how to translate between an \"outside\" representation of a piece of data and an \"inside\" representation in the form of an ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" object. The ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" class is the main type of object that holds information about a subject, and may come from a variety of sources, though usually they're produced by the Attribute Resolver service.","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"outside\" representations can be anything, provided there are plugins available that know how to convert to and from another form. Historically the main example of this has been SAML ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements (both SAML 1 and SAML 2) but includes other types of objects as well.","type":"text"}]},{"type":"paragraph","content":[{"text":"The plugin type that implements these translations is the ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":", of which there are a number of specialized subtypes and concrete implementations that understand how to handle particular kinds of ","type":"text"},{"text":"IdPAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttributeValue"}}]},{"text":" subclasses.","type":"text"}]},{"type":"paragraph","content":[{"text":"An ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":" object is actually very generic and only cares about the syntax of the data it handles; it gets everything else it needs to know at runtime from a set of rules expressed in the form of a Map. The map is keyed by simple string names of properties that describe how to encode and decode the data, and the values are of any type, depending on the specific property. Most are Strings or Booleans, but can be anything.","type":"text"}]},{"type":"paragraph","content":[{"text":"Most transcoding rules concern themselves with addressing the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the \"id\" of the ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":", which identifies the data inside the IdP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the naming of the object outside the IdP, as in the case of a SAML 2.0 Attribute's Name and NameFormat","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":" that should be used to encode and decode the data values","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"There are some other kinds of properties, but the most important ones are just those three. The most common additional need is for the “relyingParties” property, which is a brute force way to control the application of the rule to only specific SPs (or IdPs in the case of proxying).","type":"text"}]},{"type":"paragraph","content":[{"text":"As a practical example, a standard transcoding rule for handling e-mail addresses in SAML using the Properties syntax discussed later might be:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Transcoder rule for \"mail\"","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"plaintext"},"content":[{"text":"id=mail\ntranscoder=SAML2StringTranscoder SAML1StringTranscoder\nsaml2.name=urn:oid:0.9.2342.19200300.100.1.3\nsaml1.name=urn:mace:dir:attribute-def:mail","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"transcoder\" property is referring to the bean names of the objects to use, which are documented on the ","type":"text"},{"text":"parent","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510514"}}]},{"text":" page, and the others are pretty self-explanatory if you've seen defaults in older versions of Shibboleth. Note that as with all historical Shibboleth practice in the IdP and SP, that rule implies a SAML 2.0 NameFormat of “urn:oasis:names:tc:SAML:2.0:attrname-format:uri” and a SAML 1.1 AttributeNamespace of “urn:mace:shibboleth:1.0:attributeNamespace:uri”.","type":"text"}]},{"type":"paragraph","content":[{"text":"A complete explanation of how this works and what the property names are follows.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Rule Formats","type":"text"}]},{"type":"paragraph","content":[{"text":"The two main approaches for defining rules are using Spring XML and Java Properties files. We expect most people will be happier to define one-off exceptions for local needs using the Properties syntax.","type":"text"}]},{"type":"paragraph","content":[{"text":"Because the Properties format is limited to expressing a single rule at a time, the XML approach using Spring syntax is more appropriate for defining lots of rules at once without ending up with a giant pile of small files. It's a good way to deliver standard rules both by us and potentially by other sources of commonly defined rules in the future. It also supports Spring property replacement, which can be useful as well.","type":"text"}]},{"type":"paragraph","content":[{"text":"Both formats ultimately require a Map be constructed and passed into the the underlying class, ","type":"text"},{"text":"TranscodingRule","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.TranscodingRule"}}]},{"text":".","type":"text"}]},{"type":"expand","attrs":{"title":"Spring XML"},"content":[{"type":"paragraph","content":[{"text":"A parent bean called ","type":"text"},{"text":"shibboleth.TranscodingRule","type":"text","marks":[{"type":"strong"}]},{"text":" to support direct use of the class, but in most cases (*) it's easier to use the ","type":"text"},{"text":"shibboleth.TranscodingProperties","type":"text","marks":[{"type":"strong"}]},{"text":" parent bean, which allows the rule to be defined using the Spring ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element. There's a little bit more syntax used in order to support merging of the properties back into a set of defaults we include to reduce the amount of work and duplication needed to define new rules.","type":"text"}]},{"type":"paragraph","content":[{"text":"(*) The main reason you might need the direct class is to use non-String values of properties, which is not a general need; the system converts things from String internally to simplify things.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"conf/attributes/default-rules.xml","type":"text","marks":[{"type":"em"}]},{"text":" file includes a number of examples of this syntax being used.","type":"text"}]},{"type":"paragraph","content":[{"text":"The other useful bean, also used in that file, is ","type":"text"},{"text":"shibboleth.TranscodingRuleLoader","type":"text","marks":[{"type":"strong"}]},{"text":", and the value of that bean with this syntax is that it allows multiple rules to be collected together in a list without each individual rule having to be given a Spring bean ID, which is just more work and hassle to assign while avoiding duplication.","type":"text"}]},{"type":"paragraph","content":[{"text":"The previous example for \"mail\" when defined in this syntax would be:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Spring XML version of \"mail\" rule","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\t\n\t\t\tmail\n\t\t\tSAML2StringTranscoder SAML1StringTranscoder\n\t\t\turn:oid:0.9.2342.19200300.100.1.3\n\t\t\turn:mace:dir:attribute-def:mail\n\t\t\n\t\n","type":"text"}]},{"type":"paragraph","content":[{"text":"The only functional difference is that this rule includes via merge a couple of additional default properties that are included in the IdP's system files.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Java Properties"},"content":[{"type":"paragraph","content":[{"text":"The alternative syntax for defining a single rule is just to use a Java Properties file (only the non-XML flat-file syntax is supported, because, obviously...)","type":"text"}]},{"type":"paragraph","content":[{"text":"An example of this was shown earlier. A key point: the name of the file is irrelevant. It doesn't make assumptions about the attribute ID based on the name or allow that property to be omitted. In practice of course it's sensible to name things appropriately for ease of maintenance.","type":"text"}]},{"type":"paragraph","content":[{"text":"The use of Properties files is also handled by the ","type":"text"},{"text":"shibboleth.TranscodingRuleLoader","type":"text","marks":[{"type":"strong"}]},{"text":" bean, which supports vacuuming up a directory tree of Properties file all at once.","type":"text"}]},{"type":"paragraph","content":[{"text":"This is illustrated for you in the ","type":"text"},{"text":"conf/attribute-registry.xml","type":"text","marks":[{"type":"em"}]},{"text":" file, and by default the ","type":"text"},{"text":"conf/attributes/custom/","type":"text","marks":[{"type":"strong"}]},{"text":" directory is already designated as a place for these files to be created. You can create any subfolders you want for organization because it will walk the whole tree.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can of course create other loader beans that load different directories if desired.","type":"text"}]},{"type":"paragraph","content":[{"text":"A minor limitation of this approach is that it does not allow the ","type":"text"},{"text":"idp.service.attribute.registry.encodeType","type":"text","marks":[{"type":"strong"}]},{"text":" Spring property to be honored by custom rules. If you want to alter the default for the SAML transcoders' “encodeType” setting, you will need to explicitly set that property in the rule as documented for those transcoders.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Generic and Required Properties","type":"text"}]},{"type":"paragraph","content":[{"text":"Most of the properties used in rules are actually not generic but are a consequence of which ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":"s are used; each such object defines a contract with regard to what properties it supports and especially what properties it requires to operate. Errors won't generally be detected until runtime and then logged and generally ignored. The rule will simply be non-functional.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are a small set of generic properties, some required and some optional. The \"Type\" refers to the underlying object that the system expects to be able to produce as a value of the property, but String is almost always a supported format to use for convenience.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1219.0,"localId":"8ab0b721-f36e-4b62-b028-fdb8d6371871"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"Req?","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"Y","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" id/name that is used internally. This dictates when the rule will be applied to attributes within the IdP for outbound encoding, as well as what to call an attribute created during inbound decoding.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"transcoder","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"Y","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Space-delimited list of Bean IDs, or an ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"This defines which ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":" objects should be used to encoder and decode data when the rule runs, and dictates most of the rest of the properties that will be required or supported.","type":"text"}]},{"type":"paragraph","content":[{"text":"In most cases this is expressed by specifying one or more Spring bean IDs in a list; the implementation will turn those into the right objects if they exist.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"activationCondition ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":"> or a Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Standard across the system, this is a condition to evaluate at runtime to control whether to apply the rule","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"encoder","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to true, can be set false to limit use of the rule to decoding only","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"decoder","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Defaults to true, can be set false to limit use of the rule to encoding only","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"relyingParties","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"Collection or a space-delimited list of Strings","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Shortcut for applying an activation condition that matches a set of relying party names against the request","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"displayName[.lang]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Language-specific values to use as display names for the ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[199.0]},"content":[{"type":"paragraph","content":[{"text":"description[.lang]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[289.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[664.0]},"content":[{"type":"paragraph","content":[{"text":"Language-specific values to use as descriptions for the ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]}]}]}]}]},{"type":"paragraph","content":[{"text":"The latter two are optionally language-aware; if the raw property name is used, then the corresponding value is used any time the default Locale is in effect for a request. Otherwise a dot separator must be followed by a language code, which may also include country code.","type":"text"}]},{"type":"paragraph","content":[{"text":"The rest of the supported properties can be found in the documentation specific to the various categories of ","type":"text"},{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]},{"text":"s:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML1AttributeTranscoderConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510627"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML2AttributeTranscoderConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510658"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"CASAttributeTranscoderConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510600"}}]}]}]}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"OIDC OP","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976"}}]},{"text":" plugin also includes a set of ","type":"text"},{"text":"claim transcoders","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879159"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"Also discussed above, there are several beans defined to support the creation of the mapping rules contained in the registry.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1244.0,"localId":"741305c1-1647-4945-bccc-ad8053687c94"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[197.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[197.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.TranscodingProperties","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"Properties","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Properties"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining transcoding rules using a Java Properties object","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[197.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.TranscodingRule","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"TranscodingRule","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.TranscodingRule"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for low-level Spring-based creation of transcoding rules; shibboleth.TranscodingProperties is generally used instead","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[197.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.TranscodingRuleLoader","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"TranscodingRuleLoader","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.impl.TranscodingRuleLoader"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for defining collections of rules either as a collection of maps or by loading property files from a directory","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[197.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2StringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML2ScopedStringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML2ByteTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML2XMLObjectTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML2DateTimeTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML1StringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML1ScopedStringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML1ByteTranscoder","type":"text"},{"type":"hardBreak"},{"text":"SAML1XMLObjectTranscoder","type":"text"},{"type":"hardBreak"},{"text":"CASStringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"CASScopedStringTranscoder","type":"text"},{"type":"hardBreak"},{"text":"CASDateTimeTranscoder","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[126.0]},"content":[{"type":"paragraph","content":[{"text":"AttributeTranscoder","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.transcoding.AttributeTranscoder"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[407.0]},"content":[{"type":"paragraph","content":[{"text":"Built-in collection of transcoders usable in rules","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Other Examples","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Non-Standard Naming","type":"text"}]},{"type":"paragraph","content":[{"text":"While we advise against doing so, you will run into constant pressure from vendors to support one-off Attribute names. When you agree to do that, you should understand that it won’t stop, and you will end up over time with dozens of these rules to maintain and a brittle configuration prone to problems. Standards exist for that reason.","type":"text"}]},{"type":"paragraph","content":[{"text":"Having said that, it is possible to support exception-based naming in a number of ways, and if you keep it to a minimum it may be sufficient to just name the SPs for which a rule should apply and create a property file (e.g., in ","type":"text"},{"text":"conf/attributes/custom/mail.properties","type":"text","marks":[{"type":"em"}]},{"text":") to add the rule like so:","type":"text"}]},{"type":"codeBlock","content":[{"text":"id = mail\ntranscoder = SAML2StringTranscoder SAML1StringTranscoder\nsaml2.name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\nsaml2.friendlyName = mail\nsaml2.encodeType = false\nsaml2.relyingParties = https://broken.example.org/sp","type":"text"}]},{"type":"paragraph","content":[{"text":"This is merely an alternative approach to using an ","type":"text"},{"text":"AttributeEncoder","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504645"}}]},{"text":" to do the same thing, just outside instead of inside the resolver configuration.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Metadata-Driven Naming ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"Yet another way to handle exception-based naming rules is with SAML metadata. Each set of transcoders for a protocol supports its own property for instructing the system to check for a metadata “tag” extension that carries values specifying naming rules specific to that SP. This approach only applies to encoding of data, not decoding. Refer to the protocol-specific transcoder topics linked above for the details and examples.","type":"text"}]}],"version":1}

Browser not supported