{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"611666b2-ade4-479c-9183-a98c5b82baa6"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"1465f70c-b206-40dd-9caf-16da5b50bfd9"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"A set of built-in transcoders supporting SAML 1 ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" objects is provided that support the most frequently needed value types. Most of them support a common set of properties, documented below; a few other properties are defined for specific transcoder types. Since they largely all do the same thing in the same way, they're documented here together.","type":"text"}]},{"type":"paragraph","content":[{"text":"A particular property of the SAML schema is that ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" cannot have values while ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" MUST have them, so there are some built-in enforcement checks.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements can be mapped to and from ","type":"text"},{"text":"IdPRequestedAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPRequestedAttribute"}}]},{"text":" objects but the conversion is lossy due to the lack of an isRequired property in SAML and the inability to express requested values.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Properties","type":"text"}]},{"type":"paragraph","content":[{"text":"In addition to the ","type":"text"},{"text":"generic properties","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1272054333#TranscodingRuleConfiguration-GenericandRequiredProperties"}}]},{"text":", all SAML 1 transcoders support the following:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1244.0,"localId":"50795046-58a0-4037-82b6-dab13384a991"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[384.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[525.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.name","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[384.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[525.0]},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"AttributeName","type":"text","marks":[{"type":"code"}]},{"text":" to map to and from","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.namespace","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[384.0]},"content":[{"type":"paragraph","content":[{"text":"urn:mace:shibboleth:1.0:attributeNamespace:uri","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[525.0]},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"AttributeNamespace","type":"text","marks":[{"type":"code"}]},{"text":" to map to and from","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.encodeType","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[384.0]},"content":[{"type":"paragraph","content":[{"text":"true ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[525.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to encode values with an ","type":"text"},{"text":"xsi:type","type":"text","marks":[{"type":"code"}]},{"text":" attached","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[238.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.nameFromMetadata ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[97.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[384.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[525.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to check for a metadata extension tag for naming rules","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Note the default for “saml1.namespace” above. If your desired inbound or outbound syntax does not include the ","type":"text"},{"text":"AttributeName","type":"text","marks":[{"type":"code"}]},{"text":" XML Attribute or relies on a different value, then you MUST set it explicitly in the rule.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Metadata-Based Naming ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"The transcoders also support an option to rely on SAML metadata extension tags to provide SP-specific naming rules. This is an alternative to the use of the relyingParties approach of naming specific SPs in a rule to limit its use. This feature can be combined with “default” naming via a rule such that the metadata is checked for a per-SP name in preference to the default in a rule, with the default applying in the absence of a tag value applying.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this approach only works for encoding into SAML, and does not support the decoding side because the “source name” of a SAML Attribute would then not be known to the system independently of a specific SP (the encoding direction works because the source name there is the internal attribute ID, which is required to be specified in the rule).","type":"text"}]},{"type":"paragraph","content":[{"text":"To use this feature, the rule must contain the ","type":"text"},{"text":"saml1.nameFromMetadata","type":"text","marks":[{"type":"strong"}]},{"text":" property set to true. The rule may or may not also contain the default ","type":"text"},{"text":"saml1.name","type":"text","marks":[{"type":"strong"}]},{"text":" (and ","type":"text"},{"text":"saml1.namespace","type":"text","marks":[{"type":"strong"}]},{"text":") properties as a fallback.","type":"text"}]},{"type":"paragraph","content":[{"text":"If in use, all SAML 1 transcoders will check for an extension Attribute/tag of the name “http://shibboleth.net/ns/attributes/naming/saml1” whose values contain a space-delimited tuple of the form “","type":"text"},{"text":"id name namespace","type":"text","marks":[{"type":"em"}]},{"text":"”. All three values MUST be present. A tag may contain multiple values, but only the first value containing the matching attribute ID will be applied.","type":"text"}]},{"type":"paragraph","content":[{"text":"Whether this approach is better for you really depends on how you manage and curate metadata and your ability to extend it, which is increasingly the key to most effectively operating the Shibboleth software.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example","type":"text"}]},{"type":"paragraph","content":[{"text":"Consider an SP (let’s call it Sluck), that requires mail, givenName, and sn to be supplied using invented Attribute names, in contravention to the SAML standard. To enable metadata-based naming override, the ","type":"text"},{"text":"saml1.nameFromMetadata","type":"text","marks":[{"type":"strong"}]},{"text":" property flag has to be added to each of the rules (all three in this case are in ","type":"text"},{"text":"conf/attributes/inetOrgPerson.xml","type":"text","marks":[{"type":"em"}]},{"text":"). The metadata for Sluck would then contain the following extension block:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n...\n \n \n \n \n \n \n mail email unspecified\n givenName first_name unspecified\n sn first_name unspecified\n \n \n \n \n \n...\n","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"AttributeNamespace","type":"text","marks":[{"type":"code"}]},{"text":" value in the rules in the example is arbitrary as this is not a real world example and the use of that field in SAML 1 was essentially unspecified, so other than our default, no other values really have ever been defined anywhere, and our default only applies to the use of URI naming.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Transcoder Types","type":"text"}]},{"type":"paragraph","content":[{"text":"There are 4 built-in subtypes of SAML 1 transcoders, as follows. Each one is predefined as a Spring bean for use in rules using the \"short\" name of the class, as enumerated in the ","type":"text"},{"text":"TranscodingRuleConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1272054333"}}]},{"text":" reference section.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SAML1StringAttributeTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"The simplest and most commonly used transcoder, it supports encoding and decoding internal values from and to the ","type":"text"},{"text":"StringAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.StringAttributeValue"}}]},{"text":" class. It supports no additional properties.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SAML1ScopedStringAttributeTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"It supports encoding and decoding internal values from and to the ","type":"text"},{"text":"ScopedStringAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.ScopedStringAttributeValue"}}]},{"text":" class. It supports the following additional properties (all optional):","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"567b9d89-f193-4dac-bd77-4af9a5b48743"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[215.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[179.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[107.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[656.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[215.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.scopeType","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[179.0]},"content":[{"type":"paragraph","content":[{"text":"\"inline\" or \"attribute\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[107.0]},"content":[{"type":"paragraph","content":[{"text":"\"attribute\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[656.0]},"content":[{"type":"paragraph","content":[{"text":"The \"style\"/syntax with which to encode and decode the scope portion","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[215.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.scopeAttributeName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[179.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[107.0]},"content":[{"type":"paragraph","content":[{"text":"Scope","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[656.0]},"content":[{"type":"paragraph","content":[{"text":"The name of the XML attribute to encode and decode the scope portion when saml1.scopeType is \"attribute\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[215.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.scopeDelimiter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[179.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[107.0]},"content":[{"type":"paragraph","content":[{"text":"@","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[656.0]},"content":[{"type":"paragraph","content":[{"text":"The character(s) to use to separate the value and scope when saml1.scopeType is \"inline\"","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SAML1ByteAttributeTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"It supports encoding and decoding internal values from and to the ","type":"text"},{"text":"ByteAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.ByteAttributeValue"}}]},{"text":" class, with a base64 transform applied. It supports no additional properties.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SAML1XMLObjectAttributeTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"It supports encoding and decoding internal values from and to the ","type":"text"},{"text":"XMLObjectAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.XMLObjectAttributeValue"}}]},{"text":" class. It supports the following additional properties (all optional):","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"cf824822-46c5-45f0-80ba-885de1a9a544"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[749.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"saml1.includeAttributeValue","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[94.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[749.0]},"content":[{"type":"paragraph","content":[{"text":"When decoding, controls whether the decoded XMLObject is actually the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element itself, or its child element","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported