VelocityVariables
Nearly all interaction with the user agent (usually the browser, sometimes a program on the command line) is rendered via the Velocity template engine. This allows significant customizing of the output based on various properties that the IdP (and the Spring framework) make available. Prior to rendering browser pages with Velocity, the IdP makes several Velocity context variables available. Some are available in many views, while some are specific to an individual view (for instance login or attribute release consent).
In addition the Spring framework provides the deployer with the option to use additional macros. Probably the most useful macro is #springMessageText(token,'default value'), which looks up the appropriate (language specific) message property (overrideable via files in the messages directory) and returns that value or the default.
Examples of using variables and message properties can be found in the distributed templates (in the views directory).
Available variables are listed below. Many are advanced and unlikely to be needed by most deployers.
Variables Available in All Templates
Property | Description |
|---|---|
An HTMLEncoder, allows safe HTML encoding of various types. This is further described under https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510894. | |
cspDigester 5.1 | A StringDigester configured to produce base64-encoded SHA-256 hashes, suitable for use in generating CSP hashes |
cspNonce 5.1 | An IdentifierGenerationStrategy that produces nonces suitable for use with CSP |
profileRequestContext | A ProfileRequestContext, primarily used to locate subsidiary contexts: |
environment | The Spring Environment (javadoc here). This will be most frequently used to resolve properties (defined in idp.properties or other files), by calling the |
request | The HttpServletRequest. |
response | The HttpServletResponse |
flowRequestContext | The Spring Web Flow RequestContext (javadoc here). This is an advanced topic and out of scope for this page. |
flowExecutionUrl | The URL to redirect to in order to advance the flow (you’ll see this in form actions, typically) |
springMacroRequestContext | A help context supplied by Spring. Primarily used to render language specific resources from the message bundles. For instance |
custom | The Spring bean named shibboleth.CustomViewContext. This can be whatever you define it to be (in global.xml). That bean and its content should be treated as immutable. |
Variables Available to Password Login View
During password login, the templates login.vm and login-error.vm are used and have access to additional variables:
Property | Description |
|---|---|
username 5.1 | A pre-existing username to populate into the form, generally from an earlier iteration of the form |
rpContext 5.1 | A RelyingPartyContext object, providing access to basic information about the SP |
A RelyingPartyUIContext object. This object allows language sensitive rendering of specific information about the relying party (logos and so forth). This is described further here. | |
authenticationContext | An AuthenticationContext object. This object contains a large amount of information about the state of the authentication process. |
authenticationErrorContext | An AuthenticationErrorContext object. When present (which is only after a previous login error), this provides more detailed information on the failure which can then be displayed. The default views/login-error.vm file demonstrates how the contents of this context can be used to drive language specific message lookup (as in messages/authn-messages.properties). |
authenticationWarningContext | An AuthenticationWarningContext object. This isn't typically used within this view, but if warnings about account state are detected at the same time an error is also detected, it may be available. |
ldapResponseContext | An LDAPResponseContext object. This isn't typically used within this view, but if warnings about account state are detected at the same time an error is also detected, it may be available. |
errorMessageFunction 5.1 | A Function<ProfileRequestContext,String> which produces an error message based on the state of the request. This replaces the original login-error.vm template and the logic embedded in that view fragment with Java code but can be overridden via properties, and is backward-compatible |
Variables Available During Attribute Release Consent
Property | Description |
|---|---|
A RelyingPartyUIContext object. This object allows language sensitive rendering of specific information about the relying party (logos and so forth). This is described further here. | |
attributeDisplayNameFunction | A Function takes an IdPAttribute (usually from |
attributeDisplayDescriptionFunction | A Function that takes an IdPAttribute (usually from |
consentContext | A ConsentContext representing the state of a consent flow (current and previous consents). Further information TBD. |
attributeReleaseContext | An AttributeReleaseContext, this can be used to provide an iterable group of those attributes to which consent can be applied via the call |
attributeHelper | A bean named shibboleth.AttributeHelper. By default this is of type AttributeHelper but this can be set to be any bean via the property name idp.attribute.helper. |
Variables Available During Logout
Property | Description |
|---|---|
logoutContext | A LogoutContext, contains information to list the services accessed during the session that has been terminated |
multi-rpContext | A MultiRelyingPartyContext, allows lookup of the RelyingPartyContext for each service listed in the logoutContext |
Typically the RelyingPartyContext is further interrogated to get individual rpUIContexts.
#foreach ($sp in $logoutContext.getSessionMap().keySet())
#set ($rpCtx = $multiRPContext.getRelyingPartyContextById($sp))
#if ($rpCtx)
#set ($rpUIContext = $rpCtx.getSubcontext("net.shibboleth.idp.ui.context.RelyingPartyUIContext"))
#end
#if ($rpUIContext)
## Do stuff with rpuicontext - just like the login page
#end
#endVariables Available in Other Circumstances
Terms of Use
During terms of use consent the intercept/terms-of-use.vm view template three two properties available :
rpUIContext as used in the login case
termsOfUseId - a ConsentContext representing the state of a consent flow (current and previous consents). Further information TBD.
attributeHelper - see below
The attributeHelper
This variable is present in the ‘hello flow’ and the following intercept flows: attribute-release, expiring-password, impersonate, terms-of-use, warning-flow. It is also available in the error views for the CAS, SAML and Admin flows. By default this is of type AttributeHelper but this can be set to be any bean via the property name idp.attribute.helper. The default implementation gives easy access to the first attribute value for the specified attribute.
Examples
Locating the OpenSAML EntityDescriptor for the Relying Party
The EntityDescriptor is located in the MetadataContext. Finding this requires some navigation:
#set ($outboundContext = $profileRequestContext.getOutboundMessageContext())
#set ($samlPeerContext = $outboundContext.getSubcontext('org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext'))
#set ($metadataContext = $samlPeerContext.getSubcontext('org.opensaml.saml.common.messaging.context.SAMLMetadataContext'))
#set ($spEntity = $metadataContext.getEntityDescriptor())Show a particular HTML Element depending on the requesting SP's EntityId
#set ($spEntityId = $profileRequestContext.getSubcontext('net.shibboleth.profile.context.RelyingPartyContext').getRelyingPartyId())
...
#if ($spEntityId.equals("https://sp.examle.org/shibboleth"))
<a>particular HTML element</a>
#end