AACLI

Overview

The IdP includes a command line tool included in older versions called "aacli", which stood for Attribute Authority Command Line Interface. The command line tool is a wrapper around a web interface that operates an administrative flow that runs the Attribute Resolver and Attribute Filter services, and produces output in various forms.

The underlying web interface, which is managed as an AdministrativeConfiguration, looks like this:

http[s]://localhost/idp/profile/admin/resolvertest?principal=jdoe&requester=https%3A%2F%2Fsp.example.org%2Fsp

The same thing on the command line would be:

$ /opt/shibboleth-idp/bin/aacli.sh -n jdoe -r https://sp.example.org/sp

The parameters supported and their corresponding command line options are:

Query String

Command Line

Description

Query String

Command Line

Description

requester

--requester, -r

Required, identifies the relying party (SP) to simulate a resolution for

principal

--principal, -n

Required, names the subject/user to simulate a resolution for

acsIndex

--acsIndex, -i

Identifies the index of an <md:AttributeConsumingService> element in the SP's metadata, which allows certain uncommonly used filtering rules to be run

saml1

--saml1

Value is ignored, if present causes the output to be encoded into a SAML 1.1 assertion

saml2

--saml2

Value is ignored, if present causes the output to be encoded into a SAML 2.0 assertion

unfiltered 5.1

--unfiltered

Value is ignored, if present causes the non-SAML output to include all attributes, not just filtered results

The tool essentially reproduces the results that would ordinarily be produced during a SSO or Attribute Query request. There are a couple of caveats to the reproduction of the results:

  • It bypasses any caching of results by data connectors so can occasionally provide different output, but this can help identify issues involving caching.

  • It can produce the same output under the assumption that plugins don't do unusual things that would be impossible to reproduce outside of a real transaction.

As an example of the second, if the resolution of data depended on some characteristic of the client, such as a network address, that would be unlikely to behave consistently, as would a scenario where the resolution of the data depended on details from the authentication process aside from just the canonicalized principal name.

For the vast majority of deployments, this tool can produce very accurate, often 100% accurate, results.

The format of the output is controlled by the presence or absence of the "saml1" and "saml2" options. With neither present, the output is derived directly from the internal attributes produced by the resolver, and are rendered using a simple JSON notation that is neutral in form and doesn't follow any particular standard. Otherwise, the configured encoding into SAML is done.

While this includes the production of a <NameID> or <NameIdentifier>, based on the overall configuration of the system, it will not account for the case of an SP explicitly requiring a particular format via its request messages.

Sorting Output

Output may be sorted using jq or xq (part of yq).

To sort JSON : ... | jq 'walk( if type == "array" then sort else . end )'

To sort SAML : ... | xq -x 'walk( if type == "array" then sort else . end )'

On macOS, jq and xq may be installed using Homebrew brew install jq python-yq or MacPorts.

Reference

The general properties configuring this flow via admin/admin.properties are:

Name

Default

Description

Name

Default

Description

idp.resolvertest.logging

ResolverTest

Audit log identifier for flow

idp.resolvertest.accessPolicy

AccessByIPAddress

Name of access control policy for request authorization

idp.resolvertest.authenticated

false

Whether authentication should be performed prior to access control evaluation

idp.resolvertest.nonBrowserSupported

false

Whether the flow should allow for non-browser clients during authentication

idp.resolvertest.resolveAttributes

false

Whether attributes should be resolved prior to access control evaluation

To replace the internally defined flow descriptor bean, the following XML is required:

<util:list id="shibboleth.AvailableAdminFlows"> <bean parent="shibboleth.AdminFlow" c:id="http://shibboleth.net/ns/profiles/resolvertest" p:loggingId="%{idp.resolvertest.logging:ResolverTest}" p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}" p:nonBrowserSupported="%{idp.resolvertest.nonBrowserSupported:false}" p:authenticated="%{idp.resolvertest.authenticated:false}" p:resolveAttributes="%{idp.resolvertest.resolveAttributes:false}" /> </util:list>

No default version of the list is provided and it may simply be placed in conf/global.xml if needed.