FunctionPostLoginC14NConfiguration

Current File(s): conf/c14n/subject-c14n.properties, conf/c14n/subject-c14n.xml
Format: Properties, Native Spring

Overview

The “function” post-login subject c14n method is an extension point allowing a deployer-supplied Function bean to be provided to implement the subject c14n process. It’s primarily just a wrapper to implement some of the boilerplate needed so the deployer need only implement a basic function signature.

The Function provided must implement the signature Function<SubjectCanonicalizationContext,String> (notably the input is not the more typical ProfileRequestContext used throughout the IdP, though the input context is generally a child of that context so it can be accessed if needed).

Configuration

Method Settings

Use conf/c14n/subject-c14n.properties to configure this method, while defining the Function bean in conf/c14n/subject-c14n.xml. That bean ID (whatever it is) is the one you set the property idp.c14n.function.Functon to reference.

By default, the only transform applied to the result is a trim of leading or trailing whitespace. Case-folding and regular expression replacements can be added, per the reference section below, mostly as a convenience since one can certainly implement such features within the provided Function itself.

Enabling this Method

This method is enabled by setting a per-login-flow property in conf/authn/authn.properties that references it. The default bean ID of this method is “c14n/function”, so enabling it for a login flow looks like:

It is possible to configure two (or more) instances of this method at the same time with different functions and settings. The default instance is configured with a set of global properties, so defining a second instance of it with different settings requires adding a bean to conf/c14n/subject-c14n.xml. This bean can be defined at the top level of the file and needs a unique ID to reference in the login flow property example above. It does not have to carry the “c14n/” prefix but this is useful for clarity.

As an example, to define a second instance with a unique function bean other than that defined via the idp.c14n.function.Function property:

That then allows you to reference “c14n/function2” in a login flow’s property as above.

Reference