{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Spring Properties","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Authentication of users is obviously independent of OIDC (or CAS or SAML) with the exception of a couple of OIDC-specific notes.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"User Interface","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"RpUIContext","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/IDP4/RpUIContext"}}]},{"text":" lists the view \"variables\" that are populated from SAML metadata (and this extends to use of SAML metadata for OIDC ","type":"text"},{"text":"client registration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDPPLUGINS/pages/1376879133"}}]},{"text":"). That page also contains instructions how the attributes can be exploited in views.","type":"text"}]},{"type":"paragraph","content":[{"text":"When the other mechanisms for client registration are used, the following attributes are populated from OIDC client metadata.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Note that in the case of ","type":"text"},{"text":"OPDynamicClientRegistration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDPPLUGINS/pages/1376879077"}}]},{"text":", that implies unauthenticated, external injection of some values and this certainly has the potential to be unsafe, though the data should of course be encoded for safety.","type":"text"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"$rpUIContext.contactEmail(type)","type":"text","marks":[{"type":"em"}]},{"text":": Corresponds to \"contacts\" field in OIDC metadata. Only the type \"support\" is currently supported.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"$rpUIContext.informationURL","type":"text","marks":[{"type":"em"}]},{"text":": Corresponds to \"tos_uri\" field in OIDC metadata.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"$rpUIContext.logo","type":"text","marks":[{"type":"em"}]},{"text":": Corresponds to \"logo_uri\" field in OIDC metadata.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"$rpUIContext.privacyStatementURL","type":"text","marks":[{"type":"em"}]},{"text":": Corresponds to \"policy_uri\" field in OIDC metadata.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"$rpUIContext.serviceName","type":"text","marks":[{"type":"em"}]},{"text":": Corresponds to \"client_name\" field in OIDC metadata, falling back to \"client_id\" if none is set.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If the OIDC metadata does not contain language-specific settings, the default language is currently \"en\".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"ACRs","type":"text"}]},{"type":"paragraph","content":[{"text":"OIDC has the concept of an \"authentication context reference\" (acr) that is largely copied from SAML's ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" construct with a couple of notable differences: only exact matching is supported and OIDC has the concept of both \"essential\" and \"voluntary\" matching. Essential matching behaves identically to exact matching in SAML, while voluntary matching doesn't have an analog in SAML and doesn't map well to the IdP's behavior in most cases.","type":"text"}]},{"type":"paragraph","content":[{"text":"A utility bean named ","type":"text"},{"text":"shibboleth.OIDCAuthnContextClassReference","type":"text","marks":[{"type":"strong"}]},{"text":" is provided that allows the necessary custom ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects to be defined to asociate authentication flows, results, and relying party overrides with particular \"supported\" ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" types in the usual manner.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"If you wanted to attach the REFEDS MFA profile value to an MFA authentication flow, you could set the following property to cover SAML 2.0 and OIDC:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"conf/authn/authn.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"idp.authn.MFA.supportedPrincipals = \\\n\tsaml2/https://refeds.org/profile/mfa, \\\n\toidc/https://refeds.org/profile/mfa","type":"text"}]},{"type":"paragraph","content":[{"text":"If you wanted to force the use of that same profile via a RelyingParty override (by name):","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"conf/relying-party.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\t\n\t\t\thttps://oidc.example.org\n\t\t\thttps://oidc2.example.org\n\t\t\n\t\n \n \n ...\n \n\t\t\t\t\n\t\t\t\t\t\n\t\t\t\t\n\t\t\t\n ...\n \n \n","type":"text"}]},{"type":"paragraph"}],"version":1}

Browser not supported