{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"c6976fcf-e5b4-41d1-9ee2-3070ec4c580a"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"2f0577c4-6bdf-49d3-b361-a38ebd4f0110"}},{"type":"heading","attrs":{"level":2},"content":[{"type":"hardBreak"},{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"OIDC deals in \"claims\" instead of \"attributes\" but the concept is the same and the ","type":"text"},{"text":"AttributeResolverConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":" and (optionally) ","type":"text"},{"text":"AttributeRegistryConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510514"}}]},{"text":" are used as with SAML and CAS to pull in the appropriate data and encode it into JSON in responses.","type":"text"}]},{"type":"paragraph","content":[{"text":"The only special consideration for OIDC is the specialized encoding requirements, which are handled (as in SAML) either via \"inline\" ","type":"text"},{"text":"AttributeEncoders","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504645"}}]},{"text":", or by defining ","type":"text"},{"text":"\"transcoding\" rules","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510553"}}]},{"text":" that map between ","type":"text"},{"text":"IdPAttributes","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" and JSON-encoded claims.","type":"text"}]},{"type":"paragraph","content":[{"text":"An example file, ","type":"text"},{"text":"conf/examples/oidc-attribute-resolver.xml","type":"text","marks":[{"type":"em"}]},{"text":", is included that contains some examples of custom encoders, definitions that match the optional \"default\" claim rules, and suggested starting points for producing the \"sub\" claim (see also ","type":"text"},{"text":"OPSubClaim","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879208"}}]},{"text":").","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Timing of Resolution","type":"text"}]},{"type":"paragraph","content":[{"text":"The Authorize, Token and Userinfo profile endpoints all trigger attribute resolution and filtering phases. The motivation for this is to maintain an implementation that is as stateless as possible to avoid complex clustering technologies. Each endpoint is able to resolve attributes independently and therefore attribute information need not be stored to server side. This also ensures up to date values for claims returned when an access token is refreshed for extended period of time.","type":"text"}]},{"type":"paragraph","content":[{"text":"(For long time Shibboleth deployers, this is somewhat analagous to the old days when SAML attribute queries were common.)","type":"text"}]},{"type":"paragraph","content":[{"text":"There are a few obvious downsides to this stateless approach. One is that, depending on the OIDC response type, the same attribute may be resolved more than once. This is particularly an issue if the resolution process is costly and the intention is only to authenticate the user. The ","type":"text"},{"text":"ResultCache","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504329"}}]},{"text":" feature is helpful for this case.","type":"text"}]},{"type":"paragraph","content":[{"text":"A harder problem is when attribute resolution on the back-channel in the Token and Userinfo endpoints are unable to resolve attributes based on session/authentication/client information, as it is unavailable. This places additional requirements on the resolver configuration to fail gracefully in such cases. As an alternative, there is an ","type":"text"},{"text":"encodedAttributes","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879266"}}]},{"text":" profile configuration property that instructs the Authorize endpoint to encode the attributes needed in later phases into the Authorization Code and/or Access Token directly, making them available to the Token and Userinfo endpoints. This naturally increases the size of the code/token but for specific cases may be tolerable.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reserved Claims","type":"text"}]},{"type":"paragraph","content":[{"text":"Because OIDC is string-based, rather than reliant on XML and URIs for uniqueness, there are a number of arbitrary claim names that need to be avoided and will not be produced if used.","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"Please be aware that OAuth and OpenID are defined unsafely to leverage claim names that are strings rather than URIs. Thus, there are no mechanisms in place to ensure control and uniqueness over the naming of claims as can be done in SAML. As a result, we cannot guarantee that new specifications will not define new claim names and stomp on your use of new claim names that happen to collide.","type":"text"}]},{"type":"paragraph","content":[{"text":"The only real solution to this problem is simply to avoid “small/simple” names and, when using OIDC at least, avoid adding custom claims to the ID Token and leverage the UserInfo endpoint to produce them instead.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The following claim names are currently reserved (but note the warning above):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"aud","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iss","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iat","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"exp","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"acr","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"auth_time","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"at_hash","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"c_hash","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"nonce","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"sid","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The \"sub\" claim is also semi-reserved but does come from your configuration. However it has to meet certain requirements and so cannot just contain arbitrary data without risking severe consequences to RPs. It is analagous to violating the expectations of a SAML SP regarding the content of an Attribute, but with more consistently severe problems. Please refer to the dedicated page at ","type":"text"},{"text":"OPSubClaim","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879208"}}]},{"text":" for specifics.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Transcoding Rules","type":"text"}]},{"type":"paragraph","content":[{"text":"The mappings from traditional LDAP (and SAML) attributes and OIDC claims is much less self-evident, but we have produced a set of plausible default rules that map from typical LDAP attributes to appropriate claims. These rules are not enabled by default, but can be found in ","type":"text"},{"text":"conf/attributes/oidc-claim-rules.xml","type":"text","marks":[{"type":"em"}]},{"text":" and imported into ","type":"text"},{"text":"conf/attributes/default-rules.xml ","type":"text","marks":[{"type":"em"}]},{"text":"(with or without changes). That file also provides numerous examples to follow in building your own rules if desired.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that it's optional and not required to \"combine\" SAML and OIDC rules together. The system is intelligent enough to allow multiple \"outbound\" rules associated with the same ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" id with different transcoders involved.","type":"text"}]},{"type":"paragraph","content":[{"text":"The additional supported properties and transcoder types are described below. As with SAML, OIDC includes mechanisms to request claims, and so the transcoders support bidirectional mappings to allow decoding of requested JSON claims as well as encoding of ","type":"text"},{"text":"IdPAttributes","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.IdPAttribute"}}]},{"text":" into JSON.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Properties","type":"text"}]},{"type":"paragraph","content":[{"text":"In addition to the ","type":"text"},{"text":"generic properties","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510553"}}]},{"text":", all OIDC transcoders support the following:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","width":1221.0,"localId":"f3fe03af-3842-40f9-a068-d5e1cce34e69"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.name","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"The claim name to map to and from (if absent, the IdPAttribute's id is used)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.asArray","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes and decodes multiple values as a JSON array","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.asInteger","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes and decodes individual values as a JSON integer","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.asBoolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes and decodes individual values as a Boolean","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.stringDelimiter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes and decodes multiple values as a string with a specifie delimiter","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.nameFromSamlMetadata","type":"text"},{"text":"4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[78.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[90.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[802.0]},"content":[{"type":"paragraph","content":[{"text":"The claim name may be set in the SAML metadata","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"SAML metadata-driven claim name","type":"text"}]},{"type":"paragraph","content":[{"text":"Since OP v4.1, the claim name may be set in the SAML metadata-driven style. If the OIDC transcoder property ","type":"text"},{"text":"oidc.nameFromSamlMetadata","type":"text","marks":[{"type":"code"}]},{"text":" is set to ","type":"text"},{"text":"true","type":"text","marks":[{"type":"code"}]},{"text":", the metadata tag ","type":"text"},{"text":"http://shibboleth.net/ns/attributes/naming/oidc","type":"text","marks":[{"type":"code"}]},{"text":" can be used together with pattern ","type":"text"},{"text":" ","type":"text","marks":[{"type":"code"}]},{"text":" to set a custom name for the claim.","type":"text"}]},{"type":"paragraph","content":[{"text":"Below is an example snippet of SAML metadata for ","type":"text"},{"text":"test_rp","type":"text","marks":[{"type":"code"}]},{"text":" that configures the claim name ","type":"text"},{"text":"eppnNewNameForTesting","type":"text","marks":[{"type":"code"}]},{"text":" for attribute with ID ","type":"text"},{"text":"eduPersonPrincipalName","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"...\n \n \n \n \n eduPersonPrincipalName eppnNewNameForTesting\n \n...","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Transcoder Types","type":"text"}]},{"type":"paragraph","content":[{"text":"There are 3 built-in types of OIDC transcoders, as follows. Each one is predefined as a Spring bean for use in rules using the \"short\" name of the transcoder as shown.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"OIDCStringTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"The simplest and most commonly used transcoder, it supports encoding and decoding internal values from and to the ","type":"text"},{"text":"StringAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.StringAttributeValue"}}]},{"text":" class. It supports the following additional optional property:","type":"text"}]},{"type":"table","attrs":{"layout":"wide","width":1800.0,"localId":"7f875b4b-3620-42d7-b62d-a1669e706706"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[71.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[63.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[711.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.asObject","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[71.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[63.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[711.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes and decodes a string value as a JSON object (meaning parsing to and from JSON)","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"OIDCScopedStringTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"Supports encoding and decoding internal values from and to the ","type":"text"},{"text":"ScopedStringAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.ScopedStringAttributeValue"}}]},{"text":" class. It supports the following additional properties (all optional):","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"021381f2-fec2-40c4-8530-f454afb6f034"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[57.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[170.0]},"content":[{"type":"paragraph","content":[{"text":"oidc.scopeDelimiter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[57.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[67.0]},"content":[{"type":"paragraph","content":[{"text":"@","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[464.0]},"content":[{"type":"paragraph","content":[{"text":"The character(s) to use to separate the value and scope","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"OIDCByteTranscoder","type":"text"}]},{"type":"paragraph","content":[{"text":"Supports encoding and decoding internal values from and to the ","type":"text"},{"text":"ByteAttributeValue","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-attribute.cgi/net.shibboleth.idp.attribute.ByteAttributeValue"}}]},{"text":" class, with a base64 transform applied. It supports no additional properties.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Attribute Encoders","type":"text"}]},{"type":"paragraph","content":[{"text":"The alternative to the generality of the transcoding approach is the older style of embedding ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements within the ","type":"text"},{"text":"AttributeResolverConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502864"}}]},{"text":" to specify individual encoding of ","type":"text"},{"text":"AttributeDefinitions","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502907"}}]},{"text":" to claims. This is supported for OIDC via a set of extensions that add new encoder plugin types.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Note for upgraders: the older \"token placement\" settings that were supported here for splitting claims have been moved to ","type":"text"},{"text":"profile configuration ","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879261"}}]},{"text":"settings and are no longer valid here.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Because these are extensions, their ","type":"text"},{"text":"xsi:type","type":"text","marks":[{"type":"code"}]},{"text":" definitions live in a separate XML namespace and schema (unfortunately an unavoidable callback to the days when multiple namespaces were required in configurations).","type":"text"}]},{"type":"paragraph","content":[{"text":"Namespace:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"urn:mace:shibboleth:2.0:resolver:oidc","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Schema:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"http://shibboleth.net/schema/oidc/shibboleth-attribute-encoder-oidc.xsd","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/schema/oidc/shibboleth-attribute-encoder-oidc.xsd"}}]}]},{"type":"paragraph","content":[{"text":"In order to use any of these encoders, the root element of the resolver configuration file needs to be adjusted to declare a namespace prefix for the extension namespace and add in the schema location to address some fundamental XML bugs in Spring:","type":"text"}]},{"type":"codeBlock","content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"All of the extension encoders support the common settings described on the ","type":"text"},{"text":"AttributeEncoderPluginConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504645"}}]},{"text":" page. They also support all of these common XML attributes:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1221.0,"localId":"bd19644b-a4ca-42ad-a195-ce2399a91329"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"asObject","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes (and decodes) string-valued data as a JSON object instead of a string value","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"asBoolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes (and decodes) values as booleans (anything but \"true\", ignoring case, is treated as false)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"asArray","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes (and decodes) multiple values into a JSON array rather than a delimited string","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"asInt","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Encodes (and decodes) values as JSON integers (non-numeric values are ignored)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"stringDelimiter","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[83.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[903.0]},"content":[{"type":"paragraph","content":[{"text":"Sets the delimiter to use when encoding multiple values into a single JSON string","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The supported ","type":"text"},{"text":"xsi:type","type":"text","marks":[{"type":"code"}]},{"text":" values (and additional options) are:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1221.0,"localId":"e332aadb-1fe0-4d5e-bc7d-d266bd15df45"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"paragraph","content":[{"text":"xsi:type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[997.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"paragraph","content":[{"text":"oidc:OIDCString","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[997.0]},"content":[{"type":"paragraph","content":[{"text":"Basic encoder for string-valued claims (defaults to encoding multiple values as a space-delimited string)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"paragraph","content":[{"text":"oidc:OIDCScopedString","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[997.0]},"content":[{"type":"paragraph","content":[{"text":"Encoder for scoped claims. A ","type":"text"},{"text":"scopeDelimiter","type":"text","marks":[{"type":"code"}]},{"text":" XML attribute can be supplied to alter the delimiter (defaults to '@').","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"paragraph","content":[{"text":"oidc:OIDCByte","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[997.0]},"content":[{"type":"paragraph","content":[{"text":"Encoder for base64-encoding byte-valued data","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected JSON is shown in XML comments. Unrelated aspects are omitted such as dependencies and so forth.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\n\n\n\n\t\n\n\n\n\n \n \n\n","type":"text"}]},{"type":"paragraph"}],"version":1}