{"type":"doc","content":[{"type":"paragraph","content":[{"text":"File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" conf/relying-party.xml - via file defined in the","type":"text"},{"text":" idp.oidc.dynreg.defaultMetadataPolicyFile","type":"text","marks":[{"type":"em"}]},{"text":" -property by default","type":"text"},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" Native Spring, JSON","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"324ec98a-6a56-4d07-bbcd-bfa0bd125631"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"2731db88-8dda-4910-a180-97d32771943d"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"A metadata policy is used to restrict the acceptable content of a ","type":"text"},{"text":"dynamic registration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDPPLUGINS/pages/1376879077"}}]},{"text":" request. The concept is defined in the ","type":"text"},{"text":"OpenID Connect Federation 1.0","type":"text","marks":[{"type":"link","attrs":{"href":"https://openid.net/specs/openid-connect-federation-1_0.html"}}]},{"text":" specification (","type":"text"},{"text":"draft 17","type":"text","marks":[{"type":"strong"}]},{"text":" at the time of writing this documentation). We support the structure and rules specified in section ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"strong"}]},{"text":" of the specification draft: the three value operators (","type":"text"},{"text":"value","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"add, default","type":"text","marks":[{"type":"em"}]},{"text":") and the four value checks (","type":"text"},{"text":"one_of","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"subset_of","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"superset_of","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"essential","type":"text","marks":[{"type":"em"}]},{"text":"). We also support the ","type":"text"},{"text":"regexp","type":"text","marks":[{"type":"em"}]},{"text":" (regular expression) value operator.","type":"text"}]},{"type":"paragraph","content":[{"text":"All the restrictions on policy entries and the rules for combining/merging, applying and enforcing policies are respected as specified. In this use case, the combining/merging is related to metadata policies defined within a registration access token and in the profile configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"Since version 4.1, we provide a way to inject custom operators in addition to the set described above. The custom operators are merged in the same way as ","type":"text"},{"text":"default","type":"text","marks":[{"type":"em"}]},{"text":", ","type":"text"},{"text":"value","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"regex","type":"text","marks":[{"type":"em"}]},{"text":" operators.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The metadata policy configuration for a profile can be modified via the ","type":"text"},{"text":"metadataPolicyLookupStrategy","type":"text","marks":[{"type":"code"}]},{"text":" profile configuration setting. If left empty, the contents of the file path defined in the ","type":"text"},{"text":"idp.oidc.dynreg.defaultMetadataPolicyFile","type":"text","marks":[{"type":"strong"}]},{"text":" property (if specified) will be used.","type":"text"}]},{"type":"paragraph","content":[{"text":"A custom file path value for a profile can be configured in the following way:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a bean (for instance with id ","type":"text"},{"text":"custom.AnotherMetadataPolicyLookupStrategy","type":"text","marks":[{"type":"strong"}]},{"text":") in the following way:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reference the bean as the ","type":"text"},{"text":"metadataPolicyLookupStrategy","type":"text","marks":[{"type":"code"}]},{"text":" within the profile configuration in ","type":"text"},{"text":"relying-party.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Custom operators ","type":"text"},{"text":"4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"Since version 4.1, we provide a way to inject custom operators in addition to the set described above. A new operator ","type":"text"},{"text":"bean","type":"text","marks":[{"type":"em"}]},{"text":" demonstrates this feature. It can be used for wiring any bean that implements ","type":"text"},{"text":"CustomMetadataPolicyOperator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/api/java-oidc-common/3.1.0-SNAPSHOT/net/shibboleth/oidc/metadata/policy/impl/CustomMetadataPolicyOperator.html"}}]},{"text":" for performing the operation.","type":"text"}]},{"type":"paragraph","content":[{"text":"A new abstract global bean ","type":"text"},{"text":"shibboleth.oidc.MetadataPolicyOperator","type":"text","marks":[{"type":"code"}]},{"text":" can be used for wiring custom (including scripted/expression) policy operators. The bean contains two properties:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"validator","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The predicate should return true or false, depending whether the contents of the given ","type":"text"},{"text":"MetadataPolicy","type":"text","marks":[{"type":"code"}]},{"text":" are compatible with this custom policy operator.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"defaults to always true (","type":"text"},{"text":"shibboleth.Conditions.TRUE","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"valueOperator","type":"text","marks":[{"type":"strong"}]},{"text":": ","type":"text"},{"text":"BiFunction","type":"text","marks":[{"type":"code"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"input1","type":"text","marks":[{"type":"code"}]},{"text":": value candidate","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"input2","type":"text","marks":[{"type":"code"}]},{"text":": policy related to the value","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The bi-function should return the value after the operator has been applied or throw ","type":"text"},{"text":"net.shibboleth.shared.logic.ConstraintViolationException","type":"text","marks":[{"type":"code"}]},{"text":" if the candidate was not accepted.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Custom operator example","type":"text"}]},{"type":"paragraph","content":[{"text":"The following example demonstrates the idea.","type":"text"}]},{"type":"paragraph","content":[{"text":"The custom metadata policy operator bean is ","type":"text"},{"text":"EchoDemoOperator","type":"text","marks":[{"type":"code"}]},{"text":". Its ","type":"text"},{"text":"valueOperator","type":"text","marks":[{"type":"code"}]},{"text":" simply echoes back the value candidate (","type":"text"},{"text":"input1","type":"text","marks":[{"type":"code"}]},{"text":"). As the ","type":"text"},{"text":"validator","type":"text","marks":[{"type":"code"}]},{"text":" is not explicitly defined, its default value (","type":"text"},{"text":"shibboleth.Conditions.TRUE","type":"text","marks":[{"type":"code"}]},{"text":") is used.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"That operator could then be wired to a metadata policy in the following way:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"client_name\": {\n \"default\": \"A known test application\",\n \"bean\": \"EchoDemoOperator\"\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Policy Examples","type":"text"}]},{"type":"paragraph","content":[{"text":"The following JSON contains an example of a metadata policy:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"client_name\": {\n \"default\": \"A known test application\"\n },\n \"organization_name\": {\n \"value\": \"A trusted organization\"\n },\n \"redirect_uris\": {\n \"regexp\": \"^https:\\/\\/(?:([^.]+).)?example.org\\/(.*)\",\n \"essential\": true\n },\n \"id_token_signed_response_alg\": {\n \"one_of\": [\"RS256\", \"RS384\", \"RS512\"]\n },\n \"scope\": {\n \"subset_of\": [\"openid\", \"profile\", \"email\", \"phone\"]\n }\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"It should be read as follows:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"client_name","type":"text","marks":[{"type":"strong"}]},{"text":": default value is ","type":"text"},{"text":"A known test application","type":"text","marks":[{"type":"code"}]},{"text":", but it can be overridden in the dynamic client registration request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"organization_name","type":"text","marks":[{"type":"strong"}]},{"text":": The value ","type":"text"},{"text":"A trusted organization","type":"text","marks":[{"type":"code"}]},{"text":" will always be used, no matter what the dynamic client registration request contains for it","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"redirect_uris","type":"text","marks":[{"type":"strong"}]},{"text":": The values must meet the regular expression, i.e. be in https-scheme, the host-part of the URL must end with ","type":"text"},{"text":"example.org","type":"text","marks":[{"type":"em"}]},{"text":" no custom port can be defined.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"id_token_signed_response_alg","type":"text","marks":[{"type":"strong"}]},{"text":": The algorithm specified in the request (if exists) must be one of the three RS-algortihms.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"scope","type":"text","marks":[{"type":"strong"}]},{"text":": The scope in the request (if exists) can contain the four values or a subset of them","type":"text"}]}]}]},{"type":"paragraph"}],"version":1}