Page tree
Skip to end of metadata
Go to start of metadata

This feature requires V4.1 of the software.


Namespace: urn:mace:shibboleth:2.0:resolver
Schema: http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd

The Decrypted attribute definition decrypts values of input attributes to an output attribute. The encryption/decryption is based on a supplied utility class used elsewhere in the IdP called a DataSealer.

Overview

This is a potential utility component that may prove useful in support of use cases where data being resolved should be private to the IdP but stored elsewhere.

Configuring this definition requires adding at least one <InputAttributeDefinition> or <InputDataConnector> element and supplying a reference to a DataSealer with access to the key used to encrypt the input data.

Configuration Reference

Attributes

A dataSealerRef attribute MUST be supplied that references the Spring Bean ID of a DataSealer. This may be wired up globally or in an additional resource local to the AttributeResolverConfiguration. Typically the component built-in to the IdP for use in client session management is not suitable because that key is designed to change frequently.

In addition, any of the common attributes can be specified. 

NameTypeDefaultDescription

id

String

Identifier for the IdPAttribute as well as its definition. This is used for logging and to establish dependencies and relationships between connectors and definitions, and to reference the data item in filter rules and many other configuration features.

Note that the value MUST NOT contain whitespace, and use of certain other special characters will result in warnings that should be addressed in case the rules are made more strict in future versions.

activationConditionRef

Bean Reference

Bean ID of a condition to decide whether to resolve this definition, see here.
Mutually exclusive with relyingParties and resolutionPhases and variants

relyingParties

Space-delimited list

List of entity IDs for which this Attribute Definition should be resolved.
Mutually exclusive with activationConditionRef

excludeRelyingParties 4.1Space-delimited list
List of entity IDs for which this Attribute Definition should not be resolved.
Mutually exclusive with activationConditionRef
resolutionPhases 4.1space-delimited list
List of resolution phases (i.e. flows) during which this Attribute Definition should be resolved.
Mutually exclusive with activationConditionRef
excludeResolutionPhases 4.1space-delimited list
List of resolution phases (i.e. flows) during which this Attribute Definition should not be resolved.
Mutually exclusive with activationConditionRef

dependencyOnly

BooleanfalseIf set to true, the attribute is not exposed outside the resolution process and is available solely within the resolution process

preRequested

Booleanfalse

If set to true, the attribute (and its dependencies) will be resolved in pre-pass and its value made available to other definitions' ActivationConditions.

See PreRequestedAttributes for details.

profileContextStrategyRef      

Bean Reference
Bean ID of a function injected to override the normal lookup process for the request's ProfileRequestContext

Child Elements

Any of the common child elements can be specified, and at least one input dependency is required.

NameCardinalityDescription
<InputAttributeDefinition>
0 or moreThis element identifies an attribute definition which is an input to this attribute definition.
<InputDataConnector>
0 or moreThis element identifies a data connector whose attributes are to be input to this attribute definition.
<AttributeEncoder>
0 or more

An inline definition of how an attribute will be encoded for inclusion in a message to a relying party. These are distinguished by an xsi:type attribute, and the different types are documented here.

Replaceable via the more generic AttributeRegistryConfiguration.

<DisplayName>
0 or more

A human readable name for this attribute. This name may, for example, be displayed to the user to consent to the attribute's release.

If multiple display names are used, then they should bear an xml:lang attribute to distinguish them.

Replaceable via the more generic AttributeRegistryConfiguration.

<DisplayDescription>
0 or more

A human readable description of for this attribute. This name may, for example, be displayed to the user to consent to the attribute's release.

If multiple display descriptions are used, then they should bear an xml:lang attribute to distinguish them.

Replaceable via the more generic AttributeRegistryConfiguration.




  • No labels