From 16e9ff7096dc857a461cb0698a9c76def7cd928b Mon Sep 17 00:00:00 2001
From: root <root@idp-cluster-a.mafoo.org.uk>
Date: Fri, 5 Aug 2022 14:32:19 +0000
Subject: [PATCH] storedid working

---
 conf/attribute-filter.xml   | 79 +------------------------------------
 conf/attribute-resolver.xml | 15 +++++++
 conf/global.xml             | 15 +++++++
 conf/idp.properties         |  7 ++++
 4 files changed, 38 insertions(+), 78 deletions(-)

diff --git a/conf/attribute-filter.xml b/conf/attribute-filter.xml
index c2bf890..0fdd580 100644
--- a/conf/attribute-filter.xml
+++ b/conf/attribute-filter.xml
@@ -20,85 +20,8 @@
         <PolicyRequirementRule xsi:type="ANY" />
         
         <AttributeRule attributeID="schacHomeOrganization" permitAny="true" />
+        <AttributeRule attributeID="eduPersonTargetedID" permitAny="true" />
     </AttributeFilterPolicy>
 
-    <!--
-    Example rule relying on a locally applied tag in metadata to trigger attribute
-    release of some specific attributes. Add additional attributes as desired.
-    -->
-	<AttributeFilterPolicy id="Per-Attribute-singleValued">
-	    <PolicyRequirementRule xsi:type="ANY" />
-	 
-	    <AttributeRule attributeID="eduPersonPrincipalName">
-	        <PermitValueRule xsi:type="EntityAttributeExactMatch"
-	            attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
-	            attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-	            attributeValue="eduPersonPrincipalName" />
-	    </AttributeRule>
-	 
-	    <AttributeRule attributeID="mail">
-	        <PermitValueRule xsi:type="EntityAttributeExactMatch"
-	            attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
-	            attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-	            attributeValue="mail" />
-	    </AttributeRule>
-	</AttributeFilterPolicy>
-
-    <!--
-    Same as above but more efficient form for an attribute with multiple values.
-    -->
-    <AttributeFilterPolicy id="Per-Attribute-Affiliation">
-        <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
-            attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
-            attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-            attributeValue="eduPersonScopedAffiliation" />
-     
-        <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
-    </AttributeFilterPolicy>
-
-    <!--
-    Example rule for honoring Subject ID requirement tag in metadata.
-    The example supplies pairwise-id if subject-id isn't explicitly required.
-    -->
-    <AttributeFilterPolicy id="subject-identifiers">
-        <PolicyRequirementRule xsi:type="ANY" />
-
-        <AttributeRule attributeID="samlPairwiseID">
-            <PermitValueRule xsi:type="OR">
-                <Rule xsi:type="EntityAttributeExactMatch"
-                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
-                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-                    attributeValue="pairwise-id" />
-                <Rule xsi:type="EntityAttributeExactMatch"
-                    attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
-                    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-                    attributeValue="any" />
-            </PermitValueRule>
-        </AttributeRule>
-
-        <AttributeRule attributeID="samlSubjectID">
-            <PermitValueRule xsi:type="EntityAttributeExactMatch"
-                attributeName="urn:oasis:names:tc:SAML:profiles:subject-id:req"
-                attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
-                attributeValue="subject-id" />
-        </AttributeRule>
-    </AttributeFilterPolicy>
-
-    <!-- Release an additional attribute to an SP. -->
-    <AttributeFilterPolicy id="example1">
-        <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.org" />
-
-        <AttributeRule attributeID="uid" permitAny="true" />
-    </AttributeFilterPolicy>
-
-    <!-- Release eduPersonScopedAffiliation to two specific SPs. -->
-    <AttributeFilterPolicy id="example2">
-        <PolicyRequirementRule xsi:type="OR">
-            <Rule xsi:type="Requester" value="https://sp.example.org" />
-            <Rule xsi:type="Requester" value="https://another.example.org/shibboleth" />
-        </PolicyRequirementRule>
-
-        <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
-    </AttributeFilterPolicy>
     
 </AttributeFilterPolicyGroup>
diff --git a/conf/attribute-resolver.xml b/conf/attribute-resolver.xml
index dd5545f..ba450d6 100644
--- a/conf/attribute-resolver.xml
+++ b/conf/attribute-resolver.xml
@@ -61,6 +61,14 @@ list of possible components and their options.
         <InputDataConnector ref="staticAttributes" attributeNames="affiliation" />
     </AttributeDefinition>
 
+    <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"
+        nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
+        <InputDataConnector ref="storedID" attributeNames="storedID"/>
+
+        <AttributeEncoder xsi:type="SAML2XMLObject"
+                name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
+    </AttributeDefinition>
+
 
     <!-- ========================================== -->
     <!--      Data Connectors                       -->
@@ -75,4 +83,11 @@ list of possible components and their options.
         </Attribute>
     </DataConnector>
 
+    <DataConnector xsi:type="StoredId" id="storedID"
+	    generatedAttributeID="storedID"
+	    salt='04D00D29-5FFF-4732-8645-ED8B7678BE4E'>
+    <InputAttributeDefinition ref="uid" />
+    <BeanManagedConnection>sqlite-dataconnector</BeanManagedConnection>
+</DataConnector>
+
 </AttributeResolver>
diff --git a/conf/global.xml b/conf/global.xml
index c485f3f..b8578a3 100644
--- a/conf/global.xml
+++ b/conf/global.xml
@@ -48,5 +48,20 @@
         <entry key="foo" value="bar"/>
     </util:map>
     -->
+
+    <bean id="sqlite-dataconnector" class="org.apache.commons.dbcp2.BasicDataSource" destroy-method="close"
+	    p:driverClassName="%{datasource.driverClass}"
+	    p:url="%{datasource.jdbcUrl}"
+	    p:initialSize="5"
+	    p:maxTotal="50"
+	    p:maxIdle="5"
+	    p:maxWaitMillis="2000"
+	    />
+
+    <bean id="sqlite-storeageservice" parent="shibboleth.JDBCStorageService"
+	    p:dataSource-ref="sqlite-dataconnector"
+	    p:transactionIsolation="4"
+	    p:retryableErrors="40001"
+	    />
     
 </beans>
diff --git a/conf/idp.properties b/conf/idp.properties
index e598a24..5ee1986 100644
--- a/conf/idp.properties
+++ b/conf/idp.properties
@@ -246,3 +246,10 @@ idp.audit.shortenBindings=true
 idp.loglevel.idp=DEBUG
 idp.loglevel.messages=DEBUG
 idp.loglevel.encryption=DEBUG
+
+# database details
+datasource.driverClass = org.sqlite.JDBC
+datasource.jdbcUrl = jdbc:sqlite:/opt/idp-storedid/db/stored-id.db
+# datasource.user = <USER>
+# datasource.password = <PASS>
+