@@ -54,21 +54,89 @@
<bean id="authn/External" parent="shibboleth.AuthenticationFlow"
p:nonBrowserSupported="false" />
+ <bean id="authn/Level1" parent="shibboleth.AuthenticationFlow">
+ <property name="supportedPrincipals">
+ <list>
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="authn/Level2" parent="shibboleth.AuthenticationFlow">
+ <property name="supportedPrincipals">
+ <list>
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="authn/Level3" parent="shibboleth.AuthenticationFlow">
+ <property name="supportedPrincipals">
+ <list>
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level3" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
+
+ <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
+ p:passiveAuthenticationSupported="true"
+ p:forcedAuthenticationSupported="true">
+ <property name="supportedPrincipals">
+ <list>
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
+ <bean parent="shibboleth.SAML1AuthenticationMethod"
+ c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
+ <!-- GUARD -->
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
+
<bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
- p:nonBrowserSupported="false" />
+ p:nonBrowserSupported="false">
+ <property name="supportedPrincipals">
+ <list>
+ <!-- GUARD -->
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
<bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" />
<bean id="authn/X509" parent="shibboleth.AuthenticationFlow"
p:nonBrowserSupported="false">
<property name="supportedPrincipals">
<list>
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" />
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
<bean parent="shibboleth.SAML1AuthenticationMethod"
c:method="urn:ietf:rfc:2246" />
+ <!-- GUARD -->
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
</list>
</property>
</bean>
@@ -89,3 +157,14 @@
- <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
- p:passiveAuthenticationSupported="true"
- p:forcedAuthenticationSupported="true" />
+ <bean id="authn/RemoteUser4Level3" parent="shibboleth.AuthenticationFlow"
+ p:nonBrowserSupported="false">
+ <property name="supportedPrincipals">
+ <list>
+ <!-- GUARD -->
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level3" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ </list>
+ </property>
+ </bean>
@@ -112,22 +191,29 @@
<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
p:passiveAuthenticationSupported="true"
p:forcedAuthenticationSupported="true">
<!--
The list below almost certainly requires changes, and should generally be the
union of any of the separate factors you combine in your particular MFA flow
rules. The example corresponds to the example in mfa-authn-config.xml that
combines IPAddress with Password.
-->
<property name="supportedPrincipals">
<list>
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
<bean parent="shibboleth.SAML1AuthenticationMethod"
c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
+ <!-- GUARD -->
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level1" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level2" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:mace:gakunin.jp:idprivacy:ac:classes:Level3" />
</list>
</property>
</bean> |