\nThe Shibboleth Authentication Service handles the configuration to use\nwhen connecting to Shibboleth for the authentication in Nuxeo.\n
", "extensionPoints": [ { "@type": "NXExtensionPoint", "componentId": "org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService", "descriptors": [ "org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationConfig" ], "documentation": "\n Hold configuration for the Shibboleth Authentication Service. Contains:\n * the mapping between request headers and user fields\n * which header is used as user Id depending of the chosen IdP\n * the login / logout URLs for Shibboleth\n\n A sample configuration could be:\n\n \n \n \n differentUid \n uid \n \n https://host/Shibboleth.sso/WAYF \n https://host/Shibboleth.sso/Logout \n username \n email \n \n \n\n",
"documentationHtml": "\nHold configuration for the Shibboleth Authentication Service. Contains:\n* the mapping between request headers and user fields\n* which header is used as user Id depending of the chosen IdP\n* the login / logout URLs for Shibboleth\n
\nA sample configuration could be:\n
<extension point="config" target="org.nuxeo.ecm.platform.shibboleth.service.ShibbolethAuthenticationService">\n <config headerEncoding="utf-8">\n <uidHeaders>\n <uidHeader idpUrl="https://specific.idp">differentUid</uidHeader>\n <default>uid</default>\n </uidHeaders>\n <loginURL>https://host/Shibboleth.sso/WAYF</loginURL>\n <logoutURL>https://host/Shibboleth.sso/Logout</logoutURL>\n <fieldMapping header="uid">username</fieldMapping>\n <fieldMapping header="mail">email</fieldMapping>\n </config>\n </extension>\n\n \n \n \n differentUid \n uid \n \n\n https://host/Shibboleth.sso/WAYF \n https://host/Shibboleth.sso/Logout \n\n username \n email \n \n \n \n \nThis component expose a service to help mapping NuxeoPrincipal to\nuserObject provided by an external system.\n
\nThe mapping itself is configurable using an extension point.\n
\nTypical use cases include :\n
\n
\n \n \n value1 \n \n \n\n\n\n The contributed class has to implement the UserMapper interface.\n\n You can also contribute the implementation via a Groovy or JavaScript.\n\n In this case, simply omit the class attribute and add a script tag:\n\n \n \n 0) {\n userAttributes.put(\"email\",userObject.getEmails().iterator().next().getValue());\n }\n String displayName = userObject.getDisplayName();\n if (displayName!=null && !displayName.isEmpty()) {\n int idx = displayName.indexOf(\" \");\n if (idx>0) {\n userAttributes.put(\"firstName\", displayName.substring(0, idx).trim());\n userAttributes.put(\"lastName\", displayName.substring(idx+1).trim());\n } else {\n userAttributes.put(\"firstName\", displayName);\n userAttributes.put(\"lastName\", \"\");\n }\n }\n ]]> \n > emails = new ArrayList<>();\n if (email!=null) {\n emails.add(new Entry(email, \"string\"));\n userObject.setEmails(emails);\n }\n\n Name fullName = new Name(displayName, lname, \"\", fname, \"\", \"\");\n userObject.setSingularAttributeValue(SCIMConstants.SCHEMA_URI_CORE,\n \"name\", Name.NAME_RESOLVER, fullName);\n\n // manage groups\n List groupIds = um.getPrincipal(userId).getAllGroups();\n Collection> groups = new ArrayList<>();\n for (String groupId : groupIds) {\n groups.add(new Entry(groupId, \"string\"));\n }\n userObject.setGroups(groups);\n\n userObject.setActive(true);\n ]]> \n \n \n \n searchAttributes.put(\"username\", userObject.login);\n userAttributes.put(\"firstName\", userObject.name.firstName);\n userAttributes.put(\"lastName\", userObject.name.lastName);\n profileAttributes.put(\"userprofile:phonenumber\", \"555.666.7777\");\n \n \n\n\n\n In the script context for mapping userObject to NuxeoPrincipal :\n getCreateOrUpdateNuxeoPrincipal\n method\n
\nAllow to contribute mapper classes that will be responsible for\nhandling the mapping in 2 directions :\n
\n
\nHere is an example to contribute a custom class :\n
<mapper class="org.nuxeo.usermapper.test.dummy.DummyUserMapper" name="javaDummy">\n <parameters>\n <parameter name="param1">value1</parameter>\n </parameters>\n </mapper>\n\nThe contributed class has to implement the UserMapper interface.\n
\nYou can also contribute the implementation via a Groovy or JavaScript.\n
\nIn this case, simply omit the class attribute and add a script tag:\n
\n
<mapper name="scim" type="groovy">\n <mapperScript><![CDATA[\n import org.nuxeo.ecm.platform.usermanager.UserManager;\n import org.nuxeo.runtime.api.Framework;\n\n UserManager um = Framework.getLocalService(UserManager.class);\n\n String userId = userObject.getId();\n if (userId == null || userId.isEmpty()) {\n userId = userObject.getUserName();\n }\n\n searchAttributes.put(um.getUserIdField(), userId);\n\n if (searchAttributes.containsKey("uid")) {\n userAttributes.put(um.getUserIdField(), searchAttributes.get("uid"));\n }\n\n if (userObject.getEmails() != null && userObject.getEmails().size() > 0) {\n userAttributes.put("email",userObject.getEmails().iterator().next().getValue());\n }\n String displayName = userObject.getDisplayName();\n if (displayName!=null && !displayName.isEmpty()) {\n int idx = displayName.indexOf(" ");\n if (idx>0) {\n userAttributes.put("firstName", displayName.substring(0, idx).trim());\n userAttributes.put("lastName", displayName.substring(idx+1).trim());\n } else {\n userAttributes.put("firstName", displayName);\n userAttributes.put("lastName", "");\n }\n }\n ]]></mapperScript>\n <wrapperScript><![CDATA[\n import org.nuxeo.ecm.core.api.DocumentModel;\n import org.nuxeo.ecm.core.api.NuxeoException;\n import org.nuxeo.ecm.platform.usermanager.UserManager;\n import org.nuxeo.runtime.api.Framework;\n\n import com.unboundid.scim.data.Entry;\n import com.unboundid.scim.data.GroupResource;\n import com.unboundid.scim.data.Meta;\n import com.unboundid.scim.data.Name;\n import com.unboundid.scim.data.UserResource;\n import com.unboundid.scim.schema.CoreSchema;\n import com.unboundid.scim.sdk.SCIMConstants;\n\n UserManager um = Framework.getLocalService(UserManager.class);\n DocumentModel userModel = nuxeoPrincipal.getModel();\n String userId = (String) userModel.getProperty(um.getUserSchemaName(),\n um.getUserIdField());\n\n String fname = (String) userModel.getProperty(um.getUserSchemaName(),\n "firstName");\n String lname = (String) userModel.getProperty(um.getUserSchemaName(),\n "lastName");\n String email = (String) userModel.getProperty(um.getUserSchemaName(),\n "email");\n String company = (String) userModel.getProperty(um.getUserSchemaName(),\n "company");\n\n String displayName = fname + " " + lname;\n displayName = displayName.trim();\n userObject.setDisplayName(displayName);\n Collection<Entry<String>> emails = new ArrayList<>();\n if (email!=null) {\n emails.add(new Entry<String>(email, "string"));\n userObject.setEmails(emails);\n }\n\n Name fullName = new Name(displayName, lname, "", fname, "", "");\n userObject.setSingularAttributeValue(SCIMConstants.SCHEMA_URI_CORE,\n "name", Name.NAME_RESOLVER, fullName);\n\n // manage groups\n List<String> groupIds = um.getPrincipal(userId).getAllGroups();\n Collection<Entry<String>> groups = new ArrayList<>();\n for (String groupId : groupIds) {\n groups.add(new Entry<String>(groupId, "string"));\n }\n userObject.setGroups(groups);\n\n userObject.setActive(true);\n ]]></wrapperScript>\n </mapper>\n <mapper name="jsDummy" type="js">\n <mapperScript>\n searchAttributes.put("username", userObject.login);\n userAttributes.put("firstName", userObject.name.firstName);\n userAttributes.put("lastName", userObject.name.lastName);\n profileAttributes.put("userprofile:phonenumber", "555.666.7777");\n </mapperScript>\n </mapper>\n\nIn the script context for mapping userObject to NuxeoPrincipal :\n
getCreateOrUpdateNuxeoPrincipal\nmethod\n
\nIn the script context for wrapping a NuxeoPrincipal into a userObject :\n
\n\n \n \n value1 \n \n \n\n \n\n The contributed class has to implement the UserMapper interface.\n\n You can also contribute the implementation via a Groovy or JavaScript.\n\n In this case, simply omit the class attribute and add a script tag:\n\n \n\n \n \n 0) {\n userAttributes.put(\"email\",userObject.getEmails().iterator().next().getValue());\n }\n String displayName = userObject.getDisplayName();\n if (displayName!=null && !displayName.isEmpty()) {\n int idx = displayName.indexOf(\" \");\n if (idx>0) {\n userAttributes.put(\"firstName\", displayName.substring(0, idx).trim());\n userAttributes.put(\"lastName\", displayName.substring(idx+1).trim());\n } else {\n userAttributes.put(\"firstName\", displayName);\n userAttributes.put(\"lastName\", \"\");\n }\n }\n ]]>\n \n\n \n > emails = new ArrayList<>();\n if (email!=null) {\n emails.add(new Entry(email, \"string\"));\n userObject.setEmails(emails);\n }\n\n Name fullName = new Name(displayName, lname, \"\", fname, \"\", \"\");\n userObject.setSingularAttributeValue(SCIMConstants.SCHEMA_URI_CORE,\n \"name\", Name.NAME_RESOLVER, fullName);\n\n // manage groups\n List groupIds = um.getPrincipal(userId).getAllGroups();\n Collection> groups = new ArrayList<>();\n for (String groupId : groupIds) {\n groups.add(new Entry(groupId, \"string\"));\n }\n userObject.setGroups(groups);\n\n userObject.setActive(true);\n ]]>\n \n \n\n\n \n \n searchAttributes.put(\"username\", userObject.login);\n userAttributes.put(\"firstName\", userObject.name.firstName);\n userAttributes.put(\"lastName\", userObject.name.lastName);\n profileAttributes.put(\"userprofile:phonenumber\", \"555.666.7777\");\n \n \n\n \n\n In the script context for mapping userObject to NuxeoPrincipal :\n getCreateOrUpdateNuxeoPrincipal\n method\n