<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" /> <base href="https://issues.shibboleth.net/jira" />
<title>Message Title</title>
</head>
<body class="jira" style="color: #333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<!-- header here -->
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-cgreiner@idp.protectnetwork.org-a1042dc6-5b88-41ed-81d3-95ea4253feef" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top" />
</td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="cgreiner@idp.protectnetwork.org" id="email_cgreiner@idp.protectnetwork.org" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cgreiner%40idp.protectnetwork.org" style="color:#3b73af;; color: #3b73af; text-decoration: none">cgreiner@idp.protectnetwork.org</a> <strong>edited a comment</strong> on <a href="https://issues.shibboleth.net/jira/browse/IDP-796" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-static-newfeature-5f92f960-3f4a-4895-aafb-05d449a67bcd" height="16" width="16" border="0" align="absmiddle" alt="New Feature" /> IDP-796</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 15px; background-color: #fff; border-left: 1px solid #ccc; border-top: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly">
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-796" style="color: #3b73af; text-decoration: none">Re: A feature to allow release user password as attribute</a> </span>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-special-margin comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff; border-bottom: none; padding-bottom: 0">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0; padding-top: 10px"> <span class="diffcontext">Not sure if this was a rhetorical question so here's the Script Attribute Definition we use on our current v2 IdP.<br /><br /></span> <span class="diffaddedchars" style="background-color:#ddfade;"><br /></span> <span class="diffcontext">{</span> <span class="diffremovedchars" style="background-color:#ffe7e7;text-decoration:line-through;">{</span> <span class="diffaddedchars" style="background-color:#ddfade;">code:xml}<br /></span> <span class="diffcontext"> <resolver:AttributeDefinition xsi:type="ad:Script" id="password" dependencyOnly="true"><br /> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:password" /><br /> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.1466.115.121.1.40" friendlyName="password" /><br /> <ad:Script><br /> <![CDATA[<br /> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);<br /> importPackage(Packages.edu.internet2.middleware.shibboleth.idp.authn.provider);<br /> importPackage(Packages.org.opensaml.xml.util);<br /> importPackage(Packages.javax.crypto);<br /> importPackage(Packages.javax.crypto.spec);<br /> importPackage(Packages.java.security);<br /> importPackage(Packages.java.io);<br /> importPackage(Packages.sun.misc);<br /><br /> // Create new password attribute<br /> password = new BasicAttribute("encPassword");<br /><br /> // Verify the existence of a user session (login at another IdP)<br /> if (requestContext.getUserSession() != null) {<br /><br /> // Load IV<br /> salt_bytes=[---REDACTED---];<br /> salt_array=java.lang.reflect.Array.newInstance(java.lang.Byte.TYPE, salt_bytes.length);<br /> for(j=0; j<salt_bytes.length; j++) {<br /> s=new java.lang.Integer(salt_bytes[j]);<br /> salt_array[j]=s.byteValue();<br /> }<br /> salt = new IvParameterSpec(salt_array);<br /> // Load key<br /> key_ois = new ObjectInputStream(new ByteArrayInputStream(Base64.decode("---REDACTED---")));<br /> key = key_ois.readObject();<br /> ec = Cipher.getInstance("AES/CBC/PKCS5Padding");<br /> ec.init(Cipher.ENCRYPT_MODE, key, salt);<br /><br /> // Get subject<br /> userSubject = requestContext.getUserSession().getSubject();<br /><br /> // Get credentials<br /> i = userSubject.getPrivateCredentials(edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordCredential).iterator();<br /><br /> while ( i.hasNext() ) {<br /> // Set password<br /> credential = i.next();<br /> encrypted = ec.doFinal(credential.getPassword().getBytes("UTF8"));<br /> password.getValues().add(Base64.encodeBytes(encrypted));<br /> }<br /> }<br /> ]]><br /> </ad:Script><br /> </resolver:AttributeDefinition></span> <span class="diffaddedchars" style="background-color:#ddfade;"><br />{code</span> <span class="diffcontext">}</span> <span class="diffremovedchars" style="background-color:#ffe7e7;text-decoration:line-through;">}</span> <span class="diffcontext"><br /><br /></span> <span class="diffaddedchars" style="background-color:#ddfade;"><br /></span> <span class="diffcontext">It's inspired by this SWITCH document (which contains an example without encryption):<br />[https://www.switch.ch/aai/support/presentations/opcom-200909/AAI-OpCom-Password-as-attribute.pdf]</span>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0px; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-796#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-b22f7682-10bc-43a0-817e-2e799d22839d" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle" /> </a>
</td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-796#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #fff; border-top: 0; border-left: 1px solid #ccc; border-bottom: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly">
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">
This message was sent by Atlassian JIRA <span id="footer-build-information">(v6.4.1#64016-<span title="5d7581434f35c063b7031942e62ed4d72a97fa9c" data-commit-id="5d7581434f35c063b7031942e62ed4d72a97fa9c}">sha1:5d75814</span>)</span>
</td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-97bbd1c4-8911-4c34-a794-abf762532655" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix" />
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>