Passing information from Authentication Module to Resolvers

[Russell Beall]

Basically I just copied the default principal used with the Username/Password authentication handler.  Then I added 5 additional data elements plus the get/set functions.  This one ended up with the java type name: edu.usc.middleware.shibboleth.idp.authn.oAuthPrincipal.

An example scripted attribute definition can go in the attribute-resolver.xml file and is shown below.  I use a near duplicate of this script for each attribute.  There are a couple of gotcha's that I had to code around such as the potential for multiple principals, so in that instance I iterate through them until I find one that matches the classname I am interested in, if any.  These definitions have to be coded carefully because any error will result in overall attribute resolution failure for the user.  This example should be taken with a grain of salt because I haven't finished my development work on the service that will use this.  So far this one has become pretty stabilized, but there is probably room for improvement.

I expect Chad will recommend the use of a different style of script, but this one uses javascript since working examples of that type already existed in our IdP.  I will add the proviso that if using Terracotta, the modified Rhino javascript engine will be needed where many scripts like this are in use (as mentioned in the IdPCluster documentation).

Regards,
Russ.


    <AttributeDefinition id="oAuthID" xsi:type="ad:Script">
        <DisplayName xml:lang="en">oAuthID</DisplayName>
        <!-- <DisplayDescription xml:lang="en"></DisplayDescription> -->

        <AttributeEncoder xsi:type="enc:SAML1String" name="oAuthID"/>
        <AttributeEncoder xsi:type="enc:SAML2String" name="oAuthID" />

        <Script xmlns="urn:mace:shibboleth:2.0:resolver:ad">
            <![CDATA[
        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
        importPackage(Packages.org.slf4j);
        importPackage(Packages.javax.security.auth);
        importPackage(Packages.java.util);

        logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.scriptTest");

        principalName = requestContext.getPrincipalName();
        logger.debug("oAuth Script, Senior principal name: " + principalName);

        oAuthID = new BasicAttribute("oAuthID");

        session = requestContext.getUserSession();
        if (session != null) {
            subject = session.getSubject();
            principals = subject.getPrincipals();
            i = principals.iterator();

            while (i.hasNext()) {
                principal = i.next();
                principalName = principal.getName();
                if (principal instanceof edu.usc.middleware.shibboleth.idp.authn.oAuthPrincipal) {
                    oAuthID.getValues().add(principalName);
                    logger.debug("oAuth Script, adding principal name: " + principalName);
                }
                else {
                    logger.debug("oAuth Script, Failed to add principal name: " + principalName);
                }
            }
        }
            ]]>
        </Script>
    </AttributeDefinition>

On Aug 10, 2012, at 1:49 PM, cneberg wrote:

> Nice.  I hadn't thought of that. Could you give an example?
> 
> -Topher
> 
> On Mon, Aug 6, 2012 at 10:30 AM, Russell Beall <beall at usc.edu> wrote:
>> I'm developing a simple custom principal to use for this, but instead of a custom resolver, I just use scripted attribute definitions from within the standard resolver config. That is an option, because the scriptlets are capable of understanding the custom principal type.
>