How to retrieve SP required attributes at the IDP before authentication

[Paul Hethmon]

If you wanting Shibboleth IdP to resolve and populate attributes prior to authentication, then no, it is not designed to support that. It's not clear to me if you are wanting the list of requested attributes for a particular SP or a list of the attribute values for an SP for a particular user. You would have access to the list of requested attributes as stored in the metadata file for the SP inside of your login handler.

If you are more talking about the attribute values, then the only way to do that would be to resolve them your self during authentication. I do this myself as my authentication process returns information about the user. I then put that information in the session where my custom attribute resolver gets them when Shib runs the attribute code.

Does that help?

Paul

From: Dierick Bart <bart.dierick at hotmail.com<mailto:bart.dierick at hotmail.com>>
Reply-To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Wed, 21 Mar 2012 16:47:46 +0100
To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: How to retrieve SP required attributes at the IDP before authentication


1) Is it possible to provide the required SP attributes before the authentication?
2) What is the best (if I need the attributes in my loginhandler)? Get them out of the metadata of the SP or in the authentication request by value or reference?
3) Is it than possible to use these attribute (information) in my loginhandler?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120321/6f75b8f3/attachment-0001.html