How can i pass additional attributes in a SAML authentication request from SP to IdP using Shibboleth?

[Kilian Ries]

Hi Shibboleth dev-list,

I'm trying to pass additional attributes with dynamic content into it from SP to IdP inside the SAML AuthnRequest.

Let me explain my situation in detail:

I'm working on a research-prototype. The base-struckture is running well, here is an overview:


SP1 (protected web resource) <--> IdP1 (user/password) with "internal" SP2 <--> IdP2 (biometric authentication)


The IdP1 communicates intern with the SP2 (running on the same machine): SP2 receives the attributes form  IdP2 and the IdP1 fetches them from the SP2 (working!).

Now, SP2 should send the needed information (typing sample (STRING) from the biometric authentication, recorded by a flash-recorder on the IdP1's website) to IdP2 as an attribute within the SAML AuthnRequest. With that
typing-sample attribute the IdP2 can authenticate the user and send the authentication-information back to the SP2.

To realize that scenario, i think i must modify the SP and insert custom code.

The last days i checked the Shibboleth SP sourcecode. In the "ServiceProvider.cpp" file i found the following code:


void SHIBSP_DLLLOCAL clearHeaders(SPRequest& request) {
const Application& app = request.getApplication();
app.clearHeader(request, "Shib-Session-ID", "HTTP_SHIB_SESSION_ID");
app.clearHeader(request, "Shib-Identity-Provider", "HTTP_SHIB_IDENTITY_PROVIDER");
app.clearHeader(request, "Shib-Authentication-Method", "HTTP_SHIB_AUTHENTICATION_METHOD");
app.clearHeader(request, "Shib-Authentication-Instant", "HTTP_SHIB_AUTHENTICATION_INSTANT");
app.clearHeader(request, "Shib-AuthnContext-Class", "HTTP_SHIB_AUTHNCONTEXT_CLASS");
app.clearHeader(request, "Shib-AuthnContext-Decl", "HTTP_SHIB_AUTHNCONTEXT_DECL");
app.clearHeader(request, "Shib-Assertion-Count", "HTTP_SHIB_ASSERTION_COUNT");
app.clearAttributeHeaders(request);
request.clearHeader("REMOTE_USER", "HTTP_REMOTE_USER");
}


Is this the code, where the SP builds the authnRequest? If yes, i'll have to implement code there to insert a new "attribute" to the AuthnRequest, right? If not, where can I find the code which i'll have to modify?

Is there anything else which i'll have to pay attention to?

Thanks
Greets
Kilian Ries

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120509/060f1ec3/attachment.html