Decrypting attributes on-the-fly

[Griffin Cheng [CLIB]]

Dear Mr. Cantor,



Thank you for your reply.



I know a bit of Java first of all.



The PGP key available for decryption.



I have written a simple PHP script to test how to get the host variables passed from Shibboleth and decrypt values inside the attribute, the source is something like this:



<?php



# require_once 'Crypt/GPG.php';

$safe_text = $_SERVER['street'];

$eppn = $_SERVER['eppn'];

$CONFIG['gnupg_home'] = '/root/.gnupg';



(snip)



    $cmd = "/usr/local/bin/gpg2 --homedir=/var/www/.gnupg --passphrase $pass --batch --yes -d $safe_text";

}



?>

Of course, this does not work in my case, since the decrypted value has to be passed on to the black box (inside REMOTE_USER env var?)

I am not trying to avoid coding but I need a direction where I can start.


Regards,



Griffin CHENG.




-----



On 2/6/14, 8:19 PM, "Griffin Cheng [CLIB]" <cscheng at cpce-polyu.edu.hk<mailto:cscheng at cpce-polyu.edu.hk>>

wrote:



>Sorry, I am a newbie to Shibboleth. I do not understand what ?plugin

>hook? is about and how the whole workflow can ?attach? to it.  The

>problem is, the attribute in question is stored encrypted in the first

>place, using key that is not part of the Shibboleth itself.



I can't teach you how to build an extension. Not in Java, and certainly not in C++. If you don't have those skills, there's no way to do this. If you do, then you need to learn how Shibboleth works by reading documentation and looking at the code and figuring out how to extend it.



I don't know where/when you want to decrypt the data, or on which end, and I can't determine that for you. If I did, then I could describe what kind of plugin is needed to do this.



Furthermore, if the PGP key needed to decrypt the data isn't available at the place you want to do it, then you're done. You can't do anything with the data without that.



-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140207/4e93d1db/attachment.html