Decrypting attributes on-the-fly

[Christopher Bongaarts]

On 2/6/2014 10:17 PM, Griffin Cheng [CLIB] wrote:
> Also, I would resort from shelling out to decrypt (the code I post 
> earlier is a proof-of-concept but the execution is flawed for 
> simultaneous accesses), but I would opt for calling GPG API instead.

If you want to do this on the SP side, use Scott's link as a general 
guide, but the plugin type you'll want to implement is an 
AttributeDecoder.  In the Shibboleth SP source, the definition is in

   /shibsp/attribute/AttributeDecoder.h

In that same directory, the StringAttributeDecoder.cpp file might serve 
as a useful starting point, assuming you want to end up with a string 
value after decryption.  You'd basically be hooking in your GPG API 
calls just prior to the dest.push_back(val.get()) call on line 111 (SVN 
commit 3883 = SP release 2.5.3).

Then, in your attribute-map.xml file, you'd specify an AttributeDecoder 
for the encrypted Attribute with your plugin as the xsi:type.

If you want to do it on the IdP side, the easiest way (if the GPG API is 
available as a Java .jar) would be to use a ScriptedAttributeDefinition 
in the attribute-resolver.xml for that attribute, and call the GPG API 
functions from the script.  See the docs for ScriptedAttributeDefinition 
for more info and examples:

https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinition

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140207/fe1e7c22/attachment.html