Decrypting attributes on-the-fly

[Griffin Cheng [CLIB]]

Dear Mr. Bongaarts,

Thank you.  So I just change the file: 

shibsp/attribute/StringAttributeDecoder.cpp

and add the GPG code to decode the variable "val".  Is it right?

If I make the project, would it produce a plug-in of which type?

Sorry, I am a total noob on this.

Thank you.


Regards,


Griffin CHENG.

-----Original Message-----

Date: Fri, 07 Feb 2014 11:39:15 -0600
From: Christopher Bongaarts <cab at umn.edu>
Subject: Re: Decrypting attributes on-the-fly
To: dev at shibboleth.net
Message-ID: <52F51A43.6090709 at umn.edu>
Content-Type: text/plain; charset="iso-8859-1"

On 2/6/2014 10:17 PM, Griffin Cheng [CLIB] wrote:
> Also, I would resort from shelling out to decrypt (the code I post 
> earlier is a proof-of-concept but the execution is flawed for 
> simultaneous accesses), but I would opt for calling GPG API instead.

If you want to do this on the SP side, use Scott's link as a general guide, but the plugin type you'll want to implement is an AttributeDecoder.  In the Shibboleth SP source, the definition is in

   /shibsp/attribute/AttributeDecoder.h

In that same directory, the StringAttributeDecoder.cpp file might serve as a useful starting point, assuming you want to end up with a string value after decryption.  You'd basically be hooking in your GPG API calls just prior to the dest.push_back(val.get()) call on line 111 (SVN commit 3883 = SP release 2.5.3).

Then, in your attribute-map.xml file, you'd specify an AttributeDecoder for the encrypted Attribute with your plugin as the xsi:type.

If you want to do it on the IdP side, the easiest way (if the GPG API is available as a Java .jar) would be to use a ScriptedAttributeDefinition in the attribute-resolver.xml for that attribute, and call the GPG API functions from the script.  See the docs for ScriptedAttributeDefinition for more info and examples:

https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinition

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%