ProfileRequestContext accessibility outside flow actions

[Marvin Addison]

>
> That would have to happen on every request though.
>

Yes, that's correct and intentional.


> That would only work for a limited and relatively undefined subset of the
> flow. I wouldn't expect it to be there by the time LDAP authentication ran,
> for example, since by then it's gone back to the client.
>

I think I need to clarify our use case a little more because that's not
correct afaict. I need to do the following around every ResolveAttributes
action for some subset of authenticated subjects:

1. Grab an LDAP connection from the pool
2. Grab the principal from the PRC using the lookup function I mentioned.
3. Bind as that principal using the SASL authorization ID
4. Resolve attributes
5. Restore the original security context of the pooled connection
6. Return connection to the pool

It may be helpful to explain _why_ we need this. We have ACLs in our
directory that allow some principals to see attributes only on their own
entry, thus the security context when the pool initializes is not
sufficient. We have service principals that are authenticating and we need
to be bound in that security context to resolve attributes. I believe our
implementation sketch would work beautifully with the patch I suggested.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150813/618d501d/attachment.html>