Access principal name from servlet filter

[Cantor, Scott]

On 8/21/15, 10:50 AM, "dev on behalf of Etienne Dysli-Metref" <dev-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:

>A post-authentication intercept seems cleaner, but requires modifying
>more files to configure (flow xml, beans, relying party, etc.).

Yes, it's either that (and restart) or web.xml + rebuild.

> Which profile action class should I use/extend to access the user name in this case?

You can't really just extend an existing action and make that work because the intercept flow is just a separate set of actions running.

The basic rules for writing action beans are in [1] and are pretty up to date. So you have two choices, generally, creating one that's Spring-aware or one that's not. This one probably wouldn't need to be, so it would be inheriting from the OpenSAML version of AbstractProfileAction.

Any profile action can access the HttpServletRequest/Response, you just have to inject beans called shibboleth.HttpServletRequest and shibboleth.HttpServletResponse into the httpServletRequest/Response properties of the bean (they're on the base class).

So your profile action would probably just implement doExceute() to check for a SubjectContext and a principal name and then set the cookie into the response.

You could also, if you wanted, look at using a bean we have called shibboleth.CookieManager that implements this class: net.shibboleth.utilities.java.support.net.CookieManager

That would avoid the need for any manual cookie work, and would create the cookie with the properties defined in idp.proprties near the top. Might or might not be appropriate. Either way your action bean will be very simple.

Creating an intercept flow with a single action in it is fairly trivial, it's just one action-state:

<flow xmlns="http://www.springframework.org/schema/webflow"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
      parent="intercept.abstract">

    <action-state id="MyAction">
    <evaluate expression="MyAction" />
    <evaluate expression="'proceed'" />
</action-state>

    
    <bean-import resource="my-flow-beans.xml" />

</flow>


It's a lot of boilerplate and overhead, but the purpose of it is to create a lot of really bulletproof isolation between our stuff and your stuff that survives upgrades.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/Profile+Actions