SAML2 IdP Extension

[Romstorfer, Georg]

Hello,

I'm trying to develop an extension for the Shibboleth Idp V3. My requirements are the following:

-          The SP sends a SAML2 AuthnRequest containing a certificate in <samlp:Extensions>

-          My Idp extension should take this certificate, encrypt the resolved attributes with it and put them in the Advice-Tag of the AuthnResponse

In V2, I would have extended the SAML2ProfileHandler, but in V3 I don't know where to start.
Where would be the best place to implement this functionality?
Please provide me some hints in the right direction.


I asked this first at shib-users and got the following answer from Rod (thanks for the quick response):



>I suggest you move this over to shib-dev

>

>Meantime you should review the sketchy documentation (we will add to it, but cycles are short and we have to prioritise)

>

>https://wiki.shibboleth.net/confluence/display/IDP30/Extension+Development+Guide

>

>and

>

>https://wiki.shibboleth.net/confluence/display/IDP30/SpringConfiguration

>

>Also start reading the XML files in system\flows\saml, because you'll be adding stuff like that

>

>Rod

I already looked into these documents and files, but I think I need a little more help.
My understanding so far is, that I have to override the whole SAML2 web-flow,
and inject a custom action somewhere at the beginning of the flow to extract the certificate
and a second action after the AttributeResolution or BuildResponse action to encrypt the attributes.
Maybe it is also possible to implement only the second action at the end if the request can be accessed from there?

I already found the file "system/flows/saml/saml2/sso-abstract-flow.xml" that describes that flow, but I don't know
how to override it or how to introduce additional actions into it. Neither do I know how the actions correspond to any Java-Classes.

Many thanks in advance

Georg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150326/119174d1/attachment.html