custom authentication flow that includes attributes

[Cantor, Scott]

On 11/6/15, 1:10 PM, "dev on behalf of Scott Koranda" <dev-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:



>I need to implement a custom authentication flow. As part of
>the flow attributes about the user will be available. I would
>like the IdP to then be able to assert those attributes
>(possibly modified). The issue is how to get the attributes
>"through the flow" and available for attribute resolution.

This is something I'm probably going to look into more after 3.2, because it's going to come up a lot and I don't like the total separation right now.

But at the moment, the only real official medium is the Subject produced by a login flow.

>My first instinct is to have the custom flow store the
>attributes in the IdP session and then code a custom data
>connector that implements AbstractDataConnector as noted here:

The Subject(s) rather than the session, but yes, basically. I ran out of time for this release to look at actually building a connector, but there's now an official IdPAttributePrincipal that is serializeable into the session and lets any login flow, including External ones, pass back attributes.

If you wanted to build one, I'd probably just add it to 3.3.

>The custom data connector would simply get the parent of the 
>AttributeResolutionContext it is passed, and then from that
>get the session context and then find the attributes in the
>session.

SubjectContext and Subject(s) in the AuthenticationResult(s). There really isn't any data you can store in the session itself.

That does only work front-channel, of course.

>Is there a more elegant approach I am missing?

The resolver doesn't have a real notion of input attributes right now, but what I would like to do for 3.3 is support some kind of feature to retain attributes resolved earlier in a request flow and prime the resolver with them.

-- Scott