Extracting Values from a Custom Principal

[cneberg]

> Scott as we discussed earlier today.
>I think I'm missing context here but...
>>>In your example you seem to be making an assumption about what a
Principal is which transcends java.security.Principal (is youe example X509
specific?

Scott said he had implemented a custom principal to support custom
attributes from external auth.   He didn't remember if was implemented
based on a Map.   I  looked if he was referring to
https://issues.shibboleth.net/jira/browse/IDP-832 and
idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java
its not based on a Map but only a single attribute/value pair.   So I'm
re-thinking the design but I need to know more about how it works in
practice.   If an external auth plugin attaches a few of these principals
to a subject they will automatically be available encoders and all to
release in attribute-filter.xml or does some other code in
attribute_resolver.xml need to make them available to SP's?  Once I
understand I'll re-submit the idea if necessary.

Thanks,
Christopher


On Fri, Feb 12, 2016 at 3:37 AM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> (Aside: I think that this needs to move to dev)
>
> > Scott as we discussed earlier today.
>
> I think I'm missing context here but...
>
> > Something like the code below would have been very
> > useful getting attributes values out of a custom subject class it would
> have cut down on
> > custom javascript considerably.
>
> It would be good to have this in an RFE otherwise it will get lost.
>
> > 1)      Required: PrincipalClass:  What principal class to extract out
> of the subject.
> Is there ever any case when you want more than one principal class?
>
> > If there are multiple matches this logic will be called multiple times
> once per instance.
> > Assumes Principal also has an interface which allows get(String), and
> > Set<String> getKeys().
>
> I'm not sure the relevance of this, but I suspect it comes out in the code.
>
> > 3)      Optional: Attribute list - list of attributes to return or
> return all if not listed
> > 4)      Optional: ReturnAttributes change the name of the attributes on
> return to those specified.
>
> Without understanding more this seems weird.  In your example you seem to
> be making an assumption about what a Principal is which transcends
> java.security.Principal (is youe example X509 specific?
>
>  Rod
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160213/0bc639a3/attachment.html>