Extracting Values from a Custom Principal

[Cantor, Scott]

On 2/13/16, 1:31 PM, "dev on behalf of cneberg" <dev-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:


>
>Scott said he had implemented a custom principal to support custom attributes from external auth.   He didn't remember if was implemented based on a Map.   I  looked if he was referring to https://issues.shibboleth.net/jira/browse/IDP-832 and idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java its not based on a Map but only a single attribute/value pair.   So I'm re-thinking the design but I need to know more about how it works in practice.

I created it for Misagh and just generally so that it was possible to pass back attributes from an External Authn integration.

I don't believe I have (yet) actually created any resolver plugins to operate on them, but the natural thing to do would be to just write a DataConnector that pulls them all out as the result of the connector.

>   If an external auth plugin attaches a few of these principals to a subject they will automatically be available encoders and all to release in attribute-filter.xml
> or does some other code in attribute_resolver.xml need to make them available to SP's?

Well, nominally the latter. But I need to review some of the resolver internals. In theory if the IdPAttribute were actually created with AttributeEncoders attached, it could maybe be directly exposed somehow without layering another attribute on top of it, but I don't think it's that simple right now.

I think you have cases where you might want to generate new attributes with a naming prefix, for example, and I was thinking maybe we could build that in. But I agree, it's unwieldy to have to create a whole separate set of definitions on top. But no matter what, they can't leave the resolver and show up in SAML unless there are encoders attached, and I'm not sure if that can really be automated.

-- Scott