openid plugin and attributes

[Cantor, Scott]

On 3/2/16, 9:14 PM, "dev on behalf of Paul Hethmon" <dev-bounces at shibboleth.net on behalf of paul.hethmon at clareitysecurity.com> wrote:



>So I will take a closer look at the API.

I may have been confused, I guess you're talking V2. It doesn't exactly change my answer but as you're aware V2 is more monolithic.

The old MetadataProvider API is the equivalent of what I was talking about to drive the rest of the relying party behavior.

>So I’ve created a proxy between OIDC and SAML. My point today was to take that another step and actually be a corresponding SAML RP for each OIDC RP. For each RP pair, the OIDC proxy would receive the correct set of attributes to release.

I see.

>I went down this path for a couple of reasons. The first is I’m still running Shib v2 and I wanted a model/plugin I could use now for v2 and later this year for v3. The second reason is that I wasn’t aware of a way to trigger the current flows in Shib for a different protocol. If I can do that, I’m definitely interested in going there.

You can, even with 2, it's just somewhat all encompassing. You're just writing a new profile handler. A lot of the internals assumed XML messages, and so writing a different kind of profile handler was sort of a from-scratch exercise that didn't really reuse a lot of code, but then again doing it outside is still from scratch, so not much different.

A profile handler in the V2 design isn't a lot different from a plain servlet, really.

> I feel I’m fairly familiar with the v2 stuff, mostly on the login handler and attribute models. I never had a reason to go deep into the profile handlers. I haven’t looked at v3 architecture at all.

The profile handlers in V2 are just kind of an internal servlet-like dispatching mechanism Chad did, they pretty much handle the whole request start to finish, so can do just about anything.

>So if I can add a profile handler and insert myself into the core of Shib via configuration (ie internal.xml, handler.xml, etc) I’m definitely game to go there.

You can, I plugged the proprietary logout handler in easily enough.

-- Scott

>