injecting and later consuming <saml:Subject>

[Cantor, Scott]

> With version 2.6 it appears that the 'template' NativeSP
> Session Creation parameter for the /Shibboleth.sso/Login
> session initiator mechanism will allow me to do that. Correct?

Yes, provided you're comfortable with the security implications or aren't using signed requests. Obviously without signing, forging requests from the SP doesn't really require its cooperation.

> Next please consider the Shibboleth IdP 3.2.x. Suppose that I
> want to create a custom Password flow, modified from the
> default flow, that is able to inspect the <AuthnRequest>,
> determine if a <saml:Subject> exists, and then perform some
> special actions if it does exist.

Actually, the Subject element is processed by the IdP now (e.g. consider queries) and I will have to look at the code and tell you exactly what it's doing during SSO. Point being you may not have to even look at the Subject itself to do something.

What I think it's doing is verifying that the canonical subject that gets produced during the login matches the reverse-mapped identity that the system obtains from the Subject, as that's what the SAML spec says to do. But I don't recall where it stashes the value. I think it may be creating a preliminary SubjectContext and notices that it's already there when it finalizes the authentication process and just checks for a match.

So if you care about the username more than the actual Subject XML, which would make sense, that's all done for you if you configure the Subject mapping behavior via the c14n layer in the IdP. You could have it do attribute resolution if you need it to to reverse map with LDAP or a database.

> Will my custom Password flow have "easy" access to the
> <AuthnRequest> and be able to inspect it for the
> <saml:Subject>? By "easy" here I mean that I can write
> "reasonable" amounts of Java code and get the subject.

If you did have to, yes, it's trivial:

((AuthnRequest) profileRequestContext.getInboundMessageContext().getMessage()).getSubject()

-- Scott