Add custom attributes to assertion

[David Huebner]

Hi all,

I have posted a similar thread to the users list some days ago and 
basically got redirected to the dev list.
I'll start by quoting (and slightly adjusting) my goal from the original 
thread:
> we are using a custom Data Connector to resolve attributes from 
> environment variables.
> The requirement now is to encode some of these attributes in a rather 
> specific manner, which seems to comply with SAML2-Core, e.g.:
> <saml2:Attribute xmlns:somens="..." Name="somename" 
> somens:customattribute="somevalue" 
> somens:anothercustomattribute="somevalue2" />
>
> At first glance, I don't think I can do that with the existing 
> Attribute Encoders.
> So, basically I can either use a custom Attribute Encoder (is that 
> even possible without lots of customization and what would be a good 
> starting point?) or do it in some form of post-authn interceptor, that 
> adds my attributes independently of the attribute-resolver.
>
> Any better options and what way would you recommend? Are there 
> existing solutions for that?

Summary: I need Attributes with no <AttributeValues>, but some 
additional attributes (SAML2 Core allows "Arbitrary attributes" as an 
extension point, so basically that's what I'm looking for).
I think I can achieve that with a custom Attribute Encoder (and Rod 
Widdowson's reply in the original thread implies that as well), but I am 
free to other, perhaps easier, suggestions.

So, I started looking into the code and took the SAML2String Encoder as 
a starting point.
My idea is to basically store the attribute values ("somevalue" in the 
example above) as IdPAttributes while processing and then deal with them 
in the Attribute Encoder.

For that I intend to override 
net.shibboleth.idp.saml.attribute.encoding.AbstractSAML2AttributeEncoder.buildAttribute() 
and not add the attributeValues in the end.

In addition to that, I need to add the two custom attributes (as well as 
the namespace). The OpenSAML Attribute extends 
AttributeExtensibleXMLObject and therefore should allow for the 
anyAttribute extensions.
Unfortunately I am a bit lost here, so my questions would be:

- Does this make sense at all or should I approach this differently?
- If it does, how do I add such anyAttribute attributes to my attribute? 
Where should I start looking?

Cheers.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2269 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20171010/9dcb9740/attachment-0001.p7s>