<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@PMingLiU";
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
@font-face
{font-family:"Anonymous Pro";
panose-1:2 6 6 9 3 2 2 0 5 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Anonymous Pro";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Anonymous Pro";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Garamond","serif";
color:windowtext;
font-weight:normal;
font-style:normal;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Garamond","serif";
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Garamond","serif"'>Dear Mr. Cantor,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'>Further thoughts: Do you mean I can actually encrypt the data, stored in an attribute of the IdP (which is an ADFS btw), and decrypt it using the key pair during Shibboleth installation? All I need is to tell Shibboleth to decrypt that attribute automatically, when authentication is successful, right?<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-family:"Garamond","serif";color:black'>Griffin CHENG.<br>Telephone: 3746 0853<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Griffin Cheng [CLIB] <br><b>Sent:</b> Friday, 07 February, 2014 09:19<br><b>To:</b> 'dev@shibboleth.net'<br><b>Subject:</b> Re: Decrypting attributes on-the-fly<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoPlainText>Dear Mr. Cantor,<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Sorry, I am a newbie to Shibboleth. I do not understand what “plugin hook” is about and how the whole workflow can “attach” to it. The problem is, the attribute in question is stored encrypted in the first place, using key that is not part of the Shibboleth itself. Thank you.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoPlainText style='margin-bottom:12.0pt'><span style='font-family:"Garamond","serif";color:black'>Griffin CHENG.</span><o:p></o:p></p><p class=MsoPlainText>-----<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On 2/6/14, 7:23 PM, "Griffin Cheng [CLIB]" <<a href="mailto:cscheng@cpce-polyu.edu.hk">cscheng@cpce-polyu.edu.hk</a>><o:p></o:p></p><p class=MsoPlainText>wrote:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>>The question is: how can I decrypt this attribute on-the-fly, without <o:p></o:p></p><p class=MsoPlainText>>changing the requesting application, which is a black box. I think I <o:p></o:p></p><p class=MsoPlainText>>may be able to something during the attribute mapping but I have no <o:p></o:p></p><p class=MsoPlainText>>clue for now.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Both the SP and the IdP have plugin hooks enabling this, but you'd have to write code, there really isn't anything else you can do.<o:p></o:p></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-- Scott<o:p></o:p></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'>-----<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>