<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"\@PMingLiU";
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
@font-face
{font-family:"Anonymous Pro";
panose-1:2 6 6 9 3 2 2 0 5 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Anonymous Pro";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Garamond","serif";
color:windowtext;
font-weight:normal;
font-style:normal;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Anonymous Pro";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>Dear Mr. Cantor,<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Thank you for your reply.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I know a bit of Java first of all.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The PGP key available for decryption. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I have written a simple PHP script to test how to get the host variables passed from Shibboleth and decrypt values inside the attribute, the source is something like this:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><?php<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText># require_once 'Crypt/GPG.php';<o:p></o:p></p><p class=MsoPlainText>$safe_text = $_SERVER['street'];<o:p></o:p></p><p class=MsoPlainText>$eppn = $_SERVER['eppn'];<o:p></o:p></p><p class=MsoPlainText>$CONFIG['gnupg_home'] = '/root/.gnupg';<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>(snip)<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> $cmd = "/usr/local/bin/gpg2 --homedir=/var/www/.gnupg --passphrase $pass --batch --yes -d $safe_text";<o:p></o:p></p><p class=MsoPlainText>}<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>?><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'>Of course, this does not work in my case, since the decrypted value has to be passed on to the black box (inside REMOTE_USER env var?)<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'>I am not trying to avoid coding but I need a direction where I can start.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Garamond","serif";color:black'><o:p> </o:p></span></p><p class=MsoPlainText><span style='font-family:"Garamond","serif";color:black'>Griffin CHENG.<br><br></span><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On 2/6/14, 8:19 PM, "Griffin Cheng [CLIB]" <<a href="mailto:cscheng@cpce-polyu.edu.hk">cscheng@cpce-polyu.edu.hk</a>><o:p></o:p></p><p class=MsoPlainText>wrote:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>>Sorry, I am a newbie to Shibboleth. I do not understand what ?plugin <o:p></o:p></p><p class=MsoPlainText>>hook? is about and how the whole workflow can ?attach? to it. The <o:p></o:p></p><p class=MsoPlainText>>problem is, the attribute in question is stored encrypted in the first <o:p></o:p></p><p class=MsoPlainText>>place, using key that is not part of the Shibboleth itself.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I can't teach you how to build an extension. Not in Java, and certainly not in C++. If you don't have those skills, there's no way to do this. If you do, then you need to learn how Shibboleth works by reading documentation and looking at the code and figuring out how to extend it.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I don't know where/when you want to decrypt the data, or on which end, and I can't determine that for you. If I did, then I could describe what kind of plugin is needed to do this.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Furthermore, if the PGP key needed to decrypt the data isn't available at the place you want to do it, then you're done. You can't do anything with the data without that.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-- Scott<o:p></o:p></p><p class=MsoNormal><span style='font-family:"Garamond","serif"'><o:p> </o:p></span></p></div></body></html>