Shib SP, how to implement an access control plugin

[Cantor, Scott]

On 12/7/11 1:48 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
>
>I would like to better understand what is invovled in
>implementing an access control plugin. What is the best
>approach?

This is more of a dev list topic, I'd direct any follow up there (I would
myself, but Outlook, etc.)

Unfortunately there are no documents on extending the SP because of the
lack of interest (which is circular but true). The resources that exist
are basically:

- the existing code (obviously)
- using doxygen to generate the API documentation across all three packages
- a skeleton project for starting an extension library that's checked into
svn, called cpp-sp-ext

The skeleton project is sometimes not up to date in terms of build files,
but it's a mostly working autoconf project with some bare bones code for
the mechanics of getting a library loaded. If you're serious about it, I
can probably find enough time to document at least the mechanics that go
into a plugin. It's not that much to write up, just not a ten minute
exercise.

Another example of a plugin that's self-contained at this stage is in the
plugins/ directory of the SP branch.

The access control plugin example itself is self-contained even though the
code is inside the SP, in shibsp/impl. It is a good example. The API
itself is one interface, defined in include/shibsp/AccessControl.h, though
obviously you have to follow the classes to the other interfaces that its
given to use to examine the request.

If you're asking at sort of a basic level and I'm giving you more than you
wanted, I guess the answer is, a plugin to the SP is a shared library with
a defined extern "C" signature for load and unload, and a C++ class and a
factory function that's registered to create instances of the class
associated with a "type" string. You register the factory at library load,
and the SP will call the factory if the configuration includes a plugin
type that maps to your factory. The rest is just C++ polymorphism, and
your class is used the same way mine are.

All of this works the same way on Windows also, but the Windows build is
sufficiently less fun. I do have an "SDK" like thing that contains import
libraries and headers though. No idea if it actually works.

-- Scott