Resolving Tomcat GenericPrincipal roles to attributes?

[Cantor, Scott]

On 12/5/12 9:46 AM, "Nathan Mische" <nmische at gmail.com> wrote:
>
>We currently have a Shibboleth 2.5 IdP instance running on Tomcat 6 using
>container based authentication and the remote user login handler. We
>would like to expose the Tomcat principal's roles as attributes, is this
>possible?

Probably, but I wouldn't do that. Whatever you're using to populate the
roles you should simply expose directly from the data source to the
resolver. Leave the authentication step to produce a clear and simple
username and that's all.

-- Scott