Resolving Tomcat GenericPrincipal roles to attributes?

[Nathan Mische]

So as a bit of background we are consolidating several user data stores
behind one IdP. We are using a Tomcat CombinedRealm to do "fall-through"
authentication and populating roles based on the the realm the user
authenticates against. For JNDI (LDAP) realms we are using the commonRole
attribute to hard code this value. Here is an example:

  <Realm className="org.apache.catalina.realm.CombinedRealm" >

      <!-- Check Directory A-->
      <Realm className="org.apache.catalina.realm.JNDIRealm"
             connectionURL="ldaps://a.example.edu:636"
             userPattern="uid={0},ou=a,dc=example,dc=edu"
             userRoleName="eduPersonAffiliation"
             commonRole="directoryA" />

      <!-- Check Directory B-->
      <Realm className="org.apache.catalina.realm.JNDIRealm"
             connectionURL="ldaps://b.example.edu:636"
             userPattern="uid={0},ou=b,dc=example,dc=edu"
             userRoleName="eduPersonAffiliation"
             commonRole="directoryB" />

        <!-- Check Database C, users in this database will have a role of
'directoryC'-->
        <Realm className="org.apache.catalina.realm.JDBCRealm"
            connectionName="username"
            connectionPassword="password"
            connectionURL="jdbc:mysql://localhost:3306/directoryc_users"
            driverName="com.mysql.jdbc.Driver"
            userTable="users" userNameCol="user_name"
userCredCol="user_pass"
            userRoleTable="user_roles" roleNameCol="role_name"/>

  </Realm>

Unfortunately there is no guarantee the usernames will be unique across all
of the data stores.  Would a better approach in this situation be to create
unique usernames via an external auth handler? Basically I'm thinking of
concatenating the username with the realm identifier: user at directoryA?

Thanks for the feedback,

--Nathan

On Wed, Dec 5, 2012 at 10:12 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/5/12 9:46 AM, "Nathan Mische" <nmische at gmail.com> wrote:
> >
> >We currently have a Shibboleth 2.5 IdP instance running on Tomcat 6 using
> >container based authentication and the remote user login handler. We
> >would like to expose the Tomcat principal's roles as attributes, is this
> >possible?
>
> Probably, but I wouldn't do that. Whatever you're using to populate the
> roles you should simply expose directly from the data source to the
> resolver. Leave the authentication step to produce a clear and simple
> username and that's all.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121205/ef409195/attachment.html