Attributes and forwarding to Relay state

[Kantzer, Chris E]

Scott wrote
>That isn't secure. That would require an additional SSO protocol to
secure
>the exchange and is up to you to implement if that's what you want.

Okay, we will have to find a way to implement it.

But before I put the cart before the horse, I'm wondering if my
attribute config is correct.

I need to verify the 'payload' attribute is being processed from the
saml assertion.

I've created an attribute in attribute-map.xml which maps the saml
attribute with name 'payload' to an id of 'payload'.   

Here's what I see in the logs when the sp is processing the saml
assertion:
DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed attributes...
DEBUG Shibboleth.AttributeExtractor.XML [1]: skipping unmapped NameID
with format (urn:oasis:names:tc:SAML:1.1:nameid-format:transient)
DEBUG Shibboleth.AttributeDecoder.String [1]: decoding SimpleAttribute
(payload) from SAML 2 Attribute (payload) with 1 value(s)
DEBUG Shibboleth.AttributeFilter [1]: filtering 1 attribute(s) from
(ALG_IP_10)
DEBUG Shibboleth.AttributeFilter [1]: applying filtering rule(s) for
attribute (payload) from (ALG_IP_10)
DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes...
DEBUG Shibboleth.AttributeResolver.Query [1]: found AttributeStatement
in input to new session, skipping query
DEBUG Shibboleth.SessionCache [1]: creating new session
2012-03-20 13:50:12 DEBUG Shibboleth.SessionCache [1]: storing new
session...

It looks like it's getting the attribute value correctly.  But I'm not
sure where the value of payload is being stored and how I would access
it either through Apache or some other way.

Any advice would be helpful as I'm still learning this as I go.

FYI : Our SP is not protecting requests.  It just is providing SSO
capabilities for our web app deployed on Weblogic (which is on a
different domain).  Once the user is authenticated in our web app then
all requests go straight to the web app server, bypassing the sp.

On 3/16/12 1:38 PM, "Kantzer, Chris E" <ckantzer at affiniongroup.com>
wrote:

>Attributes and forwarding to Relay stateHello,
>Is there a way that an attribute consumed from the saml assertion can
be
>added to the request that is forwarded to the url in the relay state?
>The url in the relay state is on a different domain than the sp.

That isn't secure. That would require an additional SSO protocol to
secure
the exchange and is up to you to implement if that's what you want.

>Are the attributes added to the session that is created by the sp?  Is
>this session forwarded to the relay state url even if they are on
>separate domains?

The session is bound to a cookie that has to be sent back to the SP on
every protected request. You cannot secure an application with the SP
that
lives on a different server from the SP unless you deploy a second
protocol, or use the SP as a reverse proxy.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net