How can i pass additional attributes in a SAML authentication request from SP to IdP using Shibboleth?

[Kilian Ries]

Let me explain my situation in detail:

I'm working on a research-prototype. The base-struckture is running well,
here is an overview:


SP1 (protected web resource) <--> IdP1 (user/password) with "internal" SP2
<--> IdP2 (biometric authentication)


The IdP1 communicates intern with the SP2 (running on the same machine):
SP2 receives the attributes form  IdP2 and the IdP1 fetches them from the
SP2 (working!). 

Now, SP2 should send the needed information (typing sample from the
biometric authentication, recorded by a flash-recorder on the IdP1's
website) to IdP2 as an attribute within the SAML authnRequest. With that
typing-sample attribute the IdP2 can authenticate the user and send the
authentication-information back to the SP2.

The last days i checked the Shibboleth SP sourcecode. In the
"ServiceProvider.cpp" file i found the following code:


	void SHIBSP_DLLLOCAL clearHeaders(SPRequest& request) {
	const Application& app = request.getApplication();
	app.clearHeader(request, "Shib-Session-ID", "HTTP_SHIB_SESSION_ID");
	app.clearHeader(request, "Shib-Identity-Provider",
"HTTP_SHIB_IDENTITY_PROVIDER");
	app.clearHeader(request, "Shib-Authentication-Method",
"HTTP_SHIB_AUTHENTICATION_METHOD");
	app.clearHeader(request, "Shib-Authentication-Instant",
"HTTP_SHIB_AUTHENTICATION_INSTANT");
	app.clearHeader(request, "Shib-AuthnContext-Class",
"HTTP_SHIB_AUTHNCONTEXT_CLASS");
	app.clearHeader(request, "Shib-AuthnContext-Decl",
"HTTP_SHIB_AUTHNCONTEXT_DECL");
	app.clearHeader(request, "Shib-Assertion-Count",
"HTTP_SHIB_ASSERTION_COUNT");
	app.clearAttributeHeaders(request);
	request.clearHeader("REMOTE_USER", "HTTP_REMOTE_USER");
	}


Is this the code, where the SP builds the authnRequest? If yes, i'll have
to implement code there to insert a new "attribute" to the authnRequest,
right? If not, where can I find the code which i'll have to modify?

Is there anything else which i'll have to pay attention to?



Am 27.04.12 22:06 schrieb "Cantor, Scott" unter <cantor.2 at osu.edu>:

>On 4/27/12 3:52 PM, "Kilian Ries" <mail at kilian-ries.de> wrote:
>>
>>If i configure an Extensions element, is there any way to put in external
>>Data, like from a HTML FORM ? I have a Java-Application, which needs to
>>send a String/Data with the AuthnRequest from the SP to the IdP. I don't
>>know how to get the Data attached to the AuthnRequest.
>
>No, that isn't supported, it's for statically defined information. You'd
>have to implement  code to construct and encode your own request.
>
>-- Scott
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>
>
>