java-X509-login-handler and access to certificate from attribute-resolver.xml

[Douglas E. Engert]

The X509LoginServelet adds the cert to the Subject pubCredentials.
But when a script is run from attribute-resolver.xml,
the subject has the Principals, but not the pubCredentials:

(See attachment with sections of debug log.)

Any idea why the pubCredentials would be dropped from the Subject
between X509LoginServelet and invocation of attribute-resolver.xml?
Is the Subject copied internally and the pubCredentials dropped?

We have been using the java-x509-login-handler,
with mods to retrieve the msUPN for the certificate.

https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler
https://forge.switch.ch/redmine/issues/1898

I would like to replace these mods and/or access the certificate
from a script in attribute-resolver.xml.

The script would generate an LDAP query string that could be used to
  search AD for the AltSecurityIdentites attribute.

http://msdn.microsoft.com/en-us/library/windows/desktop/ms675221(v=vs.85).aspx
Or Google for Windows AD AltSecurityIdentities

I can generate the LDAP query string with additional mods to
X509LoginServlet, and pass it as another Principal, but would
rather not modify the x509-login-handler package if possible.

IDP-2.3.5, java-1.6.0 running on Ubuntu lucid and tomcat6.

Thanks.


-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

-------------- next part --------------

>From X509LoginServlet: 

14:15:41.135 - DEBUG [ch.SWITCH.aai.idp.x509.X509LoginServlet:111] - Adding subjectAltName USER at REALM of type class ch.SWITCH.aai.idp.x509.principals.MSUPNPrincipal  (msUPN) as principal to subject
14:15:41.143 - DEBUG [ch.SWITCH.aai.idp.x509.X509LoginServlet:141] - Forward subject Subject:
        Principal: CN=XXXXX
        Principal: USER at REALM
        Public Credential: [
[
  Version: V3
  Subject: CN=XXXXX



>From attribute-resolver.xml

14:15:41.174 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute x500Principal for principal CN=XXXXX
14:15:41.185 - DEBUG [edu.internet2.middleware.shibboleth.resolver.Script.scriptTest:-2] - Subject: Subject:
        Principal: CN=XXXXX
        Principal: USER at REALM

14:15:41.186 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute x500Principal containing 1 values