Custon data connector to create attributes from http headers or Apache env variables

[Wessel, Keith William]

Hi,

Though this concept seemed odd and possibly absurd to me at first (and might still), I thought I'd ask if anyone had done anything similar and could offer any guidance.

We're preparing to put an external authentication mechanism in front of our IDP. The mechanism can return more than just a remote_user since it's actually a full-fledged authn/authz solution, itself. The idea has been brought up of replacing LDAP queries for attribute resolution with simply consuming attributes from the external mechanism. By the time control gets back to the IDP, any attributes released from the external piece are available as http header variables and through Apache as environment variables.

Has anyone created a custom data connector that could bring in attributes from the environment or http headers?

On the surface, it doesn't sound difficult to do, but I'm somewhat confident that, since I see nothing from a web search about it, there might be a good reason that it hasn't been done.

Can anyone point out any obvious pitfalls that I'm overlooking here? There's, of course, the security factor of trusting whatever's coming across the wire to the IDP as official attributes, but that could be brought up on any number of levels.

Thanks for any thoughts.

Keith