Raw attributes from a HttpServletRequest attribute?

[Brian Reindel]

Thanks. This helped push me in the right direction. Instead of setting
the principal, I set the subject in the remote user servlet. As a part
of that subject there are private and public credentials. My oauth
token and verifier are a part of the private credentials. I had to
modify the AuthenticationEngine servlet init params in the web.xml to
expose these private credentials, and I could then access them in a
script attribute definition. The biggest trick was figuring out the
script syntax to access them. Below is what I ended up using in case
it helps anyone in the future. My thick client can then access the
/Shibboleth.sso/Session endpoint in JSON to get these attributes,
which contain the token and verifier.

<resolver:AttributeDefinition xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
id="oauthTokenAttributeDefinition">
    <resolver:Dependency ref="oauthTokenScript" />
    <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
name="https://www.example.org/idp/attributes/oauthToken" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
id="oauthVerifierAttributeDefinition">
    <resolver:Dependency ref="oauthVerifierScript" />
    <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
name="https://www.example.org/idp/attributes/oauthVerifier" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="oauthTokenScript">
    <Script><![CDATA[
        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

        var privateCredentials =
requestContext.userSession.subject.privateCredentials;

        oauthTokenScript = new BasicAttribute("oauthTokenScript");
        oauthTokenScript.getValues().add(privateCredentials.iterator().next().get("oauth_token"));

    ]]></Script>
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="oauthVerifierScript">
    <Script><![CDATA[
        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

        var privateCredentials =
requestContext.userSession.subject.privateCredentials;

        oauthVerifierScript = new BasicAttribute("oauthVerifierScript");
        oauthVerifierScript.getValues().add(privateCredentials.iterator().next().get("oauth_verifier"));

    ]]></Script>
</resolver:AttributeDefinition>


On Wed, Aug 7, 2013 at 1:26 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 8/7/13 12:56 PM, "Brian Reindel" <brian at reindel.com> wrote:
>>
>>Under "Information Available to the Script", those five interfaces
>>have various fields that are accessible from the script attribute
>>definition, one of which is the subject and then principals. As a part
>>of the remote user handler authentication I set the principal,
>>however, I'm not seeing how I could store extended data on it for use
>>in the attribute definition.
>
> You can set the Principal, but you can also set a Subject instead, and
> populate it with any Principals you want. The login handler API has a
> different attribute to use to set a Subject vs. a Principal.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net