Several Auth Mechanisms and Attribute Release

[Francisco Jose Fernandez Rivera]

Thanks Scott, 

Finally I created a script under CDATA section to unify both methods, so the LDAP filter always references only a variable, so independently of Kerberos login (principal --> username at REALM) or usernamePassword login (principal --> username), the search filter always references "username".

<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              id="unifiedID"
                              sourceAttributeID="unifiedID">

    <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:mace:dir:attribute-def:unifiedID" />
    <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:oid:1.3.6.1.4.1.40000.1.3"
                               friendlyName="unifiedID" />

    <Script><![CDATA[
        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
        i=requestContext.getPrincipalName().indexOf("@");
        // Create attribute to be returned from definition
        unifiedID = new BasicAttribute("unifiedID");
        if (i>0)
        unifiedID.getValues().add(requestContext.getPrincipalName().substring(0,i));
        else
        unifiedID.getValues().add(requestContext.getPrincipalName());

    ]]></Script>
</resolver:AttributeDefinition>

Thanks for all the insights. 

Now I have integrated x509 certificate login, and I am able to access the protected resources, but obviously without attribute release. 
Now I am dealing with treatment of the subject of the certificate to get the identification number of the user and launch the query against the LDAP based on that.
For what I have been reading, I just can not create a package with a simple class to achieve this and import in the CDATA section, I think I should extend some other class.... 

I'll face this during this week, and try to understand the way to extend the functionality.

Thanks again.

Francisco Fernández

-----Mensaje original-----
De: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] En nombre de Cantor, Scott
Enviado el: martes, 20 de agosto de 2013 15:38
Para: Shib Users
Asunto: Re: Several Auth Mechanisms and Attribute Release

On 8/20/13 4:02 AM, "Francisco Jose Fernandez Rivera"
<xisco.fernandez at ibsalut.es> wrote:

>Good morning,
>
>Thanks Scott and Rod for your answers, I appreciate it very much. I 
>will try to explain me better.

There's nothing else you need to explain, my response applies. You can't make it work any differently if you're accepting the stock behavior, so you'd best stop using request.principalName or you'll have to normalize the name in the resolver. There is nothing that will do it for you.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net