Several Auth Mechanisms and Attribute Release

[Douglas E. Engert]

On 8/21/2013 8:02 AM, Francisco Jose Fernandez Rivera wrote:
> Thanks Scott,
>
> Finally I created a script under CDATA section to unify both methods, so the LDAP filter always references only a variable, so independently of Kerberos login (principal --> username at REALM) or usernamePassword login (principal --> username), the search filter always references "username".
>
> <resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>                                id="unifiedID"
>                                sourceAttributeID="unifiedID">
>
>      <resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                                 name="urn:mace:dir:attribute-def:unifiedID" />
>      <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                                 name="urn:oid:1.3.6.1.4.1.40000.1.3"
>                                 friendlyName="unifiedID" />
>
>      <Script><![CDATA[
>          importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>          i=requestContext.getPrincipalName().indexOf("@");
>          // Create attribute to be returned from definition
>          unifiedID = new BasicAttribute("unifiedID");
>          if (i>0)
>          unifiedID.getValues().add(requestContext.getPrincipalName().substring(0,i));
>          else
>          unifiedID.getValues().add(requestContext.getPrincipalName());
>
>      ]]></Script>
> </resolver:AttributeDefinition>
>
> Thanks for all the insights.

https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler+-+Attribute+resolver
has an example of extracting the username form, the principal. a different manor.

>
> Now I have integrated x509 certificate login, and I am able to access the protected resources, but obviously without attribute release.

> Now I am dealing with treatment of the subject of the certificate to get the identification number of the user and launch the query against the LDAP based on that.
> For what I have been reading, I just can not create a package with a simple class to achieve this and import in the CDATA section, I think I should extend some other class....
>

See:
https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler
for example of using fields for the certificate.

We have some mods to the x.509 Login handler to extend it to do the following:

   If the certificate has a subjectAltname:otherName:msUPN, extract it and
   add to the request Subject  a principal of class MSUPNPrincipal.

   Parse the certificate and and create a principal  AltSecurityIdentityPrincipal
   using the Subject and issuer of the certificate, The string created
   can be used in a LDAP query of AD for the altSecurityIdentities attribute of
   an account.

   If the certificate has the Microsoft smart card login extension,
   (and all the CAs we trust only set this for true smart cards) the
   AuthenticationMethod is set to: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI

   The login handler jsp pages were change to also allow for a "hint" of a username
   to use with the certificate. This is added  as additional principal of class
   AltSecurityHintPrincipal.

(Windows 7 and AD 2008 can use hint and with the altSecurityIdentities attribute
to allow for many-to-many mapping of user and certificate.
Earlier versions of Windows required the certificate msUPN, and this had to match
the userPrincipalName of an AD account. We take advantage of the AD attributes
already used for smart card login from the IDP.)

Then the LDAP data connector can use x500SubjectAltNameMSUPNPrincipal, altSecurityIdentityPrincipal,
altSecurityHintPrincipal, instancePrincipalName (from username/password or Kerberos login)
to look up in AD an account of the user.

> I'll face this during this week, and try to understand the way to extend the functionality.

I can send more details if you are interested.
>
> Thanks again.
>
> Francisco Fernández
>
> -----Mensaje original-----
> De: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] En nombre de Cantor, Scott
> Enviado el: martes, 20 de agosto de 2013 15:38
> Para: Shib Users
> Asunto: Re: Several Auth Mechanisms and Attribute Release
>
> On 8/20/13 4:02 AM, "Francisco Jose Fernandez Rivera"
> <xisco.fernandez at ibsalut.es> wrote:
>
>> Good morning,
>>
>> Thanks Scott and Rod for your answers, I appreciate it very much. I
>> will try to explain me better.
>
> There's nothing else you need to explain, my response applies. You can't make it work any differently if you're accepting the stock behavior, so you'd best stop using request.principalName or you'll have to normalize the name in the resolver. There is nothing that will do it for you.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444