Add Attribute to SAML Response

[Cantor, Scott]

On 1/23/13 11:21 AM, "Zmuda, Matthew R" <Matthew.R.Zmuda at td.com> wrote:

>But isn't the Script  just run javascript? And HttpSession data is not
>available to javascript. So I don't see how I should be able to already
>get the data.

It's javascript that has access to all of the request context information,
which should be usable to access the servlet request for a front-channel
invocation of the attribute resolver.

>Not sure you mean by "b) that won't work if you have to support queries."

I mean that. If you support SAML 1 in the usual style in which queries are
done from the SP for attributes then there's no HTTP session to access,
it's back channel, user not present.

>What I am looking to do is have my Custom Login Handler set the values in
>HttpSession, then put these values into the SAMLResponse.

A response is authentication and optionally attributes. If the attributes
aren't pushed but pulled with a query, then the way to do this is by
taking the data and putting it inside custom Java principal objects that
you return from your handler. Then they're in the IdP session, and that's
something you'd have access to in either flow.

-- Scott