Getting role attributes from loginHandler (LDAP)

[Cantor, Scott]

On 6/20/13 12:06 PM, "Byte Flinger" <byteflinger at gmail.com> wrote:

>Hi Christopher
>Thanks for the answer. As mentioned, I did indeed manage to get the
>wanted information using an LDAP DataConnector however given that the
>role seems to be already returned by the login module, fast or not, it's
>still a waste to have to make yet another connection
> for information that's already been retrieved.

That's how it should be done.

>Trying to get the info out of the principal is exactly what I have been
>trying to do (among other ways) however so far I have had no luck.

You can, but don't. There are reasons why that will become a more
complicated thing to do. Using custom principal objects causes problems
for the storage of sessions and going forward that is not something you
want to be relying on. If a few extra queries is noticeable to your IdP,
you have something wrong on the back-end LDAP.

>If this is not possible, what is the use of the role parameters in the
>Ldaploginmodule anyway since it works to login without it (The module
>simply won't "commit" any roles, whatever that means).

That's a JAAS concept. It makes it impossible to reliably serialize the
result of the authenticaton without adding custom code.

-- Scott