Getting role attributes from loginHandler (LDAP)

[Byte Flinger]

Thanks for the input, I'll take it consideration.

I'd still like to know how to retrieve the role from the java subject
though if anybody knows how to do it.
On Jun 20, 2013 7:26 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 6/20/13 1:20 PM, "Byte Flinger" <byteflinger at gmail.com> wrote:
>
> >If the Ldaploginmodule is already adding a role to the principal then it
> >will be a custom principal regardless of whether I retrieve that data
> >from it or not, no?
>
> Yes, but there's a difference between relying on something and not relying
> on it, if that information disappears across some boundary in the future.
>
> >It's not about being an issue or not to do an extra ldap connection but
> >more of an optimization thing since one less connection is always better.
>
> No, it's not always better, that's my point. There are other
> considerations.
>
> >Regarding your last sentence, are you saying that the functionality of
> >commiting a role exists solely for the purpose of making it harder to
> >serialize the authentication result (which I am guessing, if so, is a
> >security feature)?
>
> No, it exists to add roles in JAAS. That has the effect of makng the
> user's principal name an incomplete representation of the result. Custom
> principals added to a Java Subject are not Serializable in Java, and
> cannot be asked to persist themselves in any standard way, which means
> preserving them in a cluster requires custom code that you would have to
> plug into the IdP in a future version that's not using Terracotta. All to
> avoid a meaningless, well-supported query to LDAP. It's not a good
> trade-off.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/d4f0e81b/attachment.html