Capturing SAML Attributes from the IDP

[Mike Flynn]

They are passed to the protected resource in the response header collection...


________________________________
 From: Jim Hoy <jim.hoy at acatar.com>
To: Shib Users <users at shibboleth.net> 
Sent: Friday, May 31, 2013 11:15 AM
Subject: RE: Capturing SAML Attributes from the IDP
 


 
In the response there is a base-64 encoded POST variable called SAMLResponse. I’m looking at the XML which begins with tag <saml2p:Response…>
 
In this response I see tags like:
 
<saml2:Attribute FriendlyName=”XYZ” Name=”…..”>
   <saml2:AttributeValue>THE_VALUE</saml2:AttributeValue>
</saml2:Attribute>
 
These Friendly names are eduPersonScopeAffiliation, eduPersonTargetID, etc… but there are also institution-specific attributes like ‘xyzUserID’ or xyzHousingLocation or the like… 
 
I need to get a collection of all of these values… If not during the login procedure as defined previously, then at some point after the redirection completes.
 
 
From:users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mike Flynn
Sent: Friday, May 31, 2013 1:39 PM
To: Shib Users
Subject: Re: Capturing SAML Attributes from the IDP
 
Your page at the protected resource can interrogate the response headers for the attributes and some other Shib parameters.  Are you looking to get the actual assertion itself to examine it?  If so you can turn on debugging in the logger config files and get the assertions in the logs.
 

________________________________
 
From:Jim Hoy <jim.hoy at acatar.com>
To: "users at shibboleth.net" <users at shibboleth.net> 
Sent: Friday, May 31, 2013 10:21 AM
Subject: Capturing SAML Attributes from the IDP
 
I suppose this is a lifecycle  issue, and please excuse the question if it’s stupid one, but… As I see it, the process goes like this:
 
1.       User requests a Shib-protected resource. 
2.       The Shibboleth ISAPI filter (as this is Windows/IIS) intercepts the request and directs the user to the IDP (only one IDP here)
3.       The user logs in successfully
4.       The browser is redirected (HTTP 302) back to /Shibboleth.sso/SAML2/POST
5.       The ISAPI filter does another 302 redirection to my secured content (/secure), which is now available to the authenticated user.
 
At step #4, I look at the HTTP request and see that there are form variables posted to the HTTP-POST handler (Shibboleth.sso/SAML2/POST). The form variables includes one called SAMLResponse which is the base 64-encoded SAML XML. This information is apparently discarded when the 302 redirect happens from the HTTP-POST handler to the /secure URL.
 
My question is a simple one: How do I access the SAMLResponse in this process? I need to extract the list of attributes for use elsewhere in my application, and I’m green-horned enough to not understand what I do at this point to actually get to the attributes I’ve just received.
 
Thanks for your help (and for not laughing too hard)
 
 

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130531/cdc3222c/attachment-0001.html