Authorization using shibboleth sso

[Surinaidu Majji]

Thank you for the reply @Peter, Kindly look into the following flow which i
am following...
Authentication flow with idp and we are writing our own SP.
1) The below encodeSamlRequest request is going to Idp like following:

  public Pair<String,String>  getSAMLRequest(String spUrl, String
consumerUrl) {
AuthnRequest authnRequest = null;
//String encodedSAMLRequest = null;
Pair<String,String> encodedSAMLRequest = null;
try {

authnRequest = this.*buildAuthnRequestObject*(spUrl, consumerUrl);
Encoder encoder = Encoder.getEncoder();
encodedSAMLRequest = encoder.encodeAuthnRequest(authnRequest);
} catch (MarshallingException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}

return *encodedSAMLRequest*;
}

private AuthnRequest buildAuthnRequestObject(String spUrl,
String consumerUrl) {
Issuer issuer = getIssuer();
issuer.setValue(spUrl);

DateTime issueInstant = new org.joda.time.DateTime();
RequestedAuthnContext requestedAuthnContext = getRequestedAuthnContext();
AuthnRequest authRequest = getAuthnRequest(issueInstant, issuer,
consumerUrl, spUrl);

authRequest.setRequestedAuthnContext(requestedAuthnContext);
String systemTime = System.currentTimeMillis() + "";
authRequest.setID("SSOIDSAMLREQ" +systemTime);
authRequest.setVersion(SAMLVersion.VERSION_20);
authRequest.setAssertionConsumerServiceIndex(1);
return authRequest;
}

2)  First time idp redirects the user to login.jsp by using configuration
which is in the *handler.xml using externalAuth*

 <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                 externalAuthnPath="/external/login"
                 supportsForcedAuthentication="true" >

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
</ph:LoginHandler>

*-->*Once it comes to the above mentioned path the user is able to see
the *login.jsp
*and user will enter the credentials and submitting to the our server to
validate the user. So we will get the boolean variable whether the user is
valid or not.

-> Once we got status from our server we are preparing the request and
response like following which is to be send it to the idp
again(AuthenticationEngine.returnToAuthenticationEngine(req,resp)).

request.setAttribute(globalStrings.getForceAuthn(), false);
Principal principal = new UsernamePrincipal(*login.getAttributes()*);
Subject subj = new Subject();
subj.getPrincipals().add(principal);
request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);
request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
request.setAttribute(globalStrings.getAuthnMethod(),
this.authenticationMethod);
AuthenticationEngine.returnToAuthenticationEngine(request, response);

3) We mention in the attribute-resolver and attribute-filter for the
attributes to be released to the SP like below

<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">

   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />

<resolver:AttributeEncoder xsi:type="SAML2Base64"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE_64" />
  <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE" />
</resolver:AttributeDefinition>

4) So will get the released required attributes from the SP(SAML response)
and do further processing.

The above is the authentication process we are following for our
application, Now we wanted to do the *authorization, *So i need two
clarifications here.
i) Do i need to prepare one more samlRequest like SAML Authorization
Decision statement to send for idp again after authentication is done.

or

ii) As i mentioned in the step(2), Shall i get the authorization permission
from our server and put it in the(*login.getAttributes()*) which is in the
UserPrinciple(), to get it at the SP side and use the permissions to give
the access to the user.



On Fri, Nov 28, 2014 at 6:10 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Surinaidu Majji <pioneer.suri at gmail.com> [2014-11-28 13:30]:
> > So Please tell me, how to deal with attribute-resolver.xml to add
> > our permissions for authorization.
>
> You add whatever data you (i.e., the SP) needs to perform access
> control, same as with any existing attributes.
> E.g. if the SP requires a subject to have a specific affiliation, you
> add the affiliation attribute definition to your resolver (and either
> lookup the info from some system the IDP has access to, or generate
> the value in the IDP on-the-fly).
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/c5c3dad0/attachment.html