Better approach to do Authorization in shibboleth

[Surinaidu Majji]

we want to do authorization for our application.
Kindly look into the following flow which i am following...
Authentication flow with idp and we are writing our own SP.
1) The below encodeSaml request is going to Idp like following:



     public Pair<String,String>  getSAMLRequest(String spUrl, String
consumerUrl) {
    AuthnRequest authnRequest = null;
    //String encodedSAMLRequest = null;
    Pair<String,String> encodedSAMLRequest = null;
    try {

    authnRequest = this.buildAuthnRequestObject(spUrl, consumerUrl);
    Encoder encoder = Encoder.getEncoder();
    encodedSAMLRequest = encoder.encodeAuthnRequest(authnRequest);
    } catch (MarshallingException e) {
    e.printStackTrace();
    } catch (IOException e) {
    e.printStackTrace();
    }

    return encodedSAMLRequest;
    }

    private AuthnRequest buildAuthnRequestObject(String spUrl,
    String consumerUrl) {
    Issuer issuer = getIssuer();
    issuer.setValue(spUrl);

    DateTime issueInstant = new org.joda.time.DateTime();
    RequestedAuthnContext requestedAuthnContext =
getRequestedAuthnContext();
    AuthnRequest authRequest = getAuthnRequest(issueInstant, issuer,
    consumerUrl, spUrl);

    authRequest.setRequestedAuthnContext(requestedAuthnContext);
    String systemTime = System.currentTimeMillis() + "";
    authRequest.setID("SSOIDSAMLREQ" +systemTime);
    authRequest.setVersion(SAMLVersion.VERSION_20);
    authRequest.setAssertionConsumerServiceIndex(1);
    return authRequest;
    }

    2)  First time idp redirects the user to login.jsp by using
configuration which is in the handler.xml using externalAuth

     <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="/external/login"
                     supportsForcedAuthentication="true" >

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>

-->Once it comes to the above mentioned path the user is able to see the
login.jsp and user will enter the credentials and submitting to the our
server to validate the user. So we will get the boolean variable whether
the user is valid or not.

-> Once we got status from our server we are preparing the request and
response like following which is to be send it to the idp
again(AuthenticationEngine.returnToAuthenticationEngine(req,resp)).

    request.setAttribute(globalStrings.getForceAuthn(), false);
    Principal principal = new UsernamePrincipal(login.getAttributes());
    Subject subj = new Subject();
    subj.getPrincipals().add(principal);
    request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
    request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);
    request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
    request.setAttribute(globalStrings.getAuthnMethod(),
this.authenticationMethod);
    AuthenticationEngine.returnToAuthenticationEngine(request, response);

    3) We mention in the attribute-resolver and attribute-filter for the
attributes to be released to the SP like below

    <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">

       <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />

    <resolver:AttributeEncoder xsi:type="SAML2Base64"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                    name="ORG_ATTRIBUTE_64" />
      <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                    name="ORG_ATTRIBUTE" />
    </resolver:AttributeDefinition>

4) So will get the released required attributes from the SP(SAML response)
and do further processing.

The above is the authentication process we are following for our
application, Now we wanted to do the authorization, So i need two
clarifications here.
i) Do i need to prepare one more samlRequest like SAML Authorization
Decision statement to send for idp again after authentication is done.

or

ii) As i mentioned in the step(2), Shall i get the authorization permission
from our server and put it in the(login.getAttributes()) which is in the
UserPrinciple(), to get it at the SP side and use the permissions to give
the access to the user.

Important: **Please tell me do we need to use
'SAMLAuthorizedDecisionStatement'**, to deal with authorization in
Shibboleth idp 2.4.0.


Thanks & Regards,
M.Surinaidu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/62244b84/attachment-0001.html