Authorization using shibboleth sso

[Peter Schober]

* Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-01 06:18]:
> Thank you for the reply @Peter, Kindly look into the following flow which i
> am following...
> Authentication flow with idp and we are writing our own SP.

I don't understand most of what you write but I think none of the
things you sent have anything to do with your question.

How you release attributes from the IDP is documented here:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute

The SP can do whatever it wants with those attributes, including base
access control decisions on the recieved attribute values.
How you do that is not a matter for this list, which is about the
Shibboleth software.

> The above is the authentication process we are following for our
> application, Now we wanted to do the *authorization, *So i need two
> clarifications here.
> i) Do i need to prepare one more samlRequest like SAML Authorization
> Decision statement to send for idp again after authentication is done.

No.

> or
> 
> ii) As i mentioned in the step(2), Shall i get the authorization permission
> from our server and put it in the(*login.getAttributes()*) which is in the
> UserPrinciple(), to get it at the SP side and use the permissions to give
> the access to the user.

I don't understand what that means. You release attributes from the
IDP as per the documentation.
-peter