Authorization using shibboleth sso

[Surinaidu Majji]

Thank you peter,

"I don't understand what that means. You release attributes from the
IDP as per the documentation."
As per your comment above i think i did not provide proper information,

-> We have 2 applications which are working with Shibboleth, Here My
understanding is about authorization is that
the some users can have permission for accessing only one application or
only some features they can access
from the applications.
-> So here we are getting the permissions from our server and send it to
the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp); by
setting the permissions in the request as an attribute.
like below:

"login.getAttributes()" contains the response from our server which we
got after submitting the credentials(login.jsp) to our server.
login.getAttributes() contains 'emailId', 'username' but now i want to
include the permissions which i could get from our server in the
login.getAttributes().

                Principal principal = new
UsernamePrincipal(login.getAttributes());
                Subject subj = new Subject();
                subj.getPrincipals().add(principal);
                request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
                request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY,
personId);

                request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
So the user perms are in Principal principal = new
UsernamePrincipal(login.getAttributes()); which is an attribute in the
request which we are sending to the authenticationEngine. So i know i can
configure attribute-resolver, attribute-filter to release the 'principal'
when in saml response comes from the shibboleth idp. So i will get the
permissions from the saml response and use that perms to allow the user to
access aprticular modules based on perms.

Please tell me if my approach is wrong.


On Mon, Dec 1, 2014 at 3:54 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-01 06:18]:
> > Thank you for the reply @Peter, Kindly look into the following flow
> which i
> > am following...
> > Authentication flow with idp and we are writing our own SP.
>
> I don't understand most of what you write but I think none of the
> things you sent have anything to do with your question.
>
> How you release attributes from the IDP is documented here:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute
>
> The SP can do whatever it wants with those attributes, including base
> access control decisions on the recieved attribute values.
> How you do that is not a matter for this list, which is about the
> Shibboleth software.
>
> > The above is the authentication process we are following for our
> > application, Now we wanted to do the *authorization, *So i need two
> > clarifications here.
> > i) Do i need to prepare one more samlRequest like SAML Authorization
> > Decision statement to send for idp again after authentication is done.
>
> No.
>
> > or
> >
> > ii) As i mentioned in the step(2), Shall i get the authorization
> permission
> > from our server and put it in the(*login.getAttributes()*) which is in
> the
> > UserPrinciple(), to get it at the SP side and use the permissions to give
> > the access to the user.
>
> I don't understand what that means. You release attributes from the
> IDP as per the documentation.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/c8ce626b/attachment.html