Authorization using shibboleth sso

[Surinaidu Majji]

Thank you again for your patience and valuable time.
As you said i configured (ph:ExternalAuth='external/login')(which indicates
path to servlet) in handler.xml. This path is taking the user to login.jsp
and user will enter credentials.
- The login.jsp will send it to our server to check credentials with the
database. Server will give a response saying that the user is valid or
invalid. This is the thing happening at handler.xml(which i am calling as
an authentication).

Yes Authorization should be done at SP side. In my case Authorization is
permissions of the logged in user, that's why i want to get the permissions
of the user when login.jsp(username,pwd) is submitting to our server.So
that i can use those permissions to do authorization.

On Mon, Dec 1, 2014 at 5:02 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-01 12:14]:
> > -> So here we are getting the permissions from our server and send it to
> > the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp);
> by
> > setting the permissions in the request as an attribute.
>
> OK, I'm beginning to see what you keep going on about the external
> authentication login handler, that's where you're intending to perform
> authorization?  If that's so, don't do that, this is meant to
> exernalize /authentication/ from the IDP. Authorization should be
> handled at the SP, based on attributes released by the IDP.
> The indended way to get the needed information into the IDP is via the
> attribute resolver (and release it in the filter), not from the
> login handler. Same as for any other attribute.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/2e93e6dc/attachment-0001.html