Authorization using shibboleth sso

[Surinaidu Majji]

Hello Peter, Since i am completely new to this shibboleth, i was not able
to provide proper information. Please tell me if you need any other
information.

On Mon, Dec 1, 2014 at 5:19 PM, Surinaidu Majji <pioneer.suri at gmail.com>
wrote:

> Thank you again for your patience and valuable time.
> As you said i configured (ph:ExternalAuth='external/login')(which
> indicates path to servlet) in handler.xml. This path is taking the user to
> login.jsp and user will enter credentials.
> - The login.jsp will send it to our server to check credentials with the
> database. Server will give a response saying that the user is valid or
> invalid. This is the thing happening at handler.xml(which i am calling as
> an authentication).
>
> Yes Authorization should be done at SP side. In my case Authorization is
> permissions of the logged in user, that's why i want to get the permissions
> of the user when login.jsp(username,pwd) is submitting to our server.So
> that i can use those permissions to do authorization.
>
> On Mon, Dec 1, 2014 at 5:02 PM, Peter Schober <peter.schober at univie.ac.at>
> wrote:
>
>> * Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-01 12:14]:
>> > -> So here we are getting the permissions from our server and send it to
>> > the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp);
>> by
>> > setting the permissions in the request as an attribute.
>>
>> OK, I'm beginning to see what you keep going on about the external
>> authentication login handler, that's where you're intending to perform
>> authorization?  If that's so, don't do that, this is meant to
>> exernalize /authentication/ from the IDP. Authorization should be
>> handled at the SP, based on attributes released by the IDP.
>> The indended way to get the needed information into the IDP is via the
>> attribute resolver (and release it in the filter), not from the
>> login handler. Same as for any other attribute.
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/4064d7a6/attachment.html