Better approach to do Authorization in shibboleth

[Cantor, Scott]

On 12/1/14, 10:03 AM, "Surinaidu Majji" <pioneer.suri at gmail.com> wrote:

>The above is the authentication process we are following for our 
>application, Now we wanted to do the authorization, So i need two 
>clarifications here.
>i) Do i need to prepare one more samlRequest like SAML Authorization 
>Decision statement to send for idp again after authentication is done.

No.

>or
>
>ii) As i mentioned in the step(2), Shall i get the authorization 
>permission from our server and put it in the(login.getAttributes()) which 
>is in the UserPrinciple(), to get it at the SP side and use the 
>permissions to give the access to the user.

No.

Peter answered your question several times.

Attributes are pulled from the resolver and encoded into the SSO assertion 
and it's up to the SP to get them out and use them.

-- Scott