Authorization using shibboleth sso

[Msnaidu]

Thank you for the reply, I thought i could not get any more replies from you.
"any data you would like to send to the SP the IDP would need to
gather first (attribute resolver), from an *authoritative system.*
May i know what is 'authoritative system.' here?

As you said above the data i want to send SP, is going to IDP first like
below.

login.getAttributes() contains Username, Permissions of the user.
 
Principal principal = new UserPrincipal(login.getAttributes());
req.setAttribute(Principal_Key, principal);

IDP:
AuthenticationEngine.returnToAuhtenticationengine(req,resp);

The same thing is configured in the attribute-resolver, attribute-filter,
that the principal is need to be released to SP.
attribute-resolver.xml:

<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">

   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />
    
		<resolver:AttributeEncoder xsi:type="SAML2Base64"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE_64" />
  <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE" />
</resolver:AttributeDefinition>

I think, is that what are you talking about?

So from above the data is going through the idp before releasing to SP using
configuration in attribute-resolver.xml.
 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Authorization-using-shibboleth-sso-tp7609445p7609543.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.