Better approach to do Authorization in shibboleth

[Cantor, Scott]

On 12/2/14, 11:59 AM, "Surinaidu Majji" <pioneer.suri at gmail.com> wrote:



>Thank you for your reply, but you are saying attributes pulled from 
>resolver:
>Is that attribute-resolver.xml, configured for releasing attributes, in 
>that case
>i am releasing 'principal' which contains 'permissions' to SP. Is that 
>right?

No, it's not right. Not unless you build new code or write scripts to pull 
bits of data out of the Java subject inside the resolver and expose them 
as attributes with encoders to put them into the SAML assertion.

That isn't how people use the IdP. You need to have a database or 
directory of attributes to pull from, not rely on the authentication step 
and try and tunnel information through that.

-- Scott