Better approach to do Authorization in shibboleth

[Andrew Morgan]

On Wed, 3 Dec 2014, Surinaidu Majji wrote:

> Hello Paul,
> I am really very happy that i am getting lot of information from the Shib
> Users like you, but i do not know why i am not able to get the exact
> information which i required. I think i got the replies for my query but i
> could able to understand properly.
>
> Here my actual requirement is:
> Now i am using shibboleth idp which we own(External Idp) to do
> authentication. Here i use 'ExternalAuthn' Login handler in handler.xml.
> Now the authentication is done by checking the credentials(from login.jsp)
> with our *Server(database)*
>
> - The current requirement is like instead of using our *Server *to validate
> credentials(from login.jsp), i have to link this external idp to *other
> Server (database).*
> That's why i wanted know about authorization for my application, but i
> could not able to achieve it.
> Please consider my request, because i do not have any other source to
> get my requirement done, If require i will post my entire authentication
> procedural steps which i have right now in my existing application.

I'm having a little trouble understanding your situation, but hopefully my 
answers are relevant.

The Shibboleth IDP performs authentication via a variety of methods.  You 
wrote that your existing IDP validates credentials against a database via 
a login.jsp script.  If you want to change the login.jsp script to 
validate credentials against a different database, you can do that.

After authentication is successful, the Shibboleth IDP will attempt to 
resolve attributes (find more information about) the principal returned by 
the authentication step (usually a username or other identifier, such as 
employee number).  The attribute resolution is configured in 
attribute-resolver.xml.  Common places to lookup additional information 
are a database or LDAP.  For example, you might lookup the firstname, 
lastname, and email address of the principal.

After attribute resolution is complete, the Shibboleth IDP will filter 
those attributes according to the configuration in attribute-filter.xml. 
Only the attributes you configure will be released to the SP.

The SP can then use those attributes to making authorization decisions.

I hope this helps!

 	Andy