Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Thank you very much @Andy for your reply after looking into my query deeply.
I got better understanding about shibboleth flow when i saw your reply.

The Shibboleth IDP performs authentication via a variety of methods.
->Here i am using 'ExternalAuth' in which it goes to the my custom Url to
make further processing.

If you want to change the login.jsp script to
validate credentials against a different database, you can do that.
-> Yes I can do that and here i am thinking that only to deal with one
login.jsp for both the databases, any way that depends on my design.

After authentication is successful, the Shibboleth IDP will attempt to
resolve attributes (find more information about) the principal returned by
the authentication step
- since i am using 'ExternalAuth', and i am not  using any 'UserName'
particularly
 i am writing the code which is according to the shibboleth website for
externalAuth(use subject to get control over principal)

This code is written after authentication is successful against my database.
request.setAttribute(globalStrings.getForceAuthn(), false);
Principal principal = new UsernamePrincipal(login.getAttributes());
Subject subj = new Subject();
subj.getPrincipals().add(principal);
request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);
request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
request.setAttribute(globalStrings.getAuthnMethod(),
this.authenticationMethod);
AuthenticationEngine.returnToAuthenticationEngine(request, response);

 The attribute resolution is configured in attribute-resolver.xml.
- The below is my attribute-resolver.xml to resolve the attributes, please
look into it.

<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">

   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />

<resolver:AttributeEncoder xsi:type="SAML2Base64"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE_64" />
  <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="ORG_ATTRIBUTE" />
for the above, there is no "dataconnector" is used.

attribute-filter.xml:

<afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="principal">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

So that i could be able to get the above principal(email, acctType etc) at
SP side in 'SAMLResponse'.


Common places to lookup additional information are a database or LDAP.
- Here completely i am using our database, So there is no point of LDAP,
  you are saying additional information, can it be 'permissions of the
user' which is from
 our database?
- here how can get the required 'permission info'(authorization) from our
database,
- How to write it in the attribute-resolver.xml by using DataConnectors to
get the perms of user.
 Please provide me some example for configuration which i can get the
'permissions of user'.

After attribute resolution is complete, the Shibboleth IDP will filter
those attributes according to the configuration in attribute-filter.xml.
Only the attributes you configure will be released to the SP.

The SP can then use those attributes to making authorization decisions.
- > Yes, if i can do configuration in attribute-resolver and
attribute-filter.xml, i can use at SP side
   from SAMLResponse.
If you can provide me answers for my above questions, i think i can
complete my task.

Thank you for patience.

On Wed, Dec 3, 2014 at 11:48 PM, Andrew Morgan <morgan at orst.edu> wrote:

> On Wed, 3 Dec 2014, Surinaidu Majji wrote:
>
> > Hello Paul,
> > I am really very happy that i am getting lot of information from the Shib
> > Users like you, but i do not know why i am not able to get the exact
> > information which i required. I think i got the replies for my query but
> i
> > could able to understand properly.
> >
> > Here my actual requirement is:
> > Now i am using shibboleth idp which we own(External Idp) to do
> > authentication. Here i use 'ExternalAuthn' Login handler in handler.xml.
> > Now the authentication is done by checking the credentials(from
> login.jsp)
> > with our *Server(database)*
> >
> > - The current requirement is like instead of using our *Server *to
> validate
> > credentials(from login.jsp), i have to link this external idp to *other
> > Server (database).*
> > That's why i wanted know about authorization for my application, but i
> > could not able to achieve it.
> > Please consider my request, because i do not have any other source to
> > get my requirement done, If require i will post my entire authentication
> > procedural steps which i have right now in my existing application.
>
> I'm having a little trouble understanding your situation, but hopefully my
> answers are relevant.
>
> The Shibboleth IDP performs authentication via a variety of methods.  You
> wrote that your existing IDP validates credentials against a database via
> a login.jsp script.  If you want to change the login.jsp script to
> validate credentials against a different database, you can do that.
>
> After authentication is successful, the Shibboleth IDP will attempt to
> resolve attributes (find more information about) the principal returned by
> the authentication step (usually a username or other identifier, such as
> employee number).  The attribute resolution is configured in
> attribute-resolver.xml.  Common places to lookup additional information
> are a database or LDAP.  For example, you might lookup the firstname,
> lastname, and email address of the principal.
>
> After attribute resolution is complete, the Shibboleth IDP will filter
> those attributes according to the configuration in attribute-filter.xml.
> Only the attributes you configure will be released to the SP.
>
> The SP can then use those attributes to making authorization decisions.
>
> I hope this helps!
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141204/997026bb/attachment-0001.html