Better approach to do Authorization in shibboleth

[Eric Goodman]

>1)      What data elements does the SP need from the IdP describing the logged in user?
>Ans: My answer is yes, I know what data i want to get at SP side, here i want to get the permissions
>of the logged in user to decide for ?which modules loggedin user has permissions.
>    - Right now, i am only getting the 'Principal' at SP side, which contains information about
>the user(email, acctType) etc. As per my understanding i am getting the principle because of below code:

You are still telling me about how you get the principal. That was not my question, nor is it relevant to the answer you need. You need to identify the specifica data elements you need in addition to the principal.

> step:1) after authenticating against database when request goes from login.jsp:

Unless there’s something very esoteric going on, you don’t need to write code to do this. You can do all attribute lookup from the configuration of the attribute-*.xml files.

>step-2):
>To release the attributes at SP side, i configured the attribute-resolver, attribute-filter like below:
>====================================================================
>attribute-resolver.xml:
>
><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
>
>   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />
>
>                      <resolver:AttributeEncoder xsi:type="SAML2Base64" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                                name="ORG_ATTRIBUTE_64" />
>  <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                               name="ORG_ATTRIBUTE" />

That’s setting the NameID to the Principal value. You need to define the additional attributes. You haven’t done that.
attribute-filter.xml:
><afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
>        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
>        <afp:AttributeRule attributeID="principal">
>                <afp:PermitValueRule xsi:type="basic:ANY" />
>        </afp:AttributeRule>
>    </afp:AttributeFilterPolicy>

Again, you are only releasing the principal. You haven’t released any additional attributes (nor have you defined them).


>Because of above two steps i am getting the principal at SP side(SAMLResponse)
>Please correct me if i am wrong.

Since you have not defined or released any attributes describing the principal, the IdP can’t release them so the SP doesn’t see them. You need an attribute definition (in attribute-resolver.xml) and an attribute release (in attribute-filter.xml) for EACH attribute you want sent in addition to the principal. You also need a data connector created (in attribute-resolver.xml) for each database you are querying. (See Andrew’s message).

>if i am correct, Like this can we get the permissions of the user, Please give me an example to
>get the permissions of the user at SP side in saml response.

Before you can get the attributes at the SP, the IdP has to send them. You send them by creating the Attribute Definition as described above. Once that’s done, the attributes will just be there in the assertion.

>2)      What data source contains this attribute?
>- Here the only source is our database for every information, I can get the info from database by sending request with proper url.

You say there’s a database, but I’m betting you haven’t put the connection information in the attribute-resolver.xml file.

>Please provide me some example with xml configuration, So that i can easily handle my task.

(Some of this repeats what Andrew already sent)

For the attribute definitions:
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverSimpleAttributeDefinition
For the database sources (data connectors):
                https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector
                https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute  (first example)

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141204/658c2ef3/attachment-0001.html