Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Thank you @Eric, Initially i thought that if i need any attributes at SP
side, i have to send them to
Authenticationengine.returnToAuthenticationEngine(req,resp); then only i
will get that attributes by putting the definition in attribute-resolver,
attribute-filter.xml.

So here there is no need of sending the attributes to authenticationEngine.(*no
need*)
we can get the attributes by putting the attributes attribute-resolver,
attribute-filter.xml(*need*)

So i will try to query our database for user permissions by using Data
Connectors in attribute-resolver.xml and filter them in
attribute-filter.xml.

If i am in the right path as i said above, how can we query specifically
for particular user permissions from our database. Is there any filter
condition to put in the data connector?

On Fri, Dec 5, 2014 at 3:43 AM, Eric Goodman <Eric.Goodman at ucop.edu> wrote:

>   >1)      What data elements does the SP need from the IdP describing
> the logged in user?
>
> >Ans: My answer is yes, I know what data i want to get at SP side, here i
> want to get the permissions
>
> >of the logged in user to decide for ?which modules loggedin user has
> permissions.
>
> >    - Right now, i am only getting the 'Principal' at SP side, which
> contains information about
>
> >the user(email, acctType) etc. As per my understanding i am getting the
> principle because of below code:
>
>
>
> You are still telling me about how you get the principal. That was not my
> question, nor is it relevant to the answer you need. You need to identify
> the specifica data elements you need in addition to the principal.
>
>
>
> > step:1) after authenticating against database when request goes from
> login.jsp:
>
>
>
> Unless there’s something very esoteric going on, you don’t need to write
> code to do this. You can do all attribute lookup from the configuration of
> the attribute-*.xml files.
>
>
>
> >step-2):
>
> >To release the attributes at SP side, i configured the
> attribute-resolver, attribute-filter like below:
>
> >====================================================================
>
> *>attribute-resolver.xml:*
>
> >
>
> ><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
> xmlns="urn:mace:shibboleth:2.0:resolver:ad">
>
> >
>
> >   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />
>
> >
>
> >                      <resolver:AttributeEncoder xsi:type="SAML2Base64"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>
> >                                name="ORG_ATTRIBUTE_64" />
>
> >  <resolver:AttributeEncoder xsi:type="SAML2String"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>
> >                               name="ORG_ATTRIBUTE" />
>
>
>
> That’s setting the NameID to the Principal value. You need to define the
> additional attributes. You haven’t done that.
>
>   *attribute-filter.xml:*
>
> ><afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
>
> >        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
>
> >        <afp:AttributeRule attributeID="principal">
>
> >                <afp:PermitValueRule xsi:type="basic:ANY" />
>
> >        </afp:AttributeRule>
>
> >    </afp:AttributeFilterPolicy>
>
>
>
> Again, you are only releasing the principal. You haven’t released any
> additional attributes (nor have you defined them).
>
>
>
>
>
> >Because of above two steps i am getting the principal at SP
> side(SAMLResponse)
>
> *>Please correct me if i am wrong.*
>
>
>
> Since you have not defined or released any attributes describing the
> principal, the IdP can’t release them so the SP doesn’t see them. You need
> an attribute definition (in attribute-resolver.xml) and an attribute
> release (in attribute-filter.xml) for EACH attribute you want sent in
> addition to the principal. You also need a data connector created (in
> attribute-resolver.xml) for each database you are querying. (See Andrew’s
> message).
>
>
>
> >if i am correct, Like this can we get the permissions of the user,
> Please give me an example to
>
> >get the permissions of the user at SP side in saml response.
>
>
>
> Before you can get the attributes at the SP, the IdP has to send them. You
> send them by creating the Attribute Definition as described above. Once
> that’s done, the attributes will just be there in the assertion.
>
>
>
> >2)      What data source contains this attribute?
>
> >- Here the only source is our database for every information, I can get
> the info from database by sending request with proper url.
>
>
>
> You say there’s a database, but I’m betting you haven’t put the connection
> information in the attribute-resolver.xml file.
>
>
>
> >Please provide me some example with xml configuration, So that i can
> easily handle my task.
>
>
>
> (Some of this repeats what Andrew already sent)
>
>
>
> For the attribute definitions:
>
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverSimpleAttributeDefinition
>
> For the database sources (data connectors):
>
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector
>
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute
> (first example)
>
>
>
> --- Eric
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141205/89d01a33/attachment-0001.html