Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Hello @Andrew Morgan, Thanks a lot for your support.Definitely i will ask
questions to get clarification.
Once an authentication is done, i will get the necessary attributes from
SAMLResponse through attribute-resolver,attribute-filter.xml. So i can get
my necessary user permissions by querying our database through Data
Connector.

But my doubt is how could i get the Principal(includes email, acctype)
without querying  database, I think this is because of that we are sending
req.setAttribute(LoginHandler.Principal_Key, login.getAttributes()); to
AuthenticationEngine.returnToAuthenticationengine(req,resp);

By sending the  login.getAttributes() as principal to the
AuthenticationEngine, we are able to get those in response by giving
defining the 'xsi:type="PrincipalName' id="principal" in the
attribute-resolver.xml.

am i correct? Please let me know if i am wrong?

Sorry for asking this question, because i am new to my existing project,
this one is implemented by some other person(he is not here now).

On Fri, Dec 5, 2014 at 12:01 AM, Andrew Morgan <morgan at orst.edu> wrote:

> On Thu, 4 Dec 2014, Surinaidu Majji wrote:
>
> > Thank you very much @Andy for your reply after looking into my query
> deeply.
> > I got better understanding about shibboleth flow when i saw your reply.
> >
> > The Shibboleth IDP performs authentication via a variety of methods.
> > ->Here i am using 'ExternalAuth' in which it goes to the my custom Url to
> > make further processing.
> >
> > If you want to change the login.jsp script to
> > validate credentials against a different database, you can do that.
> > -> Yes I can do that and here i am thinking that only to deal with one
> > login.jsp for both the databases, any way that depends on my design.
> >
> > After authentication is successful, the Shibboleth IDP will attempt to
> > resolve attributes (find more information about) the principal returned
> by
> > the authentication step
> > - since i am using 'ExternalAuth', and i am not  using any 'UserName'
> > particularly
> > i am writing the code which is according to the shibboleth website for
> > externalAuth(use subject to get control over principal)
> >
> > This code is written after authentication is successful against my
> database.
> > request.setAttribute(globalStrings.getForceAuthn(), false);
> > Principal principal = new UsernamePrincipal(login.getAttributes());
> > Subject subj = new Subject();
> > subj.getPrincipals().add(principal);
> > request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
> > request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);
> > request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
> > request.setAttribute(globalStrings.getAuthnMethod(),
> > this.authenticationMethod);
> > AuthenticationEngine.returnToAuthenticationEngine(request, response);
>
> It is my understanding that the attributes released by the IDP *only* come
> from the attribute resolution step.  I don't think attributes can be added
> by the external auth handler.  It should be using the "principal" as the
> key to lookup additional attributes in your Data Connector.
>
> > The attribute resolution is configured in attribute-resolver.xml.
> > - The below is my attribute-resolver.xml to resolve the attributes,
> please
> > look into it.
> >
> > <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
> > xmlns="urn:mace:shibboleth:2.0:resolver:ad">
> >
> >   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />
> >
> > <resolver:AttributeEncoder xsi:type="SAML2Base64"
> > xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >                                name="ORG_ATTRIBUTE_64" />
> >  <resolver:AttributeEncoder xsi:type="SAML2String"
> > xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> >                                name="ORG_ATTRIBUTE" />
> > for the above, there is no "dataconnector" is used.
> >
> > attribute-filter.xml:
> >
> > <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
> >        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
> >        <afp:AttributeRule attributeID="principal">
> >                <afp:PermitValueRule xsi:type="basic:ANY" />
> >        </afp:AttributeRule>
> >    </afp:AttributeFilterPolicy>
> >
> > So that i could be able to get the above principal(email, acctType etc)
> at
> > SP side in 'SAMLResponse'.
> >
> >
> > Common places to lookup additional information are a database or LDAP.
> > - Here completely i am using our database, So there is no point of LDAP,
> >  you are saying additional information, can it be 'permissions of the
> > user' which is from
> > our database?
> > - here how can get the required 'permission info'(authorization) from our
> > database,
> > - How to write it in the attribute-resolver.xml by using DataConnectors
> to
> > get the perms of user.
> > Please provide me some example for configuration which i can get the
> > 'permissions of user'.
>
> The distributed attribute-resolver.xml file has an example database Data
> Connector:
>
>      <!-- Example Relational Database Connector -->
>      <!--
>      <resolver:DataConnector id="mySIS" xsi:type="dc:RelationalDatabase">
>          <dc:ApplicationManagedConnection
> jdbcDriver="oracle.jdbc.driver.OracleDriver"
>
> jdbcURL="jdbc:oracle:thin:@db.example.org:1521:SomeDB"
>                                           jdbcUserName="myid"
>                                           jdbcPassword="mypassword" />
>          <dc:QueryTemplate>
>              <![CDATA[
>                  SELECT * FROM student WHERE gzbtpid =
> '$requestContext.principalName'
>              ]]>
>          </dc:QueryTemplate>
>
>          <dc:Column columnName="gzbtpid" attributeID="uid" />
>          <dc:Column columnName="fqlft" attributeID="gpa" type="Float" />
>      </resolver:DataConnector>
>       -->
>
> I use LDAP here, but this looks pretty easy to me.  Enter your connection
> string, a SQL query, and column-to-attributeID mapping.
>
> > After attribute resolution is complete, the Shibboleth IDP will filter
> > those attributes according to the configuration in attribute-filter.xml.
> > Only the attributes you configure will be released to the SP.
> >
> > The SP can then use those attributes to making authorization decisions.
> > - > Yes, if i can do configuration in attribute-resolver and
> > attribute-filter.xml, i can use at SP side
> >   from SAMLResponse.
> > If you can provide me answers for my above questions, i think i can
> > complete my task.
>
> Keep asking questions, we'll keep trying to answer them.  :)
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141205/693e6888/attachment-0001.html