Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Hello @Scott,
Not unless you build new code or write scripts to pull
bits of data out of the *Java subject* inside the resolver and expose them
as attributes with encoders to put them into the SAML assertion.

I know that i have to define the attribute along with attribute encoders to
release the attributes to the SP. but you are saying about Java Subject, is
it *javax.security.Subject?*
*How can i include my attributes to send to the idp to be released at the
IDP side?*
*Thank you.*

On Tue, Dec 2, 2014 at 8:11 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 12/2/14, 11:59 AM, "Surinaidu Majji" <pioneer.suri at gmail.com> wrote:
>
>
>
> >Thank you for your reply, but you are saying attributes pulled from
> >resolver:
> >Is that attribute-resolver.xml, configured for releasing attributes, in
> >that case
> >i am releasing 'principal' which contains 'permissions' to SP. Is that
> >right?
>
> No, it's not right. Not unless you build new code or write scripts to pull
> bits of data out of the Java subject inside the resolver and expose them
> as attributes with encoders to put them into the SAML assertion.
>
> That isn't how people use the IdP. You need to have a database or
> directory of attributes to pull from, not rely on the authentication step
> and try and tunnel information through that.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141205/0fddbbfd/attachment.html