Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Since i am using external authentication log-in handler, I am querying our
database in my defined servlet(externalAuthnPath='url') which is configured
in handler.xml. I think that's why, we are able to get the principle at SP
without having DataConnector in attribute-resolver.xml.

Please don't consider the below is duplicate information.
I am querying our database in my defined servlet(externalAuthnPath in
handler.xml) by sending the credentials entered in login.jsp. then our
server is giving response with some required information, and the same
information we are using at SP side by providing Attribute-Definition in
attribute-resolver.xml but No *DataConnector *in attribute-resolver.xml.

So here, Querying the database in servlet is equals to putting the
DataConnector?

Is it the reason to get principle at SP side without having Data Connector?

Thanks for your time.


On Sat, Dec 6, 2014 at 12:46 AM, Andrew Morgan <morgan at orst.edu> wrote:

> On Fri, 5 Dec 2014, Surinaidu Majji wrote:
>
> > Hello @Andrew Morgan, Thanks a lot for your support.Definitely i will ask
> > questions to get clarification.
> > Once an authentication is done, i will get the necessary attributes from
> > SAMLResponse through attribute-resolver,attribute-filter.xml. So i can
> get
> > my necessary user permissions by querying our database through Data
> > Connector.
> >
> > But my doubt is how could i get the Principal(includes email, acctype)
> > without querying  database, I think this is because of that we are
> sending
> > req.setAttribute(LoginHandler.Principal_Key, login.getAttributes()); to
> > AuthenticationEngine.returnToAuthenticationengine(req,resp);
> >
> > By sending the  login.getAttributes() as principal to the
> > AuthenticationEngine, we are able to get those in response by giving
> > defining the 'xsi:type="PrincipalName' id="principal" in the
> > attribute-resolver.xml.
> >
> > am i correct? Please let me know if i am wrong?
>
> I don't know how id="principal" works if you don't have a Data Connector
> defined.  From your other emails, it sounds like you aren't querying a
> database.  Either way, you'll need to get an appropriate Data Connector
> defined in attribute-resolver.xml and use that to retrieve attributes.
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141208/374c6534/attachment.html