Better approach to do Authorization in shibboleth

[Andrew Morgan]

On Mon, 8 Dec 2014, Surinaidu Majji wrote:

> Since i am using external authentication log-in handler, I am querying our
> database in my defined servlet(externalAuthnPath='url') which is configured
> in handler.xml. I think that's why, we are able to get the principle at SP
> without having DataConnector in attribute-resolver.xml.
>
> Please don't consider the below is duplicate information.
> I am querying our database in my defined servlet(externalAuthnPath in
> handler.xml) by sending the credentials entered in login.jsp. then our
> server is giving response with some required information, and the same
> information we are using at SP side by providing Attribute-Definition in
> attribute-resolver.xml but No *DataConnector *in attribute-resolver.xml.
>
> So here, Querying the database in servlet is equals to putting the
> DataConnector?
>
> Is it the reason to get principle at SP side without having Data Connector?

This is frustrating, perhaps due to the language barrier.

The SAML response generated by the IDP contains attributes that are 
resolved and released according to the configuration of 
attribute-resolver.xml and attribute-filter.xml on the IDP.

The external authentication handler returns the authentication principal 
(typically a username) to the IDP so that it can use that as a key to 
lookup attributes using a Data Connector.

If I have this wrong, please, someone else speak up and correct me.  I 
know of no way that the username or any other attribute can be sent to an 
SP without first resolving it from a Data Connector.

Surinaidu, do you have a specific question about configuring 
attribute-resolver.xml?

 	Andy