Better approach to do Authorization in shibboleth

[Surinaidu Majji]

Our application is already working with existing
attribute-resolver.xml(without dataconnector),
I can share my attribute-resolver file, if required.

I have a question about attribute-resolver.xml,
We get the required data by using Rest-Api(simple url) from our
database(BaseX-xml database).
Now i wanted to know, how to write the dataconnector using Url to get the
data from database?

On Mon, Dec 8, 2014 at 12:00 PM, Andrew Morgan <morgan at orst.edu> wrote:

> On Mon, 8 Dec 2014, Surinaidu Majji wrote:
>
> > Since i am using external authentication log-in handler, I am querying
> our
> > database in my defined servlet(externalAuthnPath='url') which is
> configured
> > in handler.xml. I think that's why, we are able to get the principle at
> SP
> > without having DataConnector in attribute-resolver.xml.
> >
> > Please don't consider the below is duplicate information.
> > I am querying our database in my defined servlet(externalAuthnPath in
> > handler.xml) by sending the credentials entered in login.jsp. then our
> > server is giving response with some required information, and the same
> > information we are using at SP side by providing Attribute-Definition in
> > attribute-resolver.xml but No *DataConnector *in attribute-resolver.xml.
> >
> > So here, Querying the database in servlet is equals to putting the
> > DataConnector?
> >
> > Is it the reason to get principle at SP side without having Data
> Connector?
>
> This is frustrating, perhaps due to the language barrier.
>
> The SAML response generated by the IDP contains attributes that are
> resolved and released according to the configuration of
> attribute-resolver.xml and attribute-filter.xml on the IDP.
>
> The external authentication handler returns the authentication principal
> (typically a username) to the IDP so that it can use that as a key to
> lookup attributes using a Data Connector.
>
> If I have this wrong, please, someone else speak up and correct me.  I
> know of no way that the username or any other attribute can be sent to an
> SP without first resolving it from a Data Connector.
>
> Surinaidu, do you have a specific question about configuring
> attribute-resolver.xml?
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141208/3aeaeede/attachment-0001.html