Better approach to do Authorization in shibboleth

[Douglas E Engert]

On 12/7/2014 11:20 PM, Surinaidu Majji wrote:
> Since i am using external authentication log-in handler, I am querying our database in my defined servlet(externalAuthnPath='url') which is configured in handler.xml. I think that's why, we are able
> to get the principle at SP without having DataConnector in attribute-resolver.xml.

Yes.

>
> Please don't consider the below is duplicate information.
> I am querying our database in my defined servlet(externalAuthnPath in handler.xml) by sending the credentials entered in login.jsp. then our server is giving response with some required information,
> and the same information we are using at SP side by providing Attribute-Definition in attribute-resolver.xml but No *DataConnector *in attribute-resolver.xml.

I too am frustrated...

As I said in a private note, I will repeat here:

No it is different. You say "then sending to Principle_Key which is with (permissions) to IDP(AuthenticationEngine)"

The IDP is actually doing two steps.
  (1) is authentication. This can be triggered by any SP, and it causes the IDP call the login handler, and present user
      with login page. The IDP then sends a cookie to browser, with minimal login information.

  (1a) If the login handler finds the user has logged in previously, by using the _IDP cookie in the browser, the
        the user does not have to go through login again. This allows for single signon to the IDP.

  (2) Second is attribute assertion, that occur right after authentication, either by using the login handler,
      or by using the stored cookie in the browser. Attributes are looked up at this time, for the SP that
      is requesting the assertion. (This may not be the same SP that triggered the initial authentication.)
      The IDP will send the assertion to the browser, that will also store it in a cookie for the SP.

So in normal Shibboleth processing, the attribute resolver would query a database based on the principal
and get the attributes that exist in the database at this time, which may have changed since the actual
authentication done with login, and may be for a different SP, and thus different for the attributes needed
for the original SP.

Also Note in (1a) your login handler is not called at all! (1 and 1a) are done at one time,  (2) may be later and repeated
for different SPs at a different time. very little information is saved between (1) or (1a) and (2). (2) is expected
to use the principal and dataConnectors to find or  generate attributes for the specific SP.

I also suggested:

FireFox has a SAML Tracer plugin that is very useful to watch what actually goes on, including the cookies.

Have you tried using the SAML Tracer?


>
> So here, Querying the database in servlet is equals to putting the DataConnector?

No. See above (1) and (2) Not much information is passed between (1) and (2).

>
> Is it the reason to get principle at SP side without having Data Connector?

I am not sure what you are asking.



>
> Thanks for your time.
>
> On Sat, Dec 6, 2014 at 12:46 AM, Andrew Morgan <morgan at orst.edu <mailto:morgan at orst.edu>> wrote:
>
>     On Fri, 5 Dec 2014, Surinaidu Majji wrote:
>
>     > Hello @Andrew Morgan, Thanks a lot for your support.Definitely i will ask
>     > questions to get clarification.
>     > Once an authentication is done, i will get the necessary attributes from
>     > SAMLResponse through attribute-resolver,attribute-filter.xml. So i can get
>     > my necessary user permissions by querying our database through Data
>     > Connector.
>     >
>     > But my doubt is how could i get the Principal(includes email, acctype)
>     > without querying  database, I think this is because of that we are sending
>     > req.setAttribute(LoginHandler.Principal_Key, login.getAttributes()); to
>     > AuthenticationEngine.returnToAuthenticationengine(req,resp);
>     >
>     > By sending the  login.getAttributes() as principal to the
>     > AuthenticationEngine, we are able to get those in response by giving
>     > defining the 'xsi:type="PrincipalName' id="principal" in the
>     > attribute-resolver.xml.
>     >
>     > am i correct? Please let me know if i am wrong?
>
>     I don't know how id="principal" works if you don't have a Data Connector
>     defined.  From your other emails, it sounds like you aren't querying a
>     database.  Either way, you'll need to get an appropriate Data Connector
>     defined in attribute-resolver.xml and use that to retrieve attributes.
>
>              Andy
>     --
>     To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
>
>
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>