Best approach to release the authorization details to the Service Provider(SP)?

[sarath upadrista]

Hello all,

    We are using the SSO Authentication using the shibboleth. We are not
using the Shibboleth SP. We have our own SP which will prepare the SAML2
AuthnRequest. We are using the 'ph:ExternalAuthn' type LoginHandler which
has configured in the handler.xml file. According to the
ExternalLoginHandler we do few validations and will forward to 'login.jsp'
page if the user has not authenticated. Once the user has Authenticated
then we are doing following things:

    1) We will update GroupId(UserName) and password into our dataBase
where we are using restFul webservices to call our dataBase.
    2) once we got the response form the dataBase, we will send back the
below details to the IDP. Because we are using the ExternalLoginHandler the
below mentioned betails has to be send to the IDP
                              // In the ExternalAuthentication mechanism
these attributes are mandatory to be processed by the
AuthenticationManager.

request.setAttribute(globalStrings.getForceAuthn(), false);
                                Principal principal = new
UsernamePrincipal(login.getAttributes());
                                Subject subj = new Subject();
                              /* We are sending the Subject which has to be
released by the IDP to the SP. This contains details about the
authenticated user info ie.., (GroupId (userName etc) */
                                subj.getPrincipals().add(principal);

request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);

request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, groupId);

request.setAttribute(LoginHandler.SUBJECT_KEY, subj);

request.setAttribute(globalStrings.getAuthnMethod(),
this.authenticationMethod);

AuthenticationEngine.returnToAuthenticationEngine(request, response);

       - To release the principal-name to the SP we have configured the
attribute-resolver.xml and attribute-filer.xml
                  attribute-resolver.xml
<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad">

   <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" />

                <resolver:AttributeEncoder xsi:type="SAML2Base64"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="SRDM_ATTRIBUTE_64" />
  <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="SRDM_ATTRIBUTE" />
</resolver:AttributeDefinition>

                  attribute-filer.xml:
    <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
        <afp:AttributeRule attributeID="principal">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>


     - So because we have configured the IDP in the above way, the IDP is
releasing the principal name of the user as a single-valued attribute to
the SP.


Now, I would like to put the authorization mechanism. So, please answer my
below mentioned questions:

i) What is the best way to get the authorization details of the
authenticated user?
     - Shell I call my dataBase to get the authorization details after the
step 1 which has mentioned above?
     - Shell I use the resolver:DataConnector which internally call the
dataBase?
          If this is the case, We are using neither the RelationalDataBase
nor the LDAP. We are using the restFul calls to connect to our dataBase.
How to do the restFul call's at the IDP using the resolver:DataConnector?
ii) What is the best way to release the authorization details of the
authenticated user to the Service Provider?
   - Shell I add the authorization details as a Principal into the Subject?
Is it a best approach?. Will it work?
   - Shell I use the resolver:AttributeDefinition and
resolver:DataConnector to release the attributes to the Service
Provider(SP). If so, how to use the restFul call's to get the details?

If there is any other mechanism, please provide a sample which will suit
our usecase.


Please help me because I don't have any source or support to move further.
Till the Authentication it has been developed by other person who is not
there.




Thanks & Regards
Sarath U
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141209/a7d6f82c/attachment-0001.html