Best approach to release the authorization details to the Service Provider(SP)?

[Cantor, Scott]

I'm not going to answer this again. This is the last time, until you ask a 
more reasonable question and stop repeating the same one over and over.

On 12/9/14, 4:25 AM, "sarath upadrista" <upadrista.sarath at gmail.com> wrote:


> 
>    2) once we got the response form the dataBase, we will send back the 
>below details to the IDP. Because we are using the ExternalLoginHandler 
>the below mentioned
> betails has to be send to the IDP

No, that's not correct code.

>                                Subject subj = new Subject();
>                              /* We are sending the Subject which has to 
>be released by the IDP to the SP. This contains details about the 
>authenticated user
> info ie.., (GroupId (userName etc) */

With the external handler, you don't send a Subject AND a Principal AND a 
Principal name. You pick *one* of those to do, and set that *one* 
attribute in the request. Do not set all three. I don't recall which one 
it will use, but it will only use one of those results and ignore the 
others.

> 
>                                
>request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
>                                
>request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, groupId); 
>                                
>request.setAttribute(LoginHandler.SUBJECT_KEY, subj);

You pick *one* of the above and delete the other two.

>Now, I would like to put the authorization mechanism. So, please answer 
>my below mentioned questions: 
>
>i) What is the best way to get the authorization details of the 
>authenticated user?
>     - Shell I call my dataBase to get the authorization details after 
>the step 1 which has mentioned above?

Preferably yes. If you want to try and pull them out of some kind of 
complex Java Subject, you can, but you'll have to write custom code, or 
use Scripts, in the resolver to do that.

> 
>     - Shell I use the resolver:DataConnector which internally call the 
>dataBase? 
>          If this is the case, We are using neither the 
>RelationalDataBase nor the LDAP. We are using the restFul calls to 
>connect to our dataBase. How to do
> the restFul call's at the IDP using the resolver:DataConnector?

Well, you can try using one of the contributed extensions that several 
people have pointed to, or you'd have to write your own, or use a Script. 
We do not supply anything like that in the normal released code.

> 
>ii) What is the best way to release the authorization details of the 
>authenticated user to the Service Provider? 
>   - Shell I add the authorization details as a Principal into the 
>Subject? Is it a best approach?. Will it work?

The SP does not see a Java Subject, period. If you insist on using complex 
Java Subjects, which you probably should not do, all that does is change 
what you have to do in the attribute resolver and make it a bit harder. 
You cannot release any data to the SP that isn't defined in the resolver 
as an AttributeDefinition and encoded into SAML. How you do that is up to 
you, but we can't provide code for every possible need and every possible 
scenario.

> 
>   - Shell I use the resolver:AttributeDefinition and 
>resolver:DataConnector to release the attributes to the Service 
>Provider(SP).

You have no choice, you have to do that.

> If so, how to use the restFul call's to get the details?

Since we don't supply such a connector, that's a question for somebody 
else, not me.

-- Scott