Is there any way to send 'Principal' to SP side without using Custom Dataconnector?

[Peter Schober]

* Surinaidu Majji <pioneer.suri at gmail.com> [2014-12-23 06:13]:
> But still i am not clear how to get the Principal at SP side without
> dataconnector.

"DataConnector" in this community means a mechanism for the Shibboleth
IDP to look up data from a data source. It has nothing to do with a
SAML SP, it's internal to the Shibboleth IDP.
Between the SAML IDP and the SAML SP there are clearly specified SAML
protocol messages.

On the IDP side you decide what data to take from where
(dataconnector) and where to put it in the SAML (attribute definition
and its encoders).

On the SP side you do whatever your SAML implementation offers you) to
extract the information you want. Since you said you're not using the
Shibboleth SP we cannot help with that.

> What this means from the docs 'The principal name comes exclusively
> from internal IdP state.'?

The Shibboleth IDP has a concept of a "principal", meaning an
authenticated subject for which an identifier (or more) had been
establishing during authentication.

Your non-Shibboleth SAML SP may also have a concept of a "principal"
but this has nothing to do with the Shibboleth IDP or the principal
type attribute definition in your Shib IDP.

You can put what the IDP has as a principal name for a subject into an
attribute definition:
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverPrincipalNameDefinition
and then add the appropriate encoders to it, depending on where (and
how) in the SAML protocol message you wantthe data to to end up.

For example, to put the IDP's principal into the SAML Assertion's
Subject, as a NameID of type email address:

<resolver:AttributeDefinition xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="myPrincipalName">
  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</resolver:AttributeDefinition>

Alternatively, if you wanted to put the value of the IDP's principal
into a SAML attribute, say, userid/uid, you could use the
"PrincipalName" attribute defintion as is (i.e., as in the example
from the documentation, without any encoders):

<resolver:AttributeDefinition xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="myPrincipalName"/>

and reference it as a Dependency of the attribute definition for "uid":

<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid">
  <resolver:Dependency ref="myPrincipalName" />
  <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
  <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
</resolver:AttributeDefinition>

To actually release any of that to a SAML SP you'd have to permit
release in the Shib IDP's attribute filter, either for
"myPrincipalName" (if following the first example) or "uid" (if you
wanted to release it as a SAML attribute).

Use the IDP's audit log to verify that the IDP actually released the
data to the SP in question.

The rest is up to the SAML SP.
-peter