Custom Principal & Authentication Data Passing

[Cantor, Scott]

On 6/3/15, 8:16 PM, "cneberg" <cneberg at gmail.com> wrote:



>How do I pass custom data in shibboleth 3?

In general you don't, because it's not a valid thing to be passing data 
from authentication into the resolver, those aren't always running 
together. It generally means there's a problem in the design.

Assuming you don't care about queries and confine yourself to the front 
channel, you can add any Principals to the authentication result you want 
if you're using the External login method, otherwise you don't get that 
control generally speaking.

Assuming you are using External, or are using a custom flow you created, 
you would need to retrieve the authentication information essentially the 
way Brent said, it's hanging off the ProfileRequestContext.

>getUserSession is no longer avaiable.

Sessions themselves are explicitly optional now (they can just be toggled 
off), so even on the front channel you would not want to build a script 
that assumes a session exists. The authentication result for a given front 
channel SSO profile execution can be accessed via AuthenticationContext, 
even when a session isn't actually being created to preserve it.

There aren't any other scenarios except for SSO profiles where a result 
like that can be assumed.

>I've tried these methods instead to get to the subject but they all 
>return null.

resolutionContext is not the root of the tree. I believe the bug fixing 
the population of the profileContext variable is only fixed in trunk, but 
resolutionContext.getParent() will return it for now.

So the AuthenticationResult associated with a front-channel request (there 
isn't such a thing for a query) is:

resolutionContext.getParent().getSubcontext("....AuthenticationContext").ge
tAuthenticationResult()


-- Scott