Custom Principal & Authentication Data Passing

[cneberg]

>No, that wouldn't cause it. That prevents other Principals from being
added, it doesn't have any affect on what you add.

ok.

> It won't serialize safely without more code added of course
if it's trying to preserve the subject in a session, but that won't matter
in the same request.

I'd like it to survive SSO between multiple SP's.   Currently it works to
the first SP, but then succeeds copying the principal name to the second
but appears to loose all of the extra attributes I pulled from it
originally.

It also only appears to work if I my class extends UsernamePrincipal
otherwise it gives  urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal.

When you say serialization do you mean normal java serialization - which my
principal supports (stand alone it does any way, java serialization fails
when I extend UsernamePrincipal), or serialization to json like is done in
the GenericPrincipalSerializer.java and if its the latter, how do I
register my own serializer?   I don't know the expected max size of a
serialized session, is there an recommended maxium size?   Depending on the
size I might consider only putting a random ID in the principal and instead
provisioning authenticated identity to a temp data store and writing a data
store plugin to look up the ID at attribute resolution time.

-Topher

On Thu, Jun 4, 2015 at 6:38 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/4/15, 10:18 PM, "cneberg" <cneberg at gmail.com> wrote:
>
>
> >
> >The issue I'm still having is my custom principal set in my external auth
> >plugin isn't there, I think its being overwritten and I need to set the
> >shibboleth.authn.External.addDefaultPrincipals option to False
>
> No, that wouldn't cause it. That prevents other Principals from being
> added, it doesn't have any affect on what you add. Returning a Subject
> from the External servlet will use that exact object, at least for that
> transaction. It won't serialize safely without more code added of course
> if it's trying to preserve the subject in a session, but that won't matter
> in the same request.
>
> > - which isn't in a released version of the
> > IDP yet.  Do you have a release date scheduled for 3.2?
>
> No.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150608/a06c96a5/attachment.html>