idP v3 - Integrating with 3rd party API

[Cantor, Scott]

> It appears that the best approach is to write a custom Data Connector that
> loads attributes from the API and makes them available to the rest of
> Shibboleth idP. Am I on the right path?

Likely. Particularly if you mean that the format of that data is fairly esoteric and you want to just get it into the resolver in string form I guess.

> I would like Shibboleth idP to use these attributes to decide whether the
> user is allowed to log into a particular SP. Does this require a custom flow?

No. If you pull them in as atttribute data, you can leverage the check-context intercept flow that runs a custom condition bean to decide whether to proceed with a request. There's a sample condition already in the configuration that shows how to check for attributes/values coming out of the resolver, see intercepts/ context-check-intercept-config.xml

That's just an example condition, but since that's basically the one you want, that part's probably mostly done for you.

-- Scott