IDP3 External Authentication Attributes

[Cantor, Scott]

> What's an appropriate way to do this in IDP3 (preferably 3.2.1, since I
> need to get this done soon and 3.3 doesn't seem to exist).

There's an IdPAttributePrincipal class (net.shibboleth.idp.authn.principal.IdPAttributePrincipal), and I believe that was done for 3.2, but I don't know that to a certainty. Assuming that's there, you can wrap attributes in instances of that class and put them into a Subject you create on the External side. The External servlet needs to be programmed to supply the Subject as the result, and not a name or Principal, so you need to fully populate it. Put a UsernamePrincipal into the collection also and that will more or less work without additional fuss.

Getting at the Subject in the resolver will be more automated in 3.3 but for now you would get it from a SubjectContext that's directly beneath the ProfileRequestContext in the tree. Your Principals will be there (on the front channel only). There is no way to do this on the back channel.

> I'm looking over
> https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition
> and all it does is remind me that I have no idea of what I'm doing.
> Like it tells me maybe I should be "navigating the context tree"

We have documented the context tree extensively. Sufficiently, probably not, but if you haven't read all the material on the "design" side of the wiki, then that's what you need to do. There are topics linked into the home page on the right side.

> I'd like to upgrade from IDP2 to 3 with just a few changes.  I probably
> should convert this oAuth thing into a flow, but I'd rather worry about
> that someday after I figure out what a "flow" actually is.  Right now it
> seems hopelessly complicated to me.

And if you want to do that, you need to read the Spring WebFlow documentation as a starting point along with, again, the material that's in the wiki.

-- Scott