User Attributes in Java

[Peter Schober]

* Yi Yang <yangyi0318 at hotmail.com> [2016-01-26 11:38]:
> Thanks for your reply.

Thanks for ignoring the part of my reply that said:
"Please send support requests to the mailing list."

> I am coding a filter (Java and the server is Tomcat, the url pattern for the
> filter is /profile/*) on the idp side to intercept requests,
> and from the request, I can get the login context (loginContext).
> If the loginContext is not null, then I will check if the user is
> authenticated. If it is, I need to retrieve the user's attributes defined
> in attribute-filter.xml and attribute-resolver.xml, run different script
> commands based on which sp the user is from and use the user's
> attributes as parameters to the script commands. 
> I iterated the attributes and headers of httpRequest but couldn't get any of
> the attributes, is there any methods that I can retrieve the user's
> attributes in Java code?

Either you're protecting access to a Shibboleth IDP with a Shibboleth
SP (i.e., you're creating a SAML proxy) or you're more fundamentally
mistaken -- or I fail to see yet another interpretation of the above:

Whatever's defined in attribute-resolver.xml and attribute-filter.xml
relates to SAML attributes that are sent to SAML SPs via SAML
protocols and bindings. I.e., whatever you put into
attribute-resolver.xml and/or attribute-filter.xml will NOT cause
request attributes to appear in the same servlet the IDP is running
in.

Any statements you may have found from myself or others relating to
attribute access from Java in the context of Shibboleth are for the
use case of protecting a Java resource with the Shibboleth SP software
(and tunneling recieved attributes from the SP to the servlet
container via AJP).

Now that we hopefully have all this ouf of the way, why not start at
the beginning:
* What IDP version are you doing this for? If the answer is < 3.2 you
  should start again with a current release.
* What specifically are trying to achieve with your filter?

-peter