Clarification on custom attributes

[BPottier at andovercos.com]

I’ll see if I can find a JAAS plugin. The driver though is not open sourced … say that I wanted to take the route of writing something custom, would you agree that writing the authentication portion would be relatively simple for anyone familiar with Java? And further is the issue of attributes more trouble than it’s worth if we did take that route?

Benjamin Pottier
Systems Engineer
The Andover Companies
(978) 475-3300 x321

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, February 22, 2017 12:09 PM
To: Shib Users
Subject: Re: Clarification on custom attributes

On 2/22/17, 11:46 AM, "users on behalf of BPottier at andovercos.com<mailto:BPottier at andovercos.com>" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of BPottier at andovercos.com><mailto:BPottier at andovercos.com%3e> wrote:

> Disclaimer: I’m not a developer … but I want to get the developers I work with onboard with writing a custom action to
> validate username password against a DynamoDB table. I’ve done the research there as far as writing a bean and
> inheriting from the AbstractUsernamePasswordValidationAction class. The process of validating the user seems relatively
> straightforward. My question is how do I approach attributes? Just need some help getting an idea so I can sell it to the
> developers.

A quick search says there's a JDBC driver for it (I have no idea what it is, I just did a quick check), so the answer is that for authentication I'd just go find a JAAS plugin for JDBC-based login, and for attribute access you just use the built-in JDBC support.

So no development needed on either, unless there's no such JAAS plugin around anymore. If there's really nothing much out there anymore, I'm happy to add a JAAS module for JDBC to a future release, it's hardly rocket science.

The challenge with either is that finding drivers with working connection management is tough. Any network issues at all and my experience lately is that they all hang the IdP due to TCP closures. It's just not something I trust much anymore. There's no reason it can't work, but people just don't build reliable network code in those drivers.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

________________________________

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170222/a0eec598/attachment-0001.html>