Shibboleth SP and x.509 Authentication

[Cantor, Scott]

On 1/18/17, 7:21 PM, "users on behalf of Oran Wallace" <users-bounces at shibboleth.net on behalf of oran.wallace at survice.com> wrote:

> After authentication at the IdP, how can I tell which x.509 certificate 
> the user used to authenticate?

Somebody would have to configure the IdP to extract something from it and pass it as an attribute.

> The reason for this is I'd like to query 
> the certificated used for the users ID (or something that unique) for 
>  authorization within the application. Does this have to be an attribute?

Or a NameID, but same difference, yes.
    
> Also how can I test with an IdP that performs x.509 authentication? Do I 
> have to stand up an IdP and config x.509 auth?

You can't run SSO without both ends. But if you're not responsible for the IdP, then just establish a set of standard attributes you need to receive, document it, and tell whoever runs the IdP to make it so. X.509 has nothing much to do with it, frankly. If you application has some policy reason for requiring that particular method, that would be another dimension of the contract and you should request that by specifying a SAML authentication context class. There is a standard one to use for X.509, or there are more abstract ways, but we're getting into community norms now.

If you don't care, and the authentication policy is really something the IdP is dictating, it's none of your concern at all.

-- Scott