scripted attributes and customObjectRef="shibboleth.HttpServletRequest"

[Cantor, Scott]

On 6/13/17, 5:42 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> If I protect the entire IDP, I see the variables and their values, but doing this for real would really screw with the operation of the
> IDP.
>
> Ideas?

You'd have to capture them during authentication, which means switching to External and your own servlet to do the work.

Produce a Java Subject to pass back and you can tunnel just about anything back by putting data in Principals and public/private Credentials.

It depends if you want them to be preserved in the user's session and have the IdP handle SSO or discard all of it and have the external system handle SSO and just replay the attributes back in every time.

The former would probably be done by transforming the external attributes into IdPAttributes and wrapping them in an IdPAttributePrincipal and putting that in the Subject. That will get serialized off and preserved, and it will be there during subsequent requests.

If you want to avoid all that, you would want to tell the IdP not to serialize the result of the flow (there's a condition property for that) and you could put the data in some custom form in the Subject's credential set and it would be accessible that way from the resolver but thrown away afterward.

-- Scott