x509 authentication bypassing ldap.

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2019-06-03 14:37]:
> * marangiom <m.marangio at innova.puglia.it> [2019-06-03 14:32]:
> > Now, i've been asked to avoid the user registration and allow users to login
> > with a smartcard (whose validity is solved in apache) without a previous
> > registration: I would like to build the response using just the few
> > attributes read from the smartcard and pack up a saml response: I would like
> > to jump the steps 3 and (partially) 4.
> 
> I guess you could resolve additional attributes from the certificate
> in a Script type attribute definition, instead of looking them from
> LDAP.

Note that I kind of assumed you'd use the built-in X.509 authentication
https://wiki.shibboleth.net/confluence/display/IDP30/X509AuthnConfiguration
not Apache httpd as reverse proxy.
That may change what's possible and how easy/secure it its wrt
grabbing X.509 attributes from headers/request attributes.
-peter