Shibboleth Idp 4.1 and using the auth password as an attribute

[Vincent Feyaerts]

Hi,

 

In our Shib IdP 3.4 (java-1.8.0-openjdk-1.8.0.282.b08-1.el7_9.x86_64 ) we
repacked the password from the user as an attribute for one special SP. This
was done in a scripted attribute:

 

    <AttributeDefinition id="password" xsi:type="ScriptedAttribute">

        <AttributeEncoder xsi:type="SAML2String"
name="urn:mace:ua.ac.be:dir:attribute-def:password" friendlyName="password"
encodeType="false" />

        <Script><![CDATA[

                subjectCtx =
profileContext.getSubcontext("net.shibboleth.idp.authn.context.SubjectContex
t");

                subject = subjectCtx.getSubjects()[0];

 
password.addValue(subject.getPrivateCredentials().toArray()[0].getName());

        ]]></Script>

    </AttributeDefinition>

 

If I would turn on debug and log the subject, subjectCtx.getSubjects()[0], I
would get this:

        Principal:
AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2
.0:ac:classes:PasswordProtectedTransport}

        Principal:
AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2
.0:ac:classes:Password}

        Principal:
AuthenticationMethodPrincipal{authnMethod=urn:oasis:names:tc:SAML:1.0:am:pas
sword}

        Principal:
[org.ldaptive.jaas.LdapPrincipal at 1847202780::.......redacted....... [],
responseControls=null, messageId=-1]]

        Principal: UsernamePrincipal{username=...redacted....}

        Private Credential: PasswordPrincipal{password=<elided>}

 

So in IdP 4.1 (java-11-openjdk-11.0.10.0.9-4.el8_3.x86_64 ) I can't access
to the password. I did some debugging:

 

                subjectCtx =
profileContext.getSubcontext("net.shibboleth.idp.authn.context.SubjectContex
t");

                subject = subjectCtx.getSubjects()[0];

                logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute
");

                logger.info(subject);

 

This returns a very similar thing but the last line is missing. So evidently
no access to the PrivateCredentials.

 

INFO [net.shibboleth.idp.attribute:7] - Subject:

        Principal:
AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2
.0:ac:classes:PasswordProtectedTransport}

        Principal:
AuthenticationMethodPrincipal{authnMethod=urn:oasis:names:tc:SAML:1.0:am:pas
sword}

        Principal:
AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2
.0:ac:classes:Password}

        Principal:
[org.ldaptive.jaas.LdapPrincipal at 1847202780::....redacted.....[],
responseControls=null, messageId=2]]

        Principal: UsernamePrincipal{username=...redacted....}

 

Is this something I can re-enable somewhere so I can have access to the
PrivateCredentials again? Or is this just no longer an option with Shib 4+

 

Thank you

Vincent Feyaerts

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210326/0b27a1d4/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6855 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210326/0b27a1d4/attachment.p7s>