Getting Shibboleth attributes into client-side Javascript applications

[Wessel, Keith]

Hi, all,

I've had two different questions from developers recently about how to get user information from Shibboleth attributes into a Javascript application running in the user's browser. Is this what the SP's Session Handler is designed for? If a browser already contains the user's SP session cookie, could that be sent with a request to this handler to obtain the user's attributes?

The guidance I've offered so far has been limited to an intermediate piece between the authentication and the loading of the Javascript that copies attributes into a cookie or just building native authentication (usually OIDC) into the Javascript. Neither are ideal as they're both full of potential large security pitfalls.

If the session handler isn't suited to this, I'd welcome other guidance.

Thanks,
Keith