<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
In addition to Mike's response, this wiki article may prove helpful:
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeAccess</a><br>
<div><br>
</div>
<div>If you absolutely need to inspect the assertion, you can do it by calling this:</div>
<div><br>
</div>
<div>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExport</div>
<div><br>
<div>
<div>On May 31, 2013, at 17:39 , Mike Flynn wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div>
<div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt">
<div><span><font size="3">Your page at the protected resource can interrogate the response headers for the </font>attributes<font size="3"> and some other Shib parameters. Are you looking to get the actual assertion itself to examine it? If so you can turn
on debugging in the logger config files and get the assertions in the logs.</font></span></div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">
<div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">
<div dir="ltr">
<hr size="1">
<font size="2" face="Arial"><b><span style="font-weight:bold;">From:</span></b> Jim Hoy <jim.hoy@acatar.com><br>
<b><span style="font-weight: bold;">To:</span></b> "users@shibboleth.net" <users@shibboleth.net>
<br>
<b><span style="font-weight: bold;">Sent:</span></b> Friday, May 31, 2013 10:21 AM<br>
<b><span style="font-weight: bold;">Subject:</span></b> Capturing SAML Attributes from the IDP<br>
</font></div>
<div class="y_msg_container"><br>
<div id="yiv2999297150"><style><!--
#yiv2999297150
_filtered #yiv2999297150 {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered #yiv2999297150 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
#yiv2999297150
#yiv2999297150 p.yiv2999297150MsoNormal, #yiv2999297150 li.yiv2999297150MsoNormal, #yiv2999297150 div.yiv2999297150MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:11.0pt;font-family:"Calibri", "sans-serif";}
#yiv2999297150 a:link, #yiv2999297150 span.yiv2999297150MsoHyperlink
{color:#0563C1;text-decoration:underline;}
#yiv2999297150 a:visited, #yiv2999297150 span.yiv2999297150MsoHyperlinkFollowed
{color:#954F72;text-decoration:underline;}
#yiv2999297150 p.yiv2999297150MsoListParagraph, #yiv2999297150 li.yiv2999297150MsoListParagraph, #yiv2999297150 div.yiv2999297150MsoListParagraph
{margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-size:11.0pt;font-family:"Calibri", "sans-serif";}
#yiv2999297150 span.yiv2999297150EmailStyle17
{font-family:"Calibri", "sans-serif";color:windowtext;}
#yiv2999297150 .yiv2999297150MsoChpDefault
{font-family:"Calibri", "sans-serif";}
_filtered #yiv2999297150 {margin:1.0in 1.0in 1.0in 1.0in;}
#yiv2999297150 div.yiv2999297150WordSection1
{}
#yiv2999297150
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
_filtered #yiv2999297150 {}
#yiv2999297150 ol
{margin-bottom:0in;}
#yiv2999297150 ul
{margin-bottom:0in;}
--></style>
<div>
<div class="yiv2999297150WordSection1">
<div class="yiv2999297150MsoNormal">I suppose this is a lifecycle issue, and please excuse the question if it’s stupid one, but… As I see it, the process goes like this:</div>
<div class="yiv2999297150MsoNormal"> </div>
<div class="yiv2999297150MsoListParagraph" style=""><span style="">1.<span style="font:7.0pt;">
</span></span>User requests a Shib-protected resource. <br>
<br>
</div>
<div class="yiv2999297150MsoListParagraph" style=""><span style="">2.<span style="font:7.0pt;">
</span></span>The Shibboleth ISAPI filter (as this is Windows/IIS) intercepts the request and directs the user to the IDP (only one IDP here)<br>
<br>
</div>
<div class="yiv2999297150MsoListParagraph" style=""><span style="">3.<span style="font:7.0pt;">
</span></span>The user logs in successfully<br>
<br>
</div>
<div class="yiv2999297150MsoListParagraph" style=""><span style="">4.<span style="font:7.0pt;">
</span></span>The browser is redirected (HTTP 302) back to /Shibboleth.sso/SAML2/POST<br>
<br>
</div>
<div class="yiv2999297150MsoListParagraph" style=""><span style="">5.<span style="font:7.0pt;">
</span></span>The ISAPI filter does another 302 redirection to my secured content (/secure), which is now available to the authenticated user.</div>
<div class="yiv2999297150MsoNormal"> </div>
<div class="yiv2999297150MsoNormal">At step #4, I look at the HTTP request and see that there are form variables posted to the HTTP-POST handler (Shibboleth.sso/SAML2/POST). The form variables includes one called SAMLResponse which is the base 64-encoded SAML
XML. This information is apparently discarded when the 302 redirect happens from the HTTP-POST handler to the /secure URL.</div>
<div class="yiv2999297150MsoNormal"> </div>
<div class="yiv2999297150MsoNormal">My question is a simple one: How do I access the SAMLResponse in this process? I need to extract the list of attributes for use elsewhere in my application, and I’m green-horned enough to not understand what I do at this
point to actually get to the attributes I’ve just received.</div>
<div class="yiv2999297150MsoNormal"> </div>
<div class="yiv2999297150MsoNormal">Thanks for your help (and for not laughing too hard)</div>
<div class="yiv2999297150MsoNormal"> </div>
<div class="yiv2999297150MsoNormal"> </div>
</div>
</div>
</div>
<br>
--<br>
To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
<br>
</div>
</div>
</div>
</div>
</div>
--<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>