<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.yiv2999297150msolistparagraph, li.yiv2999297150msolistparagraph, div.yiv2999297150msolistparagraph
{mso-style-name:yiv2999297150msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.yiv2999297150msonormal, li.yiv2999297150msonormal, div.yiv2999297150msonormal
{mso-style-name:yiv2999297150msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.yiv2999297150msochpdefault, li.yiv2999297150msochpdefault, div.yiv2999297150msochpdefault
{mso-style-name:yiv2999297150msochpdefault;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.yiv2999297150msonormal1, li.yiv2999297150msonormal1, div.yiv2999297150msonormal1
{mso-style-name:yiv2999297150msonormal1;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.yiv2999297150msolistparagraph1, li.yiv2999297150msolistparagraph1, div.yiv2999297150msolistparagraph1
{mso-style-name:yiv2999297150msolistparagraph1;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.yiv2999297150msochpdefault1, li.yiv2999297150msochpdefault1, div.yiv2999297150msochpdefault1
{mso-style-name:yiv2999297150msochpdefault1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
span.yiv2999297150msohyperlink
{mso-style-name:yiv2999297150msohyperlink;}
span.yiv2999297150msohyperlinkfollowed
{mso-style-name:yiv2999297150msohyperlinkfollowed;}
span.yiv2999297150emailstyle17
{mso-style-name:yiv2999297150emailstyle17;}
span.yiv2999297150msohyperlink1
{mso-style-name:yiv2999297150msohyperlink1;
color:#0563C1;
text-decoration:underline;}
span.yiv2999297150msohyperlinkfollowed1
{mso-style-name:yiv2999297150msohyperlinkfollowed1;
color:#954F72;
text-decoration:underline;}
span.yiv2999297150emailstyle171
{mso-style-name:yiv2999297150emailstyle171;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle29
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">In the response there is a base-64 encoded POST variable called SAMLResponse. I’m looking at the XML which begins with tag <saml2p:Response…><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">In this response I see tags like:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><saml2:Attribute FriendlyName=”XYZ” Name=”…..”><br>
<saml2:AttributeValue>THE_VALUE</saml2:AttributeValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"></saml2:Attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">These Friendly names are eduPersonScopeAffiliation, eduPersonTargetID, etc… but there are also institution-specific attributes like ‘xyzUserID’ or xyzHousingLocation
or the like… <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">I need to get a collection of all of these values… If not during the login procedure as defined previously, then at some point after the redirection completes.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Mike Flynn<br>
<b>Sent:</b> Friday, May 31, 2013 1:39 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Capturing SAML Attributes from the IDP<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Arial","sans-serif";color:black">Your page at the protected resource can interrogate the response headers for the attributes and some other Shib parameters. Are you looking to get the
actual assertion itself to examine it? If so you can turn on debugging in the logger config files and get the assertions in the logs.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Arial","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="color:black">
<hr size="1" width="100%" align="center">
</span></div>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black"> Jim Hoy <</span><a href="mailto:jim.hoy@acatar.com"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">jim.hoy@acatar.com</span></a><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">><br>
<b>To:</b> "</span><a href="mailto:users@shibboleth.net"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">users@shibboleth.net</span></a><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">" <</span><a href="mailto:users@shibboleth.net"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">users@shibboleth.net</span></a><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:black">>
<br>
<b>Sent:</b> Friday, May 31, 2013 10:21 AM<br>
<b>Subject:</b> Capturing SAML Attributes from the IDP</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"><o:p> </o:p></span></p>
<div id="yiv2999297150">
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black">I suppose this is a lifecycle issue, and please excuse the question if it’s stupid one, but… As I see it, the process goes like this:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="color:black">1.</span><span style="font-size:7.0pt;color:black">
</span><span style="color:black">User requests a Shib-protected resource. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="color:black">2.</span><span style="font-size:7.0pt;color:black">
</span><span style="color:black">The Shibboleth ISAPI filter (as this is Windows/IIS) intercepts the request and directs the user to the IDP (only one IDP here)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="color:black">3.</span><span style="font-size:7.0pt;color:black">
</span><span style="color:black">The user logs in successfully<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="color:black">4.</span><span style="font-size:7.0pt;color:black">
</span><span style="color:black">The browser is redirected (HTTP 302) back to /Shibboleth.sso/SAML2/POST<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black">5.</span><span style="font-size:7.0pt;color:black">
</span><span style="color:black">The ISAPI filter does another 302 redirection to my secured content (/secure), which is now available to the authenticated user.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black">At step #4, I look at the HTTP request and see that there are form variables posted to the HTTP-POST handler (Shibboleth.sso/SAML2/POST). The form variables includes one called SAMLResponse
which is the base 64-encoded SAML XML. This information is apparently discarded when the 302 redirect happens from the HTTP-POST handler to the /secure URL.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black">My question is a simple one: How do I access the SAMLResponse in this process? I need to extract the list of attributes for use elsewhere in my application, and I’m green-horned enough
to not understand what I do at this point to actually get to the attributes I’ve just received.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black">Thanks for your help (and for not laughing too hard)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="color:black"><br>
--<br>
To unsubscribe from this list send an email to </span><a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>