<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>They are passed to the protected resource in the response header collection...</span></div><div><br></div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Jim Hoy <jim.hoy@acatar.com><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, May 31, 2013 11:15 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> RE: Capturing SAML Attributes from the IDP<br> </font> </div> <div class="y_msg_container"><br><div id="yiv6855065806">
<style><!--
#yiv6855065806
_filtered #yiv6855065806 {font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered #yiv6855065806 {font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
#yiv6855065806
#yiv6855065806 p.yiv6855065806MsoNormal, #yiv6855065806 li.yiv6855065806MsoNormal, #yiv6855065806 div.yiv6855065806MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman", "serif";}
#yiv6855065806 a:link, #yiv6855065806 span.yiv6855065806MsoHyperlink
{
color:blue;
text-decoration:underline;}
#yiv6855065806 a:visited, #yiv6855065806 span.yiv6855065806MsoHyperlinkFollowed
{
color:purple;
text-decoration:underline;}
#yiv6855065806 p.yiv6855065806msolistparagraph, #yiv6855065806 li.yiv6855065806msolistparagraph, #yiv6855065806 div.yiv6855065806msolistparagraph
{
margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman", "serif";}
#yiv6855065806 p.yiv6855065806msonormal, #yiv6855065806 li.yiv6855065806msonormal, #yiv6855065806 div.yiv6855065806msonormal
{
margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman", "serif";}
#yiv6855065806 p.yiv6855065806msochpdefault, #yiv6855065806 li.yiv6855065806msochpdefault, #yiv6855065806 div.yiv6855065806msochpdefault
{
margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman", "serif";}
#yiv6855065806 p.yiv6855065806msonormal1, #yiv6855065806 li.yiv6855065806msonormal1, #yiv6855065806 div.yiv6855065806msonormal1
{
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri", "sans-serif";}
#yiv6855065806 p.yiv6855065806msolistparagraph1, #yiv6855065806 li.yiv6855065806msolistparagraph1, #yiv6855065806 div.yiv6855065806msolistparagraph1
{
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri", "sans-serif";}
#yiv6855065806 p.yiv6855065806msochpdefault1, #yiv6855065806 li.yiv6855065806msochpdefault1, #yiv6855065806 div.yiv6855065806msochpdefault1
{
margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri", "sans-serif";}
#yiv6855065806 span.yiv6855065806msohyperlink
{}
#yiv6855065806 span.yiv6855065806msohyperlinkfollowed
{}
#yiv6855065806 span.yiv6855065806emailstyle17
{}
#yiv6855065806 span.yiv6855065806msohyperlink1
{
color:#0563C1;
text-decoration:underline;}
#yiv6855065806 span.yiv6855065806msohyperlinkfollowed1
{
color:#954F72;
text-decoration:underline;}
#yiv6855065806 span.yiv6855065806emailstyle171
{
font-family:"Calibri", "sans-serif";
color:windowtext;}
#yiv6855065806 span.yiv6855065806EmailStyle29
{
font-family:"Calibri", "sans-serif";
color:#1F497D;}
#yiv6855065806 .yiv6855065806MsoChpDefault
{
font-size:10.0pt;}
_filtered #yiv6855065806 {
margin:1.0in 1.0in 1.0in 1.0in;}
#yiv6855065806 div.yiv6855065806WordSection1
{}
--></style>
<div>
<div class="yiv6855065806WordSection1">
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;">In the response there is a base-64 encoded POST variable called SAMLResponse. I’m looking at the XML which begins with tag <saml2p:Response…></span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"> </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;">In this response I see tags like:</span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"> </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"><saml2:Attribute FriendlyName=”XYZ” Name=”…..”><br>
<saml2:AttributeValue>THE_VALUE</saml2:AttributeValue></span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"></saml2:Attribute></span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"> </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;">These Friendly names are eduPersonScopeAffiliation, eduPersonTargetID, etc… but there are also institution-specific attributes like ‘xyzUserID’ or xyzHousingLocation
or the like… </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"> </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;">I need to get a collection of all of these values… If not during the login procedure as defined previously, then at some point after the redirection completes.</span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:black;"> </span></div>
<div class="yiv6855065806MsoNormal"><span style="font-size:11.0pt;color:#1F497D;"> </span></div>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in;">
<div class="yiv6855065806MsoNormal"><b><span style="font-size:11.0pt;">From:</span></b><span style="font-size:11.0pt;"> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Mike Flynn<br>
<b>Sent:</b> Friday, May 31, 2013 1:39 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Capturing SAML Attributes from the IDP</span></div>
</div>
</div>
<div class="yiv6855065806MsoNormal"> </div>
<div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">Your page at the protected resource can interrogate the response headers for the attributes and some other Shib parameters. Are you looking to get the
actual assertion itself to examine it? If so you can turn on debugging in the logger config files and get the assertions in the logs.</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div>
<div>
<div class="yiv6855065806MsoNormal" align="center" style="text-align:center;background:white;">
<span style="color:black;">
<hr size="1" width="100%" align="center">
</span></div>
<div class="yiv6855065806MsoNormal" style="background:white;"><b><span style="font-size:10.0pt;color:black;">From:</span></b><span style="font-size:10.0pt;color:black;"> Jim Hoy <</span><a rel="nofollow" ymailto="mailto:jim.hoy@acatar.com" target="_blank" href="mailto:jim.hoy@acatar.com"><span style="font-size:10.0pt;">jim.hoy@acatar.com</span></a><span style="font-size:10.0pt;color:black;">><br>
<b>To:</b> "</span><a rel="nofollow" ymailto="mailto:users@shibboleth.net" target="_blank" href="mailto:users@shibboleth.net"><span style="font-size:10.0pt;">users@shibboleth.net</span></a><span style="font-size:10.0pt;color:black;">" <</span><a rel="nofollow" ymailto="mailto:users@shibboleth.net" target="_blank" href="mailto:users@shibboleth.net"><span style="font-size:10.0pt;">users@shibboleth.net</span></a><span style="font-size:10.0pt;color:black;">>
<br>
<b>Sent:</b> Friday, May 31, 2013 10:21 AM<br>
<b>Subject:</b> Capturing SAML Attributes from the IDP</span><span style="color:black;"></span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
<div id="yiv6855065806">
<div>
<div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">I suppose this is a lifecycle issue, and please excuse the question if it’s stupid one, but… As I see it, the process goes like this:</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="color:black;">1.</span><span style="font-size:7.0pt;color:black;">
</span><span style="color:black;">User requests a Shib-protected resource. </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="color:black;">2.</span><span style="font-size:7.0pt;color:black;">
</span><span style="color:black;">The Shibboleth ISAPI filter (as this is Windows/IIS) intercepts the request and directs the user to the IDP (only one IDP here)</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="color:black;">3.</span><span style="font-size:7.0pt;color:black;">
</span><span style="color:black;">The user logs in successfully</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="color:black;">4.</span><span style="font-size:7.0pt;color:black;">
</span><span style="color:black;">The browser is redirected (HTTP 302) back to /Shibboleth.sso/SAML2/POST</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">5.</span><span style="font-size:7.0pt;color:black;">
</span><span style="color:black;">The ISAPI filter does another 302 redirection to my secured content (/secure), which is now available to the authenticated user.</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">At step #4, I look at the HTTP request and see that there are form variables posted to the HTTP-POST handler (Shibboleth.sso/SAML2/POST). The form variables includes one called SAMLResponse
which is the base 64-encoded SAML XML. This information is apparently discarded when the 302 redirect happens from the HTTP-POST handler to the /secure URL.</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">My question is a simple one: How do I access the SAMLResponse in this process? I need to extract the list of attributes for use elsewhere in my application, and I’m green-horned enough
to not understand what I do at this point to actually get to the attributes I’ve just received.</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;">Thanks for your help (and for not laughing too hard)</span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
<div>
<div class="yiv6855065806MsoNormal" style="background:white;"><span style="color:black;"> </span></div>
</div>
</div>
</div>
</div>
<div class="yiv6855065806MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="color:black;"><br>
--<br>
To unsubscribe from this list send an email to </span><a rel="nofollow" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><span style="color:black;"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br></div> </div> </div> </div></body></html>