<div dir="ltr">Thank you again for your patience and valuable time.<div>As you said i configured (ph:ExternalAuth='external/login')(which indicates path to servlet) in handler.xml. This path is taking the user to login.jsp and user will enter credentials.</div><div>- The login.jsp will send it to our server to check credentials with the database. Server will give a response saying that the user is valid or invalid. This is the thing happening at handler.xml(which i am calling as an authentication).</div><div><br></div><div>Yes Authorization should be done at SP side. In my case Authorization is permissions of the logged in user, that's why i want to get the permissions of the user when login.jsp(username,pwd) is submitting to our server.So that i can use those permissions to do authorization. </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 1, 2014 at 5:02 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com">pioneer.suri@gmail.com</a>> [2014-12-01 12:14]:<br>
<span class="">> -> So here we are getting the permissions from our server and send it to<br>
> the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp); by<br>
> setting the permissions in the request as an attribute.<br>
<br>
</span>OK, I'm beginning to see what you keep going on about the external<br>
authentication login handler, that's where you're intending to perform<br>
authorization? If that's so, don't do that, this is meant to<br>
exernalize /authentication/ from the IDP. Authorization should be<br>
handled at the SP, based on attributes released by the IDP.<br>
The indended way to get the needed information into the IDP is via the<br>
attribute resolver (and release it in the filter), not from the<br>
login handler. Same as for any other attribute.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>