<div dir="ltr"><div>we want to do authorization for our application.</div><div>Kindly look into the following flow which i am following...</div><div>Authentication flow with idp and we are writing our own SP.</div><div>1) The below encodeSaml request is going to Idp like following:</div><div><br></div><div> </div><div><br></div><div>     public Pair&lt;String,String&gt;  getSAMLRequest(String spUrl, String consumerUrl) {</div><div>    <span class="" style="white-space:pre">                </span>AuthnRequest authnRequest = null;</div><div>    <span class="" style="white-space:pre">                </span>//String encodedSAMLRequest = null;</div><div>    <span class="" style="white-space:pre">                </span>Pair&lt;String,String&gt; encodedSAMLRequest = null;</div><div>    <span class="" style="white-space:pre">                </span>try {</div><div>    </div><div>    <span class="" style="white-space:pre">                        </span>authnRequest = this.buildAuthnRequestObject(spUrl, consumerUrl);</div><div>    <span class="" style="white-space:pre">                        </span>Encoder encoder = Encoder.getEncoder();</div><div>    <span class="" style="white-space:pre">                        </span>encodedSAMLRequest = encoder.encodeAuthnRequest(authnRequest);</div><div>    <span class="" style="white-space:pre">                </span>} catch (MarshallingException e) {</div><div>    <span class="" style="white-space:pre">                        </span>e.printStackTrace();</div><div>    <span class="" style="white-space:pre">                </span>} catch (IOException e) {</div><div>    <span class="" style="white-space:pre">                        </span>e.printStackTrace();</div><div>    <span class="" style="white-space:pre">                </span>}</div><div>    </div><div>    <span class="" style="white-space:pre">                </span>return encodedSAMLRequest;</div><div>    <span class="" style="white-space:pre">        </span>}</div><div>    </div><div>    private AuthnRequest buildAuthnRequestObject(String spUrl,</div><div>    <span class="" style="white-space:pre">                        </span>String consumerUrl) {</div><div>    <span class="" style="white-space:pre">                </span>Issuer issuer = getIssuer();</div><div>    <span class="" style="white-space:pre">                </span>issuer.setValue(spUrl);</div><div>    </div><div>    <span class="" style="white-space:pre">                </span>DateTime issueInstant = new org.joda.time.DateTime();</div><div>    <span class="" style="white-space:pre">                </span>RequestedAuthnContext requestedAuthnContext = getRequestedAuthnContext();</div><div>    <span class="" style="white-space:pre">                </span>AuthnRequest authRequest = getAuthnRequest(issueInstant, issuer,</div><div>    <span class="" style="white-space:pre">                                </span>consumerUrl, spUrl);</div><div>    </div><div>    <span class="" style="white-space:pre">                </span>authRequest.setRequestedAuthnContext(requestedAuthnContext);</div><div>    <span class="" style="white-space:pre">                </span>String systemTime = System.currentTimeMillis() + &quot;&quot;;</div><div>    <span class="" style="white-space:pre">                </span>authRequest.setID(&quot;SSOIDSAMLREQ&quot; +systemTime);<span class="" style="white-space:pre">                                </span></div><div>    <span class="" style="white-space:pre">                </span>authRequest.setVersion(SAMLVersion.VERSION_20);</div><div>    <span class="" style="white-space:pre">                </span>authRequest.setAssertionConsumerServiceIndex(1);</div><div>    <span class="" style="white-space:pre">                </span>return authRequest;</div><div>    <span class="" style="white-space:pre">        </span>}</div><div>    </div><div>    2)  First time idp redirects the user to login.jsp by using configuration which is in the handler.xml using externalAuth</div><div>    </div><div>     &lt;ph:LoginHandler xsi:type=&quot;ph:ExternalAuthn&quot;</div><div>                     externalAuthnPath=&quot;/external/login&quot;</div><div>                     supportsForcedAuthentication=&quot;true&quot; &gt;</div><div>        &lt;ph:AuthenticationMethod&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/ph:AuthenticationMethod&gt;</div><div>    &lt;/ph:LoginHandler&gt;</div><div><br></div><div>--&gt;Once it comes to the above mentioned path the user is able to see the login.jsp and user will enter the credentials and submitting to the our server to validate the user. So we will get the boolean variable whether the user is valid or not.</div><div><br></div><div>-&gt; Once we got status from our server we are preparing the request and response like following which is to be send it to the idp again(AuthenticationEngine.returnToAuthenticationEngine(req,resp)).</div><div><br></div><div>    request.setAttribute(globalStrings.getForceAuthn(), false);</div><div>    <span class="" style="white-space:pre">                                </span>Principal principal = new UsernamePrincipal(login.getAttributes());</div><div>    <span class="" style="white-space:pre">                                </span>Subject subj = new Subject();</div><div>    <span class="" style="white-space:pre">                                </span>subj.getPrincipals().add(principal);</div><div>    <span class="" style="white-space:pre">                                </span>request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);</div><div>    <span class="" style="white-space:pre">                                </span>request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);</div><div>    <span class="" style="white-space:pre">                                </span>request.setAttribute(LoginHandler.SUBJECT_KEY, subj);</div><div>    <span class="" style="white-space:pre">                                </span>request.setAttribute(globalStrings.getAuthnMethod(), this.authenticationMethod);</div><div>    <span class="" style="white-space:pre">                                </span>AuthenticationEngine.returnToAuthenticationEngine(request, response);</div><div>    </div><div>    3) We mention in the attribute-resolver and attribute-filter for the attributes to be released to the SP like below</div><div>    </div><div>    &lt;resolver:AttributeDefinition id=&quot;principal&quot; xsi:type=&quot;PrincipalName&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot;&gt;</div><div>    </div><div>       &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; /&gt;</div><div>        </div><div>    <span class="" style="white-space:pre">                </span>&lt;resolver:AttributeEncoder xsi:type=&quot;SAML2Base64&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot;</div><div>                                    name=&quot;ORG_ATTRIBUTE_64&quot; /&gt;</div><div>      &lt;resolver:AttributeEncoder xsi:type=&quot;SAML2String&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot;</div><div>                                    name=&quot;ORG_ATTRIBUTE&quot; /&gt;</div><div>    &lt;/resolver:AttributeDefinition&gt; </div><div><br></div><div>4) So will get the released required attributes from the SP(SAML response) and do further processing.</div><div><br></div><div>The above is the authentication process we are following for our application, Now we wanted to do the authorization, So i need two clarifications here.</div><div>i) Do i need to prepare one more samlRequest like SAML Authorization Decision statement to send for idp again after authentication is done.</div><div><br></div><div>or</div><div><br></div><div>ii) As i mentioned in the step(2), Shall i get the authorization permission from our server and put it in the(login.getAttributes()) which is in the UserPrinciple(), to get it at the SP side and use the permissions to give the access to the user. </div><div><br></div><div>Important: **Please tell me do we need to use &#39;SAMLAuthorizedDecisionStatement&#39;**, to deal with authorization in Shibboleth idp 2.4.0.</div><div><br></div><div><br></div><div>Thanks &amp; Regards,</div><div>M.Surinaidu</div></div>