<div dir="ltr">Thank you for the reply @Peter, Kindly look into the following flow which i am following...<div>Authentication flow with idp and we are writing our own SP.</div><div>1) The below encodeSamlRequest request is going to Idp like following:</div><div><br></div><div> public Pair<String,String> getSAMLRequest(String spUrl, String consumerUrl) {</div><div><span class="" style="white-space:pre"> </span>AuthnRequest authnRequest = null;</div><div><span class="" style="white-space:pre"> </span>//String encodedSAMLRequest = null;</div><div><span class="" style="white-space:pre"> </span>Pair<String,String> encodedSAMLRequest = null;</div><div><span class="" style="white-space:pre"> </span>try {</div><div><br></div><div><span class="" style="white-space:pre"> </span>authnRequest = this.<b>buildAuthnRequestObject</b>(spUrl, consumerUrl);</div><div><span class="" style="white-space:pre"> </span>Encoder encoder = Encoder.getEncoder();</div><div><span class="" style="white-space:pre"> </span>encodedSAMLRequest = encoder.encodeAuthnRequest(authnRequest);</div><div><span class="" style="white-space:pre"> </span>} catch (MarshallingException e) {</div><div><span class="" style="white-space:pre"> </span>e.printStackTrace();</div><div><span class="" style="white-space:pre"> </span>} catch (IOException e) {</div><div><span class="" style="white-space:pre"> </span>e.printStackTrace();</div><div><span class="" style="white-space:pre"> </span>}</div><div><br></div><div><span class="" style="white-space:pre"> </span>return <b>encodedSAMLRequest</b>;</div><div><span class="" style="white-space:pre"> </span>}</div><div><br></div><div><div>private AuthnRequest buildAuthnRequestObject(String spUrl,</div><div><span class="" style="white-space:pre"> </span>String consumerUrl) {</div><div><span class="" style="white-space:pre"> </span>Issuer issuer = getIssuer();</div><div><span class="" style="white-space:pre"> </span>issuer.setValue(spUrl);</div><div><br></div><div><span class="" style="white-space:pre"> </span>DateTime issueInstant = new org.joda.time.DateTime();</div><div><span class="" style="white-space:pre"> </span>RequestedAuthnContext requestedAuthnContext = getRequestedAuthnContext();</div><div><span class="" style="white-space:pre"> </span>AuthnRequest authRequest = getAuthnRequest(issueInstant, issuer,</div><div><span class="" style="white-space:pre"> </span>consumerUrl, spUrl);</div><div><br></div><div><span class="" style="white-space:pre"> </span>authRequest.setRequestedAuthnContext(requestedAuthnContext);</div><div><span class="" style="white-space:pre"> </span>String systemTime = System.currentTimeMillis() + "";</div><div><span class="" style="white-space:pre"> </span>authRequest.setID("SSOIDSAMLREQ" +systemTime);<span class="" style="white-space:pre"> </span></div><div><span class="" style="white-space:pre"> </span>authRequest.setVersion(SAMLVersion.VERSION_20);</div><div><span class="" style="white-space:pre"> </span>authRequest.setAssertionConsumerServiceIndex(1);</div><div><span class="" style="white-space:pre"> </span>return authRequest;</div><div><span class="" style="white-space:pre"> </span>}</div></div><div><br></div><div>2) First time idp redirects the user to login.jsp by using configuration which is in the <b>handler.xml using externalAuth</b></div><div><b><br></b></div><div><div> <ph:LoginHandler xsi:type="ph:ExternalAuthn"</div><div> externalAuthnPath="/external/login"</div><div> supportsForcedAuthentication="true" ></div><div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod></div><div></ph:LoginHandler></div></div><div><b><br></b></div><div><b>--></b>Once it comes to the above mentioned path the user is able to see the <b>login.jsp </b>and user will enter the credentials and submitting to the our server to validate the user. So we will get the boolean variable whether the user is valid or not.</div><div><br></div><div>-> Once we got status from our server we are preparing the request and response like following which is to be send it to the idp again(AuthenticationEngine.returnToAuthenticationEngine(req,resp)).</div><div><b><br></b></div><div>request.setAttribute(globalStrings.getForceAuthn(), false);</div><div><span class="" style="white-space:pre"> </span>Principal principal = new UsernamePrincipal(<b>login.getAttributes()</b>);</div><div><span class="" style="white-space:pre"> </span>Subject subj = new Subject();</div><div><span class="" style="white-space:pre"> </span>subj.getPrincipals().add(principal);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.SUBJECT_KEY, subj);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(globalStrings.getAuthnMethod(), this.authenticationMethod);</div><div><span class="" style="white-space:pre"> </span>AuthenticationEngine.returnToAuthenticationEngine(request, response);</div><div><br></div><div>3) We mention in the attribute-resolver and attribute-filter for the attributes to be released to the SP like below</div><div><br></div><div><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"></div><div><br></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /></div><div> </div><div><span class="" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML2Base64" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div> name="ORG_ATTRIBUTE_64" /></div><div> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div> name="ORG_ATTRIBUTE" /></div><div></resolver:AttributeDefinition> </div><div><br></div><div>4) So will get the released required attributes from the SP(SAML response) and do further processing.</div><div><br></div><div>The above is the authentication process we are following for our application, Now we wanted to do the <b>authorization, </b>So i need two clarifications here.</div><div>i) Do i need to prepare one more samlRequest like SAML Authorization Decision statement to send for idp again after authentication is done.</div><div><br></div><div>or</div><div><br></div><div>ii) As i mentioned in the step(2), Shall i get the authorization permission from our server and put it in the(<b>login.getAttributes()</b>) which is in the UserPrinciple(), to get it at the SP side and use the permissions to give the access to the user. </div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Nov 28, 2014 at 6:10 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com">pioneer.suri@gmail.com</a>> [2014-11-28 13:30]:<br>
<span class="">> So Please tell me, how to deal with attribute-resolver.xml to add<br>
> our permissions for authorization.<br>
<br>
</span>You add whatever data you (i.e., the SP) needs to perform access<br>
control, same as with any existing attributes.<br>
E.g. if the SP requires a subject to have a specific affiliation, you<br>
add the affiliation attribute definition to your resolver (and either<br>
lookup the info from some system the IDP has access to, or generate<br>
the value in the IDP on-the-fly).<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>