<div dir="ltr">Thank you peter, <div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">"I don't understand what that means. You release attributes from the</span><br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px">IDP as per the documentation." </span><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">As per your comment above i think i did not provide proper information, </span></div><div><br></div><div><font face="arial, sans-serif">-> We have 2 applications which are working with Shibboleth, Here My understanding is about authorization is that</font></div><div><font face="arial, sans-serif">the some users can have permission for accessing only one application or only some features they can access</font></div><div><font face="arial, sans-serif">from the applications. </font></div><div><font face="arial, sans-serif">-> So here we are getting the permissions from our server and send it to the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp); by setting the permissions in the request as an attribute.</font></div><div><font face="arial, sans-serif">like below:</font></div><div><pre><code>"login.getAttributes()" contains the response from our server which we got after submitting the credentials(login.jsp) to our server. </code><span style="font-family:arial">login.getAttributes() contains 'emailId', 'username' but now i want to include the permissions which i could get from our server in the </span><span style="font-family:arial">login.getAttributes().</span></pre></div><pre><code> Principal principal = new UsernamePrincipal(login.getAttributes());
Subject subj = new Subject();
subj.getPrincipals().add(principal);
request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId); </code></pre><div> request.setAttribute(LoginHandler.SUBJECT_KEY, subj);<font face="arial, sans-serif"> </font></div><div><font face="arial, sans-serif">So the user perms are in </font>Principal principal = new UsernamePrincipal(login.getAttributes()); which is an attribute in the request which we are sending to the authenticationEngine. So i know i can configure attribute-resolver, attribute-filter to release the 'principal' when in saml response comes from the shibboleth idp. So i will get the permissions from the saml response and use that perms to allow the user to access aprticular modules based on perms.</div><div><span style="font-family:arial,sans-serif"><br></span></div><div><span style="font-family:arial,sans-serif">Please tell me if my approach is wrong. </span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 1, 2014 at 3:54 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com">pioneer.suri@gmail.com</a>> [2014-12-01 06:18]:<br>
<span class="">> Thank you for the reply @Peter, Kindly look into the following flow which i<br>
> am following...<br>
> Authentication flow with idp and we are writing our own SP.<br>
<br>
</span>I don't understand most of what you write but I think none of the<br>
things you sent have anything to do with your question.<br>
<br>
How you release attributes from the IDP is documented here:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute</a><br>
<br>
The SP can do whatever it wants with those attributes, including base<br>
access control decisions on the recieved attribute values.<br>
How you do that is not a matter for this list, which is about the<br>
Shibboleth software.<br>
<span class=""><br>
> The above is the authentication process we are following for our<br>
</span>> application, Now we wanted to do the *authorization, *So i need two<br>
<span class="">> clarifications here.<br>
> i) Do i need to prepare one more samlRequest like SAML Authorization<br>
> Decision statement to send for idp again after authentication is done.<br>
<br>
</span>No.<br>
<span class=""><br>
> or<br>
><br>
> ii) As i mentioned in the step(2), Shall i get the authorization permission<br>
</span>> from our server and put it in the(*login.getAttributes()*) which is in the<br>
<span class="">> UserPrinciple(), to get it at the SP side and use the permissions to give<br>
> the access to the user.<br>
<br>
</span>I don't understand what that means. You release attributes from the<br>
IDP as per the documentation.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>