<div dir="ltr"><div>Hello Eric, thank you for your effort putting to answer my question.</div><div><br></div><div><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">1)<span style="font-stretch:normal;font-size:7pt;font-family:'Times New Roman'"> </span></span><u style="font-size:12.8000001907349px"></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">What data elements does the SP need from the IdP describing the logged in user?</span><br></div><div>Ans: My answer is yes, I know what data i want to get at SP side, here i want to get the permissions of the logged in user to decide for which modules loggedin user has permissions.</div><div> - Right now, i am only getting the 'Principal' at SP side, which contains information about the user(email, acctType) etc. As per my understanding i am getting the principle because of below code:</div><div><br></div><div>step:1) after authenticating against database when request goes from login.jsp: </div><div> ===============================================</div><div> The request is going to IDP(AuthenticationEngine) along with the principal</div><div> request.setAttribute(globalStrings.getForceAuthn(), false);</div><div><span class="" style="white-space:pre"> </span>Principal principal = new UsernamePrincipal(login.getAttributes());</div><div><span class="" style="white-space:pre"> </span>Subject subj = new Subject();</div><div><span class="" style="white-space:pre"> </span>subj.getPrincipals().add(principal);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.SUBJECT_KEY, subj);</div><div><span class="" style="white-space:pre"> </span>request.setAttribute(globalStrings.getAuthnMethod(), this.authenticationMethod);</div><div><span class="" style="white-space:pre"> </span>AuthenticationEngine.returnToAuthenticationEngine(request, response);</div><div> </div><div class="gmail_extra">step-2):</div><div class="gmail_extra">To release the attributes at SP side, i configured the attribute-resolver, attribute-filter like below:</div><div class="gmail_extra">====================================================================</div><div class="gmail_extra"><div class="gmail_extra"><b>attribute-resolver.xml:</b></div><div class="gmail_extra"><br></div><div class="gmail_extra"><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"></div><div class="gmail_extra"><br></div><div class="gmail_extra"> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /></div><div class="gmail_extra"> </div><div class="gmail_extra"><span class="" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML2Base64" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div class="gmail_extra"> name="ORG_ATTRIBUTE_64" /></div><div class="gmail_extra"> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</div><div class="gmail_extra"> name="ORG_ATTRIBUTE" /></div><div class="gmail_extra"><b>attribute-filter.xml:</b><br></div><div class="gmail_extra"><div class="gmail_extra"><afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone"></div><div class="gmail_extra"> <afp:PolicyRequirementRule xsi:type="basic:ANY"/></div><div class="gmail_extra"> <afp:AttributeRule attributeID="principal"></div><div class="gmail_extra"> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div class="gmail_extra"> </afp:AttributeRule></div><div class="gmail_extra"> </afp:AttributeFilterPolicy></div><div class="gmail_extra"><br></div><div class="gmail_extra">Because of above two steps i am getting the principal at SP side(SAMLResponse)</div><div class="gmail_extra"><b>Please correct me if i am wrong.</b></div><div class="gmail_extra"><br></div><div class="gmail_extra">if i am correct, Like this can we get the permissions of the user, Please give me an example to get the permissions of the user at SP side in saml response.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">2)<span style="font-stretch:normal;font-size:7pt;font-family:'Times New Roman'"> </span></span><u style="font-size:12.8000001907349px"></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">What data source contains this attribute?</span><br></div><div class="gmail_extra"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">- Here the only source is our database for every information, I can get the info from database by sending request with proper url.</span></div><div class="gmail_extra"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><br></span></div><div class="gmail_extra"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><br></span></div><div class="gmail_extra"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Please provide me some example with xml configuration, So that i can easily handle my task. </span></div></div><div class="gmail_extra"><br></div><div class="gmail_extra">Thank you.</div><div class="gmail_extra"><br></div></div><div class="gmail_extra"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 4, 2014 at 1:29 AM, Eric Goodman <span dir="ltr"><<a href="mailto:Eric.Goodman@ucop.edu" target="_blank">Eric.Goodman@ucop.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I’ll add in my own attempt at explaining as well. You seem to be thinking that you have to do something much more complicated than what is actually necessary,
so may be overlooking the specific advice because it seems “too easy”. In particular, there is no need for custom coding in the IdP to do any of the things you are asking about.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">What you need to do is answer these questions:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><span>1)<span style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">What data elements does the SP need from the IdP describing the logged in user?<u></u><u></u></span></p>
<p style="margin-left:1in">
<u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><span>a.<span style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">This tells you what attributes need to be defined (in attribute-resolver.xml)<u></u><u></u></span></p>
<p style="margin-left:1in">
<u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><span>b.<span style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">It also tells you what attributes need to be released to each SP (in attribute-filter.xml)</span> </p></div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p style="margin-left:1in"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><span>2)<span style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">What data source contains this attribute?<u></u><u></u></span></p>
<p style="margin-left:1in">
<u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><span>a.<span style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7pt;line-height:normal;font-family:'Times New Roman'">
</span></span></span><u></u><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">This tells you what data connectors you need defined (again in attribute-resolver.xml). Usually the data connector will already exist, but if you
need data from a second “server”, you may need to create an additional one.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">That’s it on the IdP side. There’s literally nothing else to do. No custom programming, no additional SAMLRequests. None of the code you’ve posted is relevant
to your question of “What should the IdP do?” because your question has been answered.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">When you configure the above settings, the AuthnResponse you get from the IdP will have the user principle AND all necessary attributes in it.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">As other people have pointed out, nothing the IdP is doing is directly authorization. The IdP is providing information used for authorization, but it doesn’t
do any (and shouldn’t do any) actual authorization itself. The IdP releases the attributes to the SP, and then it is done. The SP is then responsible for receiving and validating these attributes and handing them off to the application. The application then
uses the values of the attributes to determine what authorization the user should have. The only step where granular authorization is actually happening is within the application. The IdP and the SP are simply passing along attributes.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Because you’ve stated you’re writing your own SP, any questions about “how does the SP do this?” are beyond the scope of this list.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">--- Eric<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div style="border-style:solid none none;border-top-color:rgb(181,196,223);border-top-width:1pt;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10pt;font-family:Tahoma,sans-serif">From:</span></b><span style="font-size:10pt;font-family:Tahoma,sans-serif"> <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Surinaidu Majji<br>
<b>Sent:</b> Tuesday, December 02, 2014 10:44 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Better approach to do Authorization in shibboleth<u></u><u></u></span></p>
</div><div><div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hello Paul,<u></u><u></u></p>
<div>
<p class="MsoNormal">I am really very happy that i am getting lot of information from the Shib Users like you, but i do not know why i am not able to get the exact information which i required. I think i got the replies for my query but i could able to understand
properly.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Here my actual requirement is:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Now i am using shibboleth idp which we own(External Idp) to do authentication. Here i use 'ExternalAuthn' Login handler in handler.xml. Now the authentication is done by checking the credentials(from login.jsp) with our
<b>Server(database)</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">- The current requirement is like instead of using our <b>Server
</b>to validate credentials(from login.jsp), i have to link this external idp to <b>
other Server (database).</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">That's why i wanted know about authorization for my application, but i could not able to achieve it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Please consider my request, because i do not have any other source to get my requirement done, If require i will post my entire authentication procedural steps which i have right now in my existing application.<b> </b><u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, Dec 2, 2014 at 7:33 PM, Paul Hethmon <<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a>> wrote:<u></u><u></u></p>
<div>
<p class="MsoNormal">On Dec 2, 2014, at 6:59 AM, Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com" target="_blank">pioneer.suri@gmail.com</a>> wrote:<u></u><u></u></p>
<div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica,sans-serif">Thank you for your reply, but you are saying attributes pulled from resolver:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica,sans-serif">Is that attribute-resolver.xml, configured for releasing attributes, in that case<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Helvetica,sans-serif">i am releasing 'principal' which contains 'permissions' to SP. Is that right?<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">attribute-resolver.xml defines attributes and the sources to obtain those attributes. That includes the “principal” and anything else you might define.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">attribute-filter.xml defines which SP’s get which attributes released to them.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">None of that is “permissions” in the sense that to the IdP the attributes are opaque values sent to an SP. There is no inherent meaning of those attributes at the IdP level. At the SP level it has to define what those attributes mean.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Paul <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">——<span style="color:rgb(136,136,136)"><br>
<br>
<span>Paul Hethmon</span><br>
<span>Chief Software Architect</span><br>
<span><a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a></span><br>
<br>
</span><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>