<div dir="ltr">Thank you very much @Andy for your reply after looking into my query deeply.<div>I got better understanding about shibboleth flow when i saw your reply.</div><div> </div><div><span style="font-size:12.8000001907349px">The Shibboleth IDP performs authentication via a variety of methods.</span><br></div><div><span style="font-size:12.8000001907349px">->Here i am using 'ExternalAuth' in which it goes to the my custom Url to make further processing.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">If you want to change the login.jsp script to</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">validate credentials against a different database, you can do that.</span><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">-> Yes I can do that and here i am thinking that only to deal with one login.jsp for both the databases, any way that depends on my design.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">After authentication is successful, the Shibboleth IDP will attempt to</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">resolve attributes (find more information about) the principal returned by</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">the authentication step</span><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">- since i am using 'ExternalAuth', and i am not using any 'UserName' particularly</span></div><div><span style="font-size:12.8000001907349px"> i am writing the code which is according to the shibboleth website for externalAuth(use subject to get control over principal)</span></div><div><span style="font-size:12.8000001907349px"> </span></div><div><span style="font-size:12.8000001907349px">This code is written after authentication is successful against my database.</span></div><div><div style><span style="font-size:12.8000001907349px">request.setAttribute(globalStrings.getForceAuthn(), false);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>Principal principal = new UsernamePrincipal(login.getAttributes());</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>Subject subj = new Subject();</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>subj.getPrincipals().add(principal);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>request.setAttribute(LoginHandler.SUBJECT_KEY, subj);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>request.setAttribute(globalStrings.getAuthnMethod(), this.authenticationMethod);</span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span>AuthenticationEngine.returnToAuthenticationEngine(request, response);</span></div></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"> </span><span style="font-size:12.8000001907349px">The attribute resolution is configured in </span><span style="font-size:12.8000001907349px">attribute-resolver.xml.</span></div><div><span style="font-size:12.8000001907349px">- The below is my attribute-resolver.xml to resolve the attributes, please look into it.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><div style><span style="font-size:12.8000001907349px"><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"></span></div><div style><span style="font-size:12.8000001907349px"><br></span></div><div style><span style="font-size:12.8000001907349px"> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /></span></div><div style><span style="font-size:12.8000001907349px"> </span></div><div style><span style="font-size:12.8000001907349px"><span class="" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML2Base64" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</span></div><div style><span style="font-size:12.8000001907349px"> name="ORG_ATTRIBUTE_64" /></span></div><div style><span style="font-size:12.8000001907349px"> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</span></div><div style><span style="font-size:12.8000001907349px"> name="ORG_ATTRIBUTE" /></span></div></div><div style><span style="font-size:12.8000001907349px">for the above, there is no "dataconnector" is used. </span></div><div style><span style="font-size:12.8000001907349px"><br></span></div><div style><span style="font-size:12.8000001907349px">attribute-filter.xml:</span></div><div style><span style="font-size:12.8000001907349px"><br></span></div><div><afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone"></div><div> <afp:PolicyRequirementRule xsi:type="basic:ANY"/></div><div> <afp:AttributeRule attributeID="principal"></div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div> </afp:AttributeRule></div><div style> </afp:AttributeFilterPolicy><span style="font-size:12.8000001907349px"> </span></div><div style><span style="font-size:12.8000001907349px"><br></span></div><div style><span style="font-size:12.8000001907349px">So that i could be able to get the above principal(email, acctType etc) at SP side in 'SAMLResponse'.</span></div><div style><span style="font-size:12.8000001907349px"><br></span></div><div><br></div><div><span style="font-size:12.8000001907349px">Common places to lookup additional information </span><span style="font-size:12.8000001907349px">are a database or LDAP.</span><br></div><div><span style="font-size:12.8000001907349px">- Here completely i am using our database, So there is no point of LDAP,</span></div><div><span style="font-size:12.8000001907349px"> you are saying additional information, can it be 'permissions of the user' which is from</span></div><div><span style="font-size:12.8000001907349px"> our database?</span></div><div><span style="font-size:12.8000001907349px">- here how can get the required 'permission info'(authorization) from our database,</span></div><div><span style="font-size:12.8000001907349px">- How to write it in the attribute-resolver.xml by using DataConnectors to get the perms of user.</span></div><div><span style="font-size:12.8000001907349px"> Please provide me some example for configuration which i can get the 'permissions of user'.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">After attribute resolution is complete, the Shibboleth IDP will filter</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">those attributes according to the configuration in attribute-filter.xml.</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">Only the attributes you configure will be released to the SP.</span><br style="font-size:12.8000001907349px"><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">The SP can then use those attributes to making authorization decisions.</span><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">- > Yes, if i can do configuration in attribute-resolver and attribute-filter.xml, i can use at SP side</span></div><div><span style="font-size:12.8000001907349px"> from SAMLResponse.</span></div><div><span style="font-size:12.8000001907349px">If you can provide me answers for my above questions, i think i can complete my task.</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">Thank you for patience. </span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 3, 2014 at 11:48 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, 3 Dec 2014, Surinaidu Majji wrote:<br>
<br>
> Hello Paul,<br>
> I am really very happy that i am getting lot of information from the Shib<br>
> Users like you, but i do not know why i am not able to get the exact<br>
> information which i required. I think i got the replies for my query but i<br>
> could able to understand properly.<br>
><br>
> Here my actual requirement is:<br>
> Now i am using shibboleth idp which we own(External Idp) to do<br>
> authentication. Here i use 'ExternalAuthn' Login handler in handler.xml.<br>
> Now the authentication is done by checking the credentials(from login.jsp)<br>
</span>> with our *Server(database)*<br>
><br>
> - The current requirement is like instead of using our *Server *to validate<br>
> credentials(from login.jsp), i have to link this external idp to *other<br>
> Server (database).*<br>
<span class="">> That's why i wanted know about authorization for my application, but i<br>
> could not able to achieve it.<br>
> Please consider my request, because i do not have any other source to<br>
> get my requirement done, If require i will post my entire authentication<br>
> procedural steps which i have right now in my existing application.<br>
<br>
</span>I'm having a little trouble understanding your situation, but hopefully my<br>
answers are relevant.<br>
<br>
The Shibboleth IDP performs authentication via a variety of methods. You<br>
wrote that your existing IDP validates credentials against a database via<br>
a login.jsp script. If you want to change the login.jsp script to<br>
validate credentials against a different database, you can do that.<br>
<br>
After authentication is successful, the Shibboleth IDP will attempt to<br>
resolve attributes (find more information about) the principal returned by<br>
the authentication step (usually a username or other identifier, such as<br>
employee number). The attribute resolution is configured in<br>
attribute-resolver.xml. Common places to lookup additional information<br>
are a database or LDAP. For example, you might lookup the firstname,<br>
lastname, and email address of the principal.<br>
<br>
After attribute resolution is complete, the Shibboleth IDP will filter<br>
those attributes according to the configuration in attribute-filter.xml.<br>
Only the attributes you configure will be released to the SP.<br>
<br>
The SP can then use those attributes to making authorization decisions.<br>
<br>
I hope this helps!<br>
<br>
Andy<br>
<div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>