<div dir="ltr">Hello @Andrew Morgan, Thanks a lot for your support.Definitely i will ask questions to get clarification.<div>Once an authentication is done, i will get the necessary attributes from SAMLResponse through attribute-resolver,attribute-filter.xml. So i can get my necessary user permissions by querying our database through Data Connector.</div><div><br></div><div>But my doubt is how could i get the Principal(includes email, acctype) without querying database, I think this is because of that we are sending </div><div>req.setAttribute(LoginHandler.Principal_Key, login.getAttributes()); to</div><div>AuthenticationEngine.returnToAuthenticationengine(req,resp);</div><div><br></div><div>By sending the login.getAttributes() as principal to the AuthenticationEngine, we are able to get those in response by giving defining the 'xsi:type="PrincipalName' id="principal" in the attribute-resolver.xml.</div><div><br></div><div>am i correct? Please let me know if i am wrong?</div><div><br></div><div>Sorry for asking this question, because i am new to my existing project, this one is implemented by some other person(he is not here now). </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 5, 2014 at 12:01 AM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Thu, 4 Dec 2014, Surinaidu Majji wrote:<br>
<br>
> Thank you very much @Andy for your reply after looking into my query deeply.<br>
> I got better understanding about shibboleth flow when i saw your reply.<br>
><br>
> The Shibboleth IDP performs authentication via a variety of methods.<br>
> ->Here i am using 'ExternalAuth' in which it goes to the my custom Url to<br>
> make further processing.<br>
><br>
> If you want to change the login.jsp script to<br>
> validate credentials against a different database, you can do that.<br>
> -> Yes I can do that and here i am thinking that only to deal with one<br>
> login.jsp for both the databases, any way that depends on my design.<br>
><br>
> After authentication is successful, the Shibboleth IDP will attempt to<br>
> resolve attributes (find more information about) the principal returned by<br>
> the authentication step<br>
> - since i am using 'ExternalAuth', and i am not using any 'UserName'<br>
> particularly<br>
> i am writing the code which is according to the shibboleth website for<br>
> externalAuth(use subject to get control over principal)<br>
><br>
> This code is written after authentication is successful against my database.<br>
> request.setAttribute(globalStrings.getForceAuthn(), false);<br>
> Principal principal = new UsernamePrincipal(login.getAttributes());<br>
> Subject subj = new Subject();<br>
> subj.getPrincipals().add(principal);<br>
> request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);<br>
> request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, personId);<br>
> request.setAttribute(LoginHandler.SUBJECT_KEY, subj);<br>
> request.setAttribute(globalStrings.getAuthnMethod(),<br>
> this.authenticationMethod);<br>
> AuthenticationEngine.returnToAuthenticationEngine(request, response);<br>
<br>
</div></div>It is my understanding that the attributes released by the IDP *only* come<br>
from the attribute resolution step. I don't think attributes can be added<br>
by the external auth handler. It should be using the "principal" as the<br>
key to lookup additional attributes in your Data Connector.<br>
<div><div class="h5"><br>
> The attribute resolution is configured in attribute-resolver.xml.<br>
> - The below is my attribute-resolver.xml to resolve the attributes, please<br>
> look into it.<br>
><br>
> <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"<br>
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"><br>
><br>
> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /><br>
><br>
> <resolver:AttributeEncoder xsi:type="SAML2Base64"<br>
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
> name="ORG_ATTRIBUTE_64" /><br>
> <resolver:AttributeEncoder xsi:type="SAML2String"<br>
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
> name="ORG_ATTRIBUTE" /><br>
> for the above, there is no "dataconnector" is used.<br>
><br>
> attribute-filter.xml:<br>
><br>
> <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone"><br>
> <afp:PolicyRequirementRule xsi:type="basic:ANY"/><br>
> <afp:AttributeRule attributeID="principal"><br>
> <afp:PermitValueRule xsi:type="basic:ANY" /><br>
> </afp:AttributeRule><br>
> </afp:AttributeFilterPolicy><br>
><br>
> So that i could be able to get the above principal(email, acctType etc) at<br>
> SP side in 'SAMLResponse'.<br>
><br>
><br>
> Common places to lookup additional information are a database or LDAP.<br>
> - Here completely i am using our database, So there is no point of LDAP,<br>
> you are saying additional information, can it be 'permissions of the<br>
> user' which is from<br>
> our database?<br>
> - here how can get the required 'permission info'(authorization) from our<br>
> database,<br>
> - How to write it in the attribute-resolver.xml by using DataConnectors to<br>
> get the perms of user.<br>
> Please provide me some example for configuration which i can get the<br>
> 'permissions of user'.<br>
<br>
</div></div>The distributed attribute-resolver.xml file has an example database Data<br>
Connector:<br>
<br>
<!-- Example Relational Database Connector --><br>
<!--<br>
<resolver:DataConnector id="mySIS" xsi:type="dc:RelationalDatabase"><br>
<dc:ApplicationManagedConnection jdbcDriver="oracle.jdbc.driver.OracleDriver"<br>
jdbcURL="jdbc:oracle:thin:@db.example.org:1521:SomeDB"<br>
jdbcUserName="myid"<br>
jdbcPassword="mypassword" /><br>
<dc:QueryTemplate><br>
<![CDATA[<br>
SELECT * FROM student WHERE gzbtpid = '$requestContext.principalName'<br>
]]><br>
</dc:QueryTemplate><br>
<br>
<dc:Column columnName="gzbtpid" attributeID="uid" /><br>
<dc:Column columnName="fqlft" attributeID="gpa" type="Float" /><br>
</resolver:DataConnector><br>
--><br>
<br>
I use LDAP here, but this looks pretty easy to me. Enter your connection<br>
string, a SQL query, and column-to-attributeID mapping.<br>
<span class=""><br>
> After attribute resolution is complete, the Shibboleth IDP will filter<br>
> those attributes according to the configuration in attribute-filter.xml.<br>
> Only the attributes you configure will be released to the SP.<br>
><br>
> The SP can then use those attributes to making authorization decisions.<br>
> - > Yes, if i can do configuration in attribute-resolver and<br>
> attribute-filter.xml, i can use at SP side<br>
> from SAMLResponse.<br>
> If you can provide me answers for my above questions, i think i can<br>
> complete my task.<br>
<br>
</span>Keep asking questions, we'll keep trying to answer them. :)<br>
<div class="HOEnZb"><div class="h5"><br>
Andy<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>