<div dir="ltr">Thank you @Eric, Initially i thought that if i need any attributes at SP side, i have to send them to Authenticationengine.returnToAuthenticationEngine(req,resp); then only i will get that attributes by putting the definition in attribute-resolver, attribute-filter.xml.<div><br></div><div>So here there is no need of sending the attributes to authenticationEngine.(<b>no need</b>)</div><div>we can get the attributes by putting the attributes attribute-resolver, attribute-filter.xml(<b>need</b>)</div><div><br></div><div>So i will try to query our database for user permissions by using Data Connectors in attribute-resolver.xml and filter them in attribute-filter.xml.</div><div><br></div><div>If i am in the right path as i said above, how can we query specifically for particular user permissions from our database. Is there any filter condition to put in the data connector? </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 5, 2014 at 3:43 AM, Eric Goodman <span dir="ltr"><<a href="mailto:Eric.Goodman@ucop.edu" target="_blank">Eric.Goodman@ucop.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<div><span class="">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">1)</span><span style="font-size:7.0pt;color:#1f497d"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">What
data elements does the SP need from the IdP describing the logged in user?</span><u></u><u></u></p>
</div>
</span><div><span class="">
<p class="MsoNormal"><span style="color:#1f497d">></span>Ans: My answer is yes, I know what data i want to get at SP side, here i want to get the permissions
<span style="color:#1f497d"><u></u><u></u></span></p>
</span><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span>of the logged in user to decide for
<span style="color:#1f497d">?</span>which modules loggedin user has permissions.<u></u><u></u></p>
</div><span class="">
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> - Right now, i am only getting the 'Principal' at SP side, which contains information about
<span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span>the user(email, acctType) etc. As per my understanding i am getting the principle because of below code:<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
</div>
</span><div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">You are still telling me about how you get the principal. That was not my question, nor is it relevant to the answer you need. You need to identify the specifica
data elements you need in addition to the principal. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div>
<div><span class="">
<p class="MsoNormal"><span style="color:#1f497d">> </span>step:1) after authenticating against database when request goes from login.jsp: <span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Unless there’s something very esoteric going on, you don’t need to write code to do this. You can do all attribute lookup from the configuration of the attribute-*.xml
files.<u></u><u></u></span></p>
</div><span class="">
<div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">></span>step-2):<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span>To release the attributes at SP side, i configured the attribute-resolver, attribute-filter like below:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span>====================================================================<u></u><u></u></p>
</div>
</span><div><span class="">
<div>
<p class="MsoNormal"><b><span style="color:#1f497d">></span>attribute-resolver.xml:</b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span><resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <resolver:AttributeEncoder xsi:type="SAML2Base64" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> name="ORG_ATTRIBUTE_64" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<u></u><u></u></p>
</div>
</span><div>
<p class="MsoNormal"><span style="color:#1f497d">></span> name="ORG_ATTRIBUTE" /><span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">That’s setting the NameID to the Principal value. You need to define the additional attributes. You haven’t done that.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><b>attribute-filter.xml:</b><u></u><u></u></p>
</div>
<div><span class="">
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span><afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <afp:PolicyRequirementRule xsi:type="basic:ANY"/><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <afp:AttributeRule attributeID="principal"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> <afp:PermitValueRule xsi:type="basic:ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> </afp:AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span> </afp:AttributeFilterPolicy><u></u><u></u></p>
</div>
</span><div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Again, you are only releasing the principal. You haven’t released any additional attributes (nor have you defined them).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div><span class="">
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span>Because of above two steps i am getting the principal at SP side(SAMLResponse)<u></u><u></u></p>
</div>
</span><div><span class="">
<p class="MsoNormal"><b><span style="color:#1f497d">></span>Please correct me if i am wrong.<span style="color:#1f497d"><u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Since you have not defined or released any attributes describing the principal, the IdP can’t release them so the SP doesn’t see them. You need an attribute
definition (in attribute-resolver.xml) and an attribute release (in attribute-filter.xml) for EACH attribute you want sent in addition to the principal. You also need a data connector created (in attribute-resolver.xml) for each database you are querying.
(See Andrew’s message).<u></u><u></u></span></p>
</div><span class="">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1f497d">></span>if i am correct, Like this can we get the permissions of the user, Please give me an example to
<span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span>get the permissions of the user at SP side in saml response.<u></u><u></u></p>
</div>
</span><div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Before you can get the attributes at the SP, the IdP has to send them. You send them by creating the Attribute Definition as described above. Once that’s done,
the attributes will just be there in the assertion.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div><span class="">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">2)</span><span style="font-size:7.0pt;color:#1f497d"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">What
data source contains this attribute?</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">- Here the only source is our database for every information, I can
get the info from database by sending request with proper url.</span><u></u><u></u></p>
</div>
</span><div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">You say there’s a database, but I’m betting you haven’t put the connection information in the attribute-resolver.xml file.<u></u><u></u></span></p>
</div><span class="">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Please provide me some example with xml configuration, So that i can
easily handle my task. </span><u></u><u></u></p>
</div>
</span></div>
<div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">(Some of this repeats what Andrew already sent)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">For the attribute definitions:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverSimpleAttributeDefinition" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverSimpleAttributeDefinition</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">For the database sources (data connectors):<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector" target="_blank">
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute</a> (first example)<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></span></p><span class="HOEnZb"><font color="#888888">
</font></span></div><span class="HOEnZb"><font color="#888888">
</font></span></div><span class="HOEnZb"><font color="#888888">
<div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">--- Eric<u></u><u></u></span></p>
</div>
</font></span></div>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>