<div dir="ltr">Thank you @Peter,<div>As you said, to release the attributes, we are defining them in the attribute-resolver without having Data Connector(for principle), that's why, we are getting the data(Principal data) at SP side. but before that we are querying our database by sending the <a href="http://log.in">log.in</a> jsp credentials and getting the response and sending them to the Authenticationengine. </div><div><br></div><div><span style="font-size:12.8000001907349px">The indended way to get the needed information into the IDP is via the</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">attribute resolver (and release it in the filter), not from the</span><br style="font-size:12.8000001907349px"><span style="font-size:12.8000001907349px">login handler.</span><br></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px">So from the above req.setAttribute(LoginHandler.Principla, attributes);</span></div><div><span style="font-size:12.8000001907349px">is going to the IDP again, Is it not like getting the attributes through IDP?</span></div><div><span style="font-size:12.8000001907349px"><br></span></div><div><span style="font-size:12.8000001907349px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 1, 2014 at 5:02 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Surinaidu Majji <<a href="mailto:pioneer.suri@gmail.com">pioneer.suri@gmail.com</a>> [2014-12-01 12:14]:<br>
<span class="">> -> So here we are getting the permissions from our server and send it to<br>
> the idp by AuthenticationEngine.returnToAuthenticationEngine(req,resp); by<br>
> setting the permissions in the request as an attribute.<br>
<br>
</span>OK, I'm beginning to see what you keep going on about the external<br>
authentication login handler, that's where you're intending to perform<br>
authorization? If that's so, don't do that, this is meant to<br>
exernalize /authentication/ from the IDP. Authorization should be<br>
handled at the SP, based on attributes released by the IDP.<br>
The indended way to get the needed information into the IDP is via the<br>
attribute resolver (and release it in the filter), not from the<br>
login handler. Same as for any other attribute.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>