<div dir="ltr"><div><font color="#000000" face="Verdana, Geneva, Helvetica, Arial, sans-serif">Hello all,</font></div><div><font color="#000000" face="Verdana, Geneva, Helvetica, Arial, sans-serif"><br></font></div><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    We are using the SSO Authentication using the shibboleth. We are not using the Shibboleth SP. We have our own SP which will prepare the SAML2 AuthnRequest. We are using the &#39;ph:ExternalAuthn&#39; type LoginHandler which has configured in the handler.xml file. According to the ExternalLoginHandler we do few validations and will forward to &#39;login.jsp&#39; page if the user has not authenticated. Once the user has Authenticated then we are doing following things: </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    1) We will update GroupId(UserName) and password into our dataBase where we are using restFul webservices to call our dataBase. </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    2) once we got the response form the dataBase, we will send back the below details to the IDP. Because we are using the ExternalLoginHandler the below mentioned betails has to be send to the IDP </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                              // In the ExternalAuthentication mechanism these attributes are mandatory to be processed by the AuthenticationManager. </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                request.setAttribute(globalStrings.getForceAuthn(), false); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                Principal principal = new UsernamePrincipal(login.getAttributes()); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                Subject subj = new Subject(); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                              /* We are sending the Subject which has to be released by the IDP to the SP. This contains details about the authenticated user info ie.., (GroupId (userName etc) */ </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                subj.getPrincipals().add(principal); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY, groupId); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                request.setAttribute(LoginHandler.SUBJECT_KEY, subj); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                request.setAttribute(globalStrings.getAuthnMethod(), this.authenticationMethod); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                AuthenticationEngine.returnToAuthenticationEngine(request, response); </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">       - To release the principal-name to the SP we have configured the attribute-resolver.xml and attribute-filer.xml </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                  attribute-resolver.xml </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">&lt;resolver:AttributeDefinition id=&quot;principal&quot; xsi:type=&quot;PrincipalName&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot;&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">   &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; /&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                &lt;resolver:AttributeEncoder xsi:type=&quot;SAML2Base64&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot; </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                name=&quot;SRDM_ATTRIBUTE_64&quot; /&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">  &lt;resolver:AttributeEncoder xsi:type=&quot;SAML2String&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot; </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                                name=&quot;SRDM_ATTRIBUTE&quot; /&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">&lt;/resolver:AttributeDefinition&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                  attribute-filer.xml: </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    &lt;afp:AttributeFilterPolicy id=&quot;releaseBasicAttributesToAnyone&quot;&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">        &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:ANY&quot;/&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">        &lt;afp:AttributeRule attributeID=&quot;principal&quot;&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">                &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">        &lt;/afp:AttributeRule&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">    &lt;/afp:AttributeFilterPolicy&gt;</span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">     - So because we have configured the IDP in the above way, the IDP is releasing the principal name of the user as a single-valued attribute to the SP. </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">Now, I would like to put the authorization mechanism. So, please answer my below mentioned questions: </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">i) What is the best way to get the authorization details of the authenticated user? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">     - Shell I call my dataBase to get the authorization details after the step 1 which has mentioned above? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">     - Shell I use the resolver:DataConnector which internally call the dataBase? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">          If this is the case, We are using neither the RelationalDataBase nor the LDAP. We are using the restFul calls to connect to our dataBase. How to do the restFul call&#39;s at the IDP using the resolver:DataConnector? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">ii) What is the best way to release the authorization details of the authenticated user to the Service Provider? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">   - Shell I add the authorization details as a Principal into the Subject? Is it a best approach?. Will it work? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">   - Shell I use the resolver:AttributeDefinition and resolver:DataConnector to release the attributes to the Service Provider(SP). If so, how to use the restFul call&#39;s to get the details? </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">If there is any other mechanism, please provide a sample which will suit our usecase. </span><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><span style="font-size:13px;color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">Please help me because I don&#39;t have any source or support to move further. Till the Authentication it has been developed by other person who is not there.</span><br style="font-size:13px"><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br></span></div><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br></span></div><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br></span></div><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif"><br></span></div><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">Thanks &amp; Regards</span></div><div style="font-size:13px"><span style="color:rgb(0,0,0);font-family:Verdana,Geneva,Helvetica,Arial,sans-serif">Sarath U</span></div></div>