<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=NL-BE link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span lang=EN-US>Hi,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>In our Shib IdP 3.4 (java-1.8.0-openjdk-1.8.0.282.b08-1.el7_9.x86_64 ) we repacked the password from the user as an attribute for one special SP. This was done in a scripted attribute:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> <AttributeDefinition id="password" xsi:type="ScriptedAttribute"><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> <AttributeEncoder xsi:type="SAML2String" name="urn:mace:ua.ac.be:dir:attribute-def:password" friendlyName="password" encodeType="false" /><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> <Script><![CDATA[<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> subjectCtx = profileContext.getSubcontext("net.shibboleth.idp.authn.context.SubjectContext");<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> subject = subjectCtx.getSubjects()[0];<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> password.addValue(subject.getPrivateCredentials().toArray()[0].getName());<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> ]]></Script><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> </AttributeDefinition><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>If I would turn on debug and log the subject, subjectCtx.getSubjects()[0], I would get this:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:Password}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthenticationMethodPrincipal{authnMethod=urn:oasis:names:tc:SAML:1.0:am:password}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: [org.ldaptive.jaas.LdapPrincipal@1847202780::<i>.......redacted.......</i> [], responseControls=null, messageId=-1]]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: UsernamePrincipal{username=<i>...redacted....</i>}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> <span style='background:yellow;mso-highlight:yellow'>Private Credential: PasswordPrincipal{password=<elided>}</span><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>So in IdP 4.1 (java-11-openjdk-11.0.10.0.9-4.el8_3.x86_64 ) I can’t access to the password. I did some debugging:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> subjectCtx = profileContext.getSubcontext("net.shibboleth.idp.authn.context.SubjectContext");<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> subject = subjectCtx.getSubjects()[0];<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> logger.info(subject);<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>This returns a very similar thing but the last line is missing. So evidently no access to the PrivateCredentials.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'>INFO [net.shibboleth.idp.attribute:7] - Subject:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthenticationMethodPrincipal{authnMethod=urn:oasis:names:tc:SAML:1.0:am:password}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:Password}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: [org.ldaptive.jaas.LdapPrincipal@1847202780::<i>....redacted.....</i>[], responseControls=null, messageId=2]]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'> Principal: UsernamePrincipal{username=<i>...redacted....</i>}<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Is this something I can re-enable somewhere so I can have access to the PrivateCredentials again? Or is this just no longer an option with Shib 4+<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Thank you<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Vincent Feyaerts<span style='color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%'><o:p></o:p></span></span></p></div></body></html>