shibboleth idp get user attributes

Question

I am making a plugin (in JAVA) for shibboleth idp. In the plugin, I need to get the user's attributes if the user is authenticated. I use a Filter (pattern /profile/*) to process the request, but none of the user attributes is stored in the request's attributes or header, how could I retrieve the user's attributes in Java code if the user is authenticated?

Answer 1

You have to open your AJP port in your application server. Attributes will be sent out to only those pages where AJP is enables. (you may want to add attributePrefix="AJP_" to your conf file.)

You need to add following to your proxy server (considering AJP port is open on 8009)

ProxyPass /profile/* ajp://localhost:8009/profile/*

Even if this is done, shibboleth parameters won't display directly under parameters.keySet() . But if you do parameters.get(key) then it will return some value sent by shib.

Above behaviour may vary for different servers; ie you may need to get values by parameters.get("AJP_"+key) . PS check in both header and request object.