Shib SP, how to implement an access control plugin

[Scott Koranda]

> On 12/7/11 1:48 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
> >
> >I would like to better understand what is invovled in
> >implementing an access control plugin. What is the best
> >approach?
> 
> Unfortunately there are no documents on extending the SP because of the
> lack of interest (which is circular but true). The resources that exist
> are basically:
> 
> - the existing code (obviously)
> - using doxygen to generate the API documentation across all three packages
> - a skeleton project for starting an extension library that's checked into
> svn, called cpp-sp-ext

I am being prompted for a password when I attempt to checkout
cpp-sp-ext:

$ svn co https://svn.shibboleth.net/cpp-sp-ext
Authentication realm: <https://svn.shibboleth.net:443> Shibboleth SVN Repository
Password for 'skoranda': 

May I have checkout privileges please?

> 
> The skeleton project is sometimes not up to date in terms of build files,
> but it's a mostly working autoconf project with some bare bones code for
> the mechanics of getting a library loaded. If you're serious about it, I
> can probably find enough time to document at least the mechanics that go
> into a plugin. It's not that much to write up, just not a ten minute
> exercise.

Please do not exert that effort on our account at this time.

The team doing the particular legacy application integration work underway 
that prompted my question is able to use the combination of
Shibboleth (for authentication) and mod_authnz_external (for
authorization) for now. Our testing showed that by using a
combination of

AuthzShibAuthoritative Off
ShibRequireAll On

we can do what we need to do for now.

I am going to personally try and spend some time learning how
to develop a plugin but it is not my highest priority and the
details you have already given me should suffice for some
time.

Thanks,

Scott K