Shib SP, how to implement an access control plugin

[Scott Koranda]

> On 12/7/11 1:48 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
> >
> >I would like to better understand what is invovled in
> >implementing an access control plugin. What is the best
> >approach?
> 
> This is more of a dev list topic, I'd direct any follow up there (I would
> myself, but Outlook, etc.)
> 
> Unfortunately there are no documents on extending the SP because of the
> lack of interest (which is circular but true). The resources that exist
> are basically:
> 
> - the existing code (obviously)
> - using doxygen to generate the API documentation across all three packages
> - a skeleton project for starting an extension library that's checked into
> svn, called cpp-sp-ext
> 
> The skeleton project is sometimes not up to date in terms of build files,
> but it's a mostly working autoconf project with some bare bones code for
> the mechanics of getting a library loaded. If you're serious about it, I
> can probably find enough time to document at least the mechanics that go
> into a plugin. It's not that much to write up, just not a ten minute
> exercise.

So I have what appears to be a working access control plugin.
It is the simplest possible plugin--I hardcoded into the
authorized() method

return shib_acl_true;

After configuring shibboleth2.xml to get the plugin loaded and
an appropriate <RequestMapper> I am able to access the
protected content. Recompiling after changing the code to

return shib_acl_false;

(and restarting shibd and Apache httpd) and I am no longer
able to access the content (no warnings or errors in the log
file so I am fairly confident the plugin still loaded and it
is truly the plugin that is denying access).

Since it's fresh for me I am happy to write up a step-by-step
tutorial if it would be helpful. Shall I?

If so where in the wiki would you like it? Or should I write it
in my own space and link it under "Documentation" in

https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions

Thanks,

Scott K

P.S. Linux only. I do not do Windows.