<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br><div><br><blockquote type="cite"><div>On Oct 29, 2024, at 9:31 AM, Philip Smart via dev <dev@shibboleth.net> wrote:</div><br class="Apple-interchange-newline"><div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Yup, as Scott said, this is all highly configurable based on the usual IdP access control mechanisms. From a plugin perspective, if you did want to change the policy, you can by using the property (once you have defined the new policy):</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"></div></blockquote><br></div><div>An example for other admin endpoints is the following in admin/admin.properties:</div><div><br></div><div><div>#idp.resolvertest.logging = ResolverTest</div><div>idp.resolvertest.accessPolicy = ResolverAccessByAttribute</div><div>idp.resolvertest.authenticated = true</div><div>#idp.resolvertest.nonBrowserSupported = false</div><div>idp.resolvertest.defaultAuthenticationMethods = saml2/https://refeds.org/profile/mfa</div><div>idp.resolvertest.resolveAttributes = true</div><div>#idp.resolvertest.postAuthenticationFlows =</div><div><br></div><div>#idp.mdquery.logging = MetadataQuery</div><div>idp.mdquery.accessPolicy = ResolverAccessByAttribute</div><div>idp.mdquery.authenticated = true</div><div>#idp.mdquery.nonBrowserSupported = false</div><div>idp.mdquery.defaultAuthenticationMethods = saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div>idp.mdquery.resolveAttributes = true</div><div>#idp.mdquery.postAuthenticationFlows =</div></div><div><br></div>and then something like this added into the shibboleth.AccessControlPolicies map in access-control.xml:<div><br></div><div><div> <entry key="ResolverAccessByAttribute"></div><div> <bean parent="shibboleth.PredicateAccessControl"></div><div> <constructor-arg></div><div> <bean parent="shibboleth.Conditions.SimpleAttribute"></div><div> <property name="attributeValueMap"></div><div> <map></div><div> <entry key="activeDirectoryMemberOfShort"></div><div> <list></div><div> <value>IDM--access-resolver</value></div><div> </list></div><div> </entry></div><div> </map></div><div> </property></div><div> </bean></div><div> </constructor-arg></div><div> </bean></div><div> </entry></div><div><br></div><div>where you are saying a particular resolved attribute needs to have a particular value in order to have access.</div><div><br></div><div>
<div>--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></div></body></html>