<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Thanks, that suggestion sounds good.</p>
<p>We have an attribute called irfAuthorizedService which is an
multi-valued attribute that contains all the services that a user
has access to.<br>
I was going to test the suggestion with the following
configuration:</p>
<p><entry key="AccessByAttribute"><br>
<bean
parent="shibboleth.PredicateAccessControl"><br>
<constructor-arg><br>
<bean
parent="shibboleth.Conditions.SimpleAttribute"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry
key="irfAuthorizedService"><br>
<list><br>
<value>shibAdmin</value><br>
</list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</constructor-arg><br>
</bean><br>
</entry><br>
</p>
<p>I webauthn.properties file I have:</p>
<p>idp.authn.webauthn.admin.management.accessPolicy =
AccessByAttribute</p>
<p>I have used irfAuthorizedService in other services as to said.</p>
<p>But it seems not to work with this attribute ("You do not have
access to the requested resource."). I suppose there is more
configuration I must make?<br>
</p>
<p>/Regards Mats<br>
</p>
<div class="moz-cite-prefix">On 2024-10-29 15:57, Philip Smart via
dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DDD97929-B696-4CCC-8537-03702C07585B@jisc.ac.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Thanks, Micheal.
<div><br>
</div>
<div>The admin flow should be resolving attributes by default,
even if the properties file says it is not. That is a typo; I
will commit a fix for that now.</div>
<div><br>
</div>
<div>Phil<br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On 29 Oct 2024, at 14:46, Michael Grady
<a class="moz-txt-link-rfc2396E" href="mailto:mgrady@unicon.net"><mgrady@unicon.net></a> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div
style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<table border="0" cellspacing="0" cellpadding="0"
width="100%"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; cellpadding: 0 !important; border: 0 !important; cellspacing: 0 !important; display: table !important; width: 100% !important; table-layout: fixed !important; border-collapse: seperate !important; float: none !important; border-spacing: 0px 0px !important; "
align="left">
<tbody
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; display: block !important; ">
<tr
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
<td valign="middle" width="1px" bgcolor="#A6A6A6"
cellpadding="7px 2px 7px 2px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; padding: 7px 2px 7px 2px !important; background-color: #A6A6A6 !important; valign: middle !important; width: 0px !important; ">
<br>
</td>
<td valign="middle" width="100%" bgcolor="#EAEAEA"
cellpadding="7px 5px 7px 15px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 100% !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 15px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; ">
<div
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
You don't often get email from
<a class="moz-txt-link-abbreviated" href="mailto:mgrady@unicon.net">mgrady@unicon.net</a>. <a
href="https://aka.ms/LearnAboutSenderIdentification"
style="background: revert !important;color: revert !important;content-visibility: revert !important;direction: revert !important;display: revert !important;font-size: revert !important;opacity: revert !important;rotate: revert !important;scale: revert !important;visibility: revert !important;"
moz-do-not-send="true">
Learn why this is important</a> </div>
</td>
<td valign="middle" align="left" width="75px"
bgcolor="#EAEAEA" cellpadding="7px 5px 7px 5px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 75px !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 5px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; align: left !important; ">
<br>
</td>
</tr>
</tbody>
</table>
<div><br>
<div><br>
<blockquote type="cite">
<div>On Oct 29, 2024, at 9:31 AM, Philip Smart via
dev <a class="moz-txt-link-rfc2396E" href="mailto:dev@shibboleth.net"><dev@shibboleth.net></a> wrote:</div>
<br class="Apple-interchange-newline">
<div><span
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Yup,
as Scott said, this is all highly configurable
based on the usual IdP access control
mechanisms. From a plugin perspective, if you
did want to change the policy, you can by
using the property (once you have defined the
new policy):</span><br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">idp.authn.webauthn.admin.management.accessPolicy
= <SomePolicy></span><br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
</div>
</blockquote>
<br>
</div>
<div>An example for other admin endpoints is the
following in admin/admin.properties:</div>
<div><br>
</div>
<div>
<div>#idp.resolvertest.logging = ResolverTest</div>
<div>idp.resolvertest.accessPolicy =
ResolverAccessByAttribute</div>
<div>idp.resolvertest.authenticated = true</div>
<div>#idp.resolvertest.nonBrowserSupported = false</div>
<div>idp.resolvertest.defaultAuthenticationMethods =
saml2/<a class="moz-txt-link-freetext" href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a></div>
<div>idp.resolvertest.resolveAttributes = true</div>
<div>#idp.resolvertest.postAuthenticationFlows =</div>
<div><br>
</div>
<div>#idp.mdquery.logging = MetadataQuery</div>
<div>idp.mdquery.accessPolicy =
ResolverAccessByAttribute</div>
<div>idp.mdquery.authenticated = true</div>
<div>#idp.mdquery.nonBrowserSupported = false</div>
<div>idp.mdquery.defaultAuthenticationMethods =
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div>
<div>idp.mdquery.resolveAttributes = true</div>
<div>#idp.mdquery.postAuthenticationFlows =</div>
</div>
<div><br>
</div>
and then something like this added into the
shibboleth.AccessControlPolicies map in
access-control.xml:
<div><br>
</div>
<div>
<div> <entry
key="ResolverAccessByAttribute"></div>
<div> <bean
parent="shibboleth.PredicateAccessControl"></div>
<div> <constructor-arg></div>
<div> <bean
parent="shibboleth.Conditions.SimpleAttribute"></div>
<div> <property
name="attributeValueMap"></div>
<div> <map></div>
<div> <entry
key="activeDirectoryMemberOfShort"></div>
<div>
<list></div>
<div>
<value>IDM--access-resolver</value></div>
<div>
</list></div>
<div> </entry></div>
<div> </map></div>
<div> </property></div>
<div> </bean></div>
<div> </constructor-arg></div>
<div> </bean></div>
<div> </entry></div>
<div><br>
</div>
<div>where you are saying a particular resolved
attribute needs to have a particular value in
order to have access.</div>
<div><br>
</div>
<div>
<div>--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.</div>
<div><br>
</div>
<br class="Apple-interchange-newline">
</div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a
company limited by guarantee which is registered in
England under company number. 05747339, VAT number GB 197
0632 86. Jisc’s registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary
and a company limited by guarantee which is registered in
England under company number 02881024, VAT number GB 197
0632 86. The registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary
and a company limited by shares which is registered in
England under company number 09316933, VAT number GB 197
0632 86. The registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our
privacy notice here:
<a class="moz-txt-link-freetext" href="https://www.jisc.ac.uk/website/privacy-notice">https://www.jisc.ac.uk/website/privacy-notice</a></p>
</font></font>
</mc><br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik Fax: +46 (0)980 79 050
Swedish Institute of Space Physics email: <a class="moz-txt-link-abbreviated" href="mailto:matsl@irf.se">matsl@irf.se</a>
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: <a class="moz-txt-link-freetext" href="https://www.irf.se/pgp/matsl">https://www.irf.se/pgp/matsl</a>
Digital vcard: <a class="moz-txt-link-freetext" href="https://www.irf.se/vcard/mats.luspa">https://www.irf.se/vcard/mats.luspa</a></pre>
</body>
</html>