<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello!</p>
<p>I think it has to do with that irfAuthorizedService is a
multi-value attribute.</p>
<p>When I used uid, that is a single-value attribute it worked.</p>
<p>I use ldap.<br>
</p>
<p>/Regards Mats<br>
</p>
<div class="moz-cite-prefix">Den 2024-10-29 kl. 16:45, skrev Philip
Smart:<br>
</div>
<blockquote type="cite"
cite="mid:4B427967-5925-4A12-9B9A-5D315563FC13@jisc.ac.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On 29 Oct 2024, at 15:32, Mats Luspa via dev
<a class="moz-txt-link-rfc2396E" href="mailto:dev@shibboleth.net"><dev@shibboleth.net></a> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div>
<p>Thanks, that suggestion sounds good.</p>
<p>We have an attribute called irfAuthorizedService which
is an multi-valued attribute that contains all the
services that a user has access to.<br>
I was going to test the suggestion with the following
configuration:</p>
<p><entry key="AccessByAttribute"><br>
<bean
parent="shibboleth.PredicateAccessControl"><br>
<constructor-arg><br>
<bean
parent="shibboleth.Conditions.SimpleAttribute"><br>
<property
name="attributeValueMap"><br>
<map><br>
<entry
key="irfAuthorizedService"><br>
<list><br>
<value>shibAdmin</value><br>
</list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</constructor-arg><br>
</bean><br>
</entry><br>
</p>
<p>I webauthn.properties file I have:</p>
<p>idp.authn.webauthn.admin.management.accessPolicy =
AccessByAttribute</p>
<p>I have used irfAuthorizedService in other services as
to said.</p>
<p>But it seems not to work with this attribute ("You do
not have access to the requested resource."). I suppose
there is more configuration I must make?<br>
</p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>There shouldn't be. Is there anything in the logs about
what attributes are being resolved, what access policy is
being used, and what attributes are being checked (e.g.
`Checking for attribute:` in the log)?</div>
<br>
<blockquote type="cite">
<div>
<div>
<p>/Regards Mats<br>
</p>
<div class="moz-cite-prefix">On 2024-10-29 15:57, Philip
Smart via dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DDD97929-B696-4CCC-8537-03702C07585B@jisc.ac.uk">
Thanks, Micheal.
<div><br>
</div>
<div>The admin flow should be resolving attributes by
default, even if the properties file says it is not.
That is a typo; I will commit a fix for that now.</div>
<div><br>
</div>
<div>Phil<br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On 29 Oct 2024, at 14:46, Michael Grady <a
class="moz-txt-link-rfc2396E"
href="mailto:mgrady@unicon.net"
moz-do-not-send="true">
<mgrady@unicon.net></a> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div
style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<table border="0" cellspacing="0"
cellpadding="0" width="100%"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; cellpadding: 0 !important; border: 0 !important; cellspacing: 0 !important; display: table !important; width: 100% !important; table-layout: fixed !important; border-collapse: seperate !important; float: none !important; border-spacing: 0px 0px !important; "
align="left">
<tbody
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; display: block !important; ">
<tr
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
<td valign="middle" width="1px"
bgcolor="#A6A6A6"
cellpadding="7px 2px 7px 2px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; padding: 7px 2px 7px 2px !important; background-color: #A6A6A6 !important; valign: middle !important; width: 0px !important; ">
<br>
</td>
<td valign="middle" width="100%"
bgcolor="#EAEAEA"
cellpadding="7px 5px 7px 15px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 100% !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 15px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; ">
<div
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; ">
You don't often get email from <a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:mgrady@unicon.net"
moz-do-not-send="true">
mgrady@unicon.net</a>. <a
href="https://aka.ms/LearnAboutSenderIdentification"
style="background: revert !important;color: revert !important;content-visibility: revert !important;direction: revert !important;display: revert !important;font-size: revert !important;opacity: revert !important;rotate: revert !important;scale: revert !important;visibility: revert !important;"
moz-do-not-send="true">
Learn why this is important</a> </div>
</td>
<td valign="middle" align="left"
width="75px" bgcolor="#EAEAEA"
cellpadding="7px 5px 7px 5px"
style=" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important; width: 75px !important; background-color: #EAEAEA !important; padding: 7px 5px 7px 5px !important; font-family: wf_segoe-ui_normal, Segoe UI, Segoe WP, Tahoma, Arial, sans-serif !important; font-size: 12px !important; font-weight: normal !important; color: #212121 !important; text-align: left !important; word-wrap: break-word !important; align: left !important; ">
<br>
</td>
</tr>
</tbody>
</table>
<div><br>
<div><br>
<blockquote type="cite">
<div>On Oct 29, 2024, at 9:31 AM, Philip
Smart via dev <a
class="moz-txt-link-rfc2396E"
href="mailto:dev@shibboleth.net"
moz-do-not-send="true">
<dev@shibboleth.net></a>
wrote:</div>
<br class="Apple-interchange-newline">
<div><span
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Yup,
as Scott said, this is all highly
configurable based on the usual IdP
access control mechanisms. From a
plugin perspective, if you did want
to change the policy, you can by
using the property (once you have
defined the new policy):</span><br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">idp.authn.webauthn.admin.management.accessPolicy
= <SomePolicy></span><br
style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
</div>
</blockquote>
<br>
</div>
<div>An example for other admin endpoints is
the following in admin/admin.properties:</div>
<div><br>
</div>
<div>
<div>#idp.resolvertest.logging =
ResolverTest</div>
<div>idp.resolvertest.accessPolicy =
ResolverAccessByAttribute</div>
<div>idp.resolvertest.authenticated = true</div>
<div>#idp.resolvertest.nonBrowserSupported
= false</div>
<div>idp.resolvertest.defaultAuthenticationMethods
= saml2/<a class="moz-txt-link-freetext"
href="https://refeds.org/profile/mfa"
moz-do-not-send="true">https://refeds.org/profile/mfa</a></div>
<div>idp.resolvertest.resolveAttributes =
true</div>
<div>#idp.resolvertest.postAuthenticationFlows
=</div>
<div><br>
</div>
<div>#idp.mdquery.logging = MetadataQuery</div>
<div>idp.mdquery.accessPolicy =
ResolverAccessByAttribute</div>
<div>idp.mdquery.authenticated = true</div>
<div>#idp.mdquery.nonBrowserSupported =
false</div>
<div>idp.mdquery.defaultAuthenticationMethods
=
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div>
<div>idp.mdquery.resolveAttributes = true</div>
<div>#idp.mdquery.postAuthenticationFlows
=</div>
</div>
<div><br>
</div>
and then something like this added into the
shibboleth.AccessControlPolicies map in
access-control.xml:
<div><br>
</div>
<div>
<div> <entry
key="ResolverAccessByAttribute"></div>
<div> <bean
parent="shibboleth.PredicateAccessControl"></div>
<div>
<constructor-arg></div>
<div> <bean
parent="shibboleth.Conditions.SimpleAttribute"></div>
<div> <property
name="attributeValueMap"></div>
<div>
<map></div>
<div>
<entry
key="activeDirectoryMemberOfShort"></div>
<div>
<list></div>
<div>
<value>IDM--access-resolver</value></div>
<div>
</list></div>
<div>
</entry></div>
<div>
</map></div>
<div>
</property></div>
<div> </bean></div>
<div>
</constructor-arg></div>
<div> </bean></div>
<div> </entry></div>
<div><br>
</div>
<div>where you are saying a particular
resolved attribute needs to have a
particular value in order to have
access.</div>
<div><br>
</div>
<div>
<div>--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.</div>
<div><br>
</div>
<br class="Apple-interchange-newline">
</div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740)
and a company limited by guarantee which is
registered in England under company number.
05747339, VAT number GB 197 0632 86. Jisc’s
registered office is: 4 Portwall Lane, Bristol,
BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc
subsidiary and a company limited by guarantee
which is registered in England under company
number 02881024, VAT number GB 197 0632 86. The
registered office is: 4 Portwall Lane, Bristol,
BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc
subsidiary and a company limited by shares which
is registered in England under company number
09316933, VAT number GB 197 0632 86. The
registered office is: 4 Portwall Lane, Bristol,
BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data
see our privacy notice here: <a
class="moz-txt-link-freetext"
href="https://www.jisc.ac.uk/website/privacy-notice"
moz-do-not-send="true">
https://www.jisc.ac.uk/website/privacy-notice</a></p>
</font></font></mc><br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik Fax: +46 (0)980 79 050
Swedish Institute of Space Physics email: <a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:matsl@irf.se" moz-do-not-send="true">matsl@irf.se</a>
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: <a class="moz-txt-link-freetext"
href="https://www.irf.se/pgp/matsl" moz-do-not-send="true">https://www.irf.se/pgp/matsl</a>
Digital vcard: <a class="moz-txt-link-freetext"
href="https://www.irf.se/vcard/mats.luspa"
moz-do-not-send="true">https://www.irf.se/vcard/mats.luspa</a></pre>
</div>
-- <br>
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
<br>
</blockquote>
</body>
</html>