Regarding authentication in shibboleth

[Kevin P. Foote]

Naveen, 

Is your IdP releasing the attribute "organizationalUnit" to your SP?

Your apache Location block is requiring a value of "computer" to be present 
in that attribute for access to your location.

A simper test would be to use require valid-user for initial testing. 
Then hit the Shibboleth.sso/Session handler and verify that all your
attributes are being passed to the SP.

------
thanks
  kevin.foote

On Thu, 11 Aug 2011, Naveen Davis wrote:

-> Hi,
-> 
-> I am testing out authentication and access control in shibboleth by
-> modifying shib.conf file. I have created a new location called "staff"
-> which should only be accessed by the "computer" organizational unit.
-> Given below is my configuration in shib.conf file.
-> 
-> #
-> # Configure the module for content.
-> #
-> # You MUST enable AuthType shibboleth for the module to process
-> # any requests, and there MUST be a require command as well. To
-> # enable Shibboleth but not specify any session/access requirements
-> # use "require shibboleth".
-> #
-> <Location /secure>
->   AuthType shibboleth
->   ShibRequestSetting requireSession 1
->   require valid-user
-> </Location>
-> 
-> <Location /staff>
->   AuthType shibboleth
->   ShibRequestSetting requireSession 1
->   require organizationalUnit computer
-> </Location>
-> 
-> 
-> I have created a test user "staff" with organizationalUnitName
-> "computer" in the LDAP.But when trying to access this location I am
-> getting the following error.
-> 
-> Forbidden
-> You don't have permission to access /staff/ on this server.
-> 
-> 
-> ________________________________________________________________________
-> Apache/2.2.3 (CentOS) Server at sp2.example.org Port 443
-> 
-> Could anyone provide me some insight in to what I am doing wrong here.
-> 
-> BR,
-> Naveen
-> 
-> --
-> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
->