Regarding authentication in shibboleth

[Naveen Davis]

Hi Kevin,

Yes my idp is releasing the attribute information as required.
The Shibboleth.sso/Session handler gives the following output

Miscellaneous

Identity Provider: https://idp1.example.org/idp/shibboleth
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Authentication Time: 2011-08-11T10:38:17.413Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)
Session Expiration (barring inactivity): 466 minute(s)

Attributes
cn: Staff
ou: computer
sn: Test

BR,
Naveen

On Thu, 2011-08-11 at 06:46 -0400, Kevin P. Foote wrote:
> Naveen, 
> 
> Is your IdP releasing the attribute "organizationalUnit" to your SP?
> 
> Your apache Location block is requiring a value of "computer" to be present 
> in that attribute for access to your location.
> 
> A simper test would be to use require valid-user for initial testing. 
> Then hit the Shibboleth.sso/Session handler and verify that all your
> attributes are being passed to the SP.
> 
> ------
> thanks
>   kevin.foote
> 
> On Thu, 11 Aug 2011, Naveen Davis wrote:
> 
> -> Hi,
> -> 
> -> I am testing out authentication and access control in shibboleth by
> -> modifying shib.conf file. I have created a new location called "staff"
> -> which should only be accessed by the "computer" organizational unit.
> -> Given below is my configuration in shib.conf file.
> -> 
> -> #
> -> # Configure the module for content.
> -> #
> -> # You MUST enable AuthType shibboleth for the module to process
> -> # any requests, and there MUST be a require command as well. To
> -> # enable Shibboleth but not specify any session/access requirements
> -> # use "require shibboleth".
> -> #
> -> <Location /secure>
> ->   AuthType shibboleth
> ->   ShibRequestSetting requireSession 1
> ->   require valid-user
> -> </Location>
> -> 
> -> <Location /staff>
> ->   AuthType shibboleth
> ->   ShibRequestSetting requireSession 1
> ->   require organizationalUnit computer
> -> </Location>
> -> 
> -> 
> -> I have created a test user "staff" with organizationalUnitName
> -> "computer" in the LDAP.But when trying to access this location I am
> -> getting the following error.
> -> 
> -> Forbidden
> -> You don't have permission to access /staff/ on this server.
> -> 
> -> 
> -> ________________________________________________________________________
> -> Apache/2.2.3 (CentOS) Server at sp2.example.org Port 443
> -> 
> -> Could anyone provide me some insight in to what I am doing wrong here.
> -> 
> -> BR,
> -> Naveen
> -> 
> -> --
> -> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net