Regarding authentication in shibboleth

[Kevin P. Foote]

Then is the IdP released attribute "ou" mapped in the attribute-map file to
what apache expects "organizationalUnit"?  

------
thanks
  kevin.foote

On Thu, 11 Aug 2011, Naveen Davis wrote:

-> Hi Kevin,
-> 
-> Yes my idp is releasing the attribute information as required.
-> The Shibboleth.sso/Session handler gives the following output
-> 
-> Miscellaneous
-> 
-> Identity Provider: https://idp1.example.org/idp/shibboleth
-> SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
-> Authentication Time: 2011-08-11T10:38:17.413Z
-> Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
-> Authentication Context Decl: (none)
-> Session Expiration (barring inactivity): 466 minute(s)
-> 
-> Attributes
-> cn: Staff
-> ou: computer
-> sn: Test
-> 
-> BR,
-> Naveen
-> 
-> On Thu, 2011-08-11 at 06:46 -0400, Kevin P. Foote wrote:
-> > Naveen, 
-> > 
-> > Is your IdP releasing the attribute "organizationalUnit" to your SP?
-> > 
-> > Your apache Location block is requiring a value of "computer" to be present 
-> > in that attribute for access to your location.
-> > 
-> > A simper test would be to use require valid-user for initial testing. 
-> > Then hit the Shibboleth.sso/Session handler and verify that all your
-> > attributes are being passed to the SP.
-> > 
-> > ------
-> > thanks
-> >   kevin.foote
-> > 
-> > On Thu, 11 Aug 2011, Naveen Davis wrote:
-> > 
-> > -> Hi,
-> > -> 
-> > -> I am testing out authentication and access control in shibboleth by
-> > -> modifying shib.conf file. I have created a new location called "staff"
-> > -> which should only be accessed by the "computer" organizational unit.
-> > -> Given below is my configuration in shib.conf file.
-> > -> 
-> > -> #
-> > -> # Configure the module for content.
-> > -> #
-> > -> # You MUST enable AuthType shibboleth for the module to process
-> > -> # any requests, and there MUST be a require command as well. To
-> > -> # enable Shibboleth but not specify any session/access requirements
-> > -> # use "require shibboleth".
-> > -> #
-> > -> <Location /secure>
-> > ->   AuthType shibboleth
-> > ->   ShibRequestSetting requireSession 1
-> > ->   require valid-user
-> > -> </Location>
-> > -> 
-> > -> <Location /staff>
-> > ->   AuthType shibboleth
-> > ->   ShibRequestSetting requireSession 1
-> > ->   require organizationalUnit computer
-> > -> </Location>
-> > -> 
-> > -> 
-> > -> I have created a test user "staff" with organizationalUnitName
-> > -> "computer" in the LDAP.But when trying to access this location I am
-> > -> getting the following error.
-> > -> 
-> > -> Forbidden
-> > -> You don't have permission to access /staff/ on this server.
-> > -> 
-> > -> 
-> > -> ________________________________________________________________________
-> > -> Apache/2.2.3 (CentOS) Server at sp2.example.org Port 443
-> > -> 
-> > -> Could anyone provide me some insight in to what I am doing wrong here.
-> > -> 
-> > -> BR,
-> > -> Naveen
-> > -> 
-> > -> --
-> > -> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-> > -> 
-> > --
-> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-> 
-> 
-> --
-> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
->