Shibboleth configuration in Apache

[Peter Schober]

* Badri <badri at visolve.com> [2012-04-24 10:57]:
> Now the question is, we already two different groups of users in ldap. 
> One contains all the users and another have only few important 
> high-privileged users.
> The web root directory is protected with the following configuration.
> <
> AuthType Shibboleth
> ShibRequireSession On
> ShibApplicationId default
> ShibExportAssertion On
> Require Shibboleth
>  >
> 
> This allows all users to access. Say I want to let only the particular 
> group of users in ldap those are high-privileged users. How do I do it 
> here???

You're not really performing any access control here, I would say.
I'll expand on that below.

First off, those two together are a bit nonsensical, AFAIU:

> ShibRequireSession On
> Require Shibboleth

You only ever need "Require Shibboleth" as syntactic sugar for httpd
iff you don't want to require a session and no authorization enforced
by the webserver. (That's a rather special, albeit not uncommon case,
try searching the wiki for "lazy session".)
By contrast, "ShibRequireSession On" means you want the module to
require a session and that usually goes together with some
authorization rules (e.g. "require user foo bar baz") or the
"authentication == authenrization" directive "require valid-user".

Setting "ShibApplicationId default" is nonsensical as well, since
"default" is the default application id. And "ShibExportAssertion On"
only matters if you're actually trying to parse and XML from the
assertion and do anything with it (which I doubt).

To anwser another part of your question: The SAML IdP should send
appropriate attributes (e.g. groups the principal is a member of) and
the SAML SP can make access control decisions based on that
(e.g. "require group foo").
Attributes have specific names on-the-wire and the SP can map any
attribute name to in internal structure available to httpd's require
directive.

The final aspect of your question (nesting directives in httpd) should
be answered in the httpd docs.
-peter