forcing one protected area to only accept a specific IDP with other areas use many IDPs

[Jeffrey Eaton]

On Feb 16, 2012, at 4:32 PM, Cantor, Scott wrote:

>> We have a server with content protected by Shibboleth.  One section of
>> content should accept assertions from any IDP in InCommon (call this
>> /incommon/).  The other section of content must only ever accept assertions
>> from our own IDP (call this /local/).
> 
> We generally frown on authorization based on IdP vs. attributes, but the general use case of having different trust requirements for different content is addressed by the ApplicationOverride capability by specifying different MetadataProvider plugins in the override, which will supersede the default(s).

Is it possible to have an apache Requires directive that looks at the entityID of the authenticating IDP?  I see that it exposes it to the app in Shib-Identity-Provider, but I don't see any way of getting at that in Apache.   I can see that you can get to authnContextClassRef and authnContextDeclRef, but no equivalent for entityID.  That would also seem to satisfy the requirement, if it's possible.  If that's not possible, it seems like a logical feature request.

> 
>> and then added an ApplicationOverride like:
> 
> Your override is altering the discovery settings, but it doesn't change the metadata, or any authorization policy. In fact, you don't need an override for the setting you applied, that's easily doable with ShibRequestSetting entityID.
> 
> But for altering metadata, you'd need the override.


I can do the Metadata override for now.

Thanks,

-jeaton