Disable authentication by group.

[Steven Carmody]

On 6/22/12 3:43 PM, Chance Cox wrote:
> I have Shibboleth authenticating to Active Directory and i'm trying
> to figure out a way to restrict authentication based on group
> membership. Has anyone done anything like that before?
>

from a previous posting by Keith Hazelton; I believe that Wisconsin is 
using this IDP extension to control which users are authorized to access 
the Wisconsin GAE instance. Sounds to be similar to your problem....

Unicon did some work on the Shib IdP authN flow for UW-Madison based on 
Spring Web Flow. It was released under Apache 2 licensing. It might give 
you the tools you need.


Here are some pointers:
_______
Slide decks from I2 Member Meeting:

http://events.internet2.edu/2011/fall-mm/agenda.cfm?go=session&id=10001976&event=1148

The solution is comprised of two components:

1) IdP/SWF integration

https://github.com/dima767/Shibboleth-IDP-Postlogin-Filter

2) SWF that inplements

https://github.com/dima767/Shibboleth-IDP-Postlogin-Flow

Best,
Bill Thompson, Unicon
_____