Disallow eppn/affiliation to be asserted by the wrong IdP

[William Spooner]

On 11 Oct 2012, at 19:50, Peter Schober wrote:

> * Cantor, Scott <cantor.2 at osu.edu> [2012-10-11 19:48]:
>> <william.spooner at eaglegenomics.com> wrote:
>>> The upshot; it's going to be too much effort to configure shibboleth to
>>> handle this natively at the SP end. My solution is an apache
>>> PerlAuthzHandler that uses the persistent-id to check that the userid is
>>> from the correct IdP entity based on per-IdP regexps. Using a handler
>>> means that the application layer remains unaware of IdP shenanigans. Bit
>>> of a shame, but it's a case of "better the devil you know".
>> 
>> The SP does that for you as well. It checks the NameQualifier and
>> SPNameQualifer in a persistent NameID against the asserting and relying
>> party names.
> 
> AFAIU the intention was to check the values of /other/ attributes
> based on the issuer of the assertion or persistent NameID.
> -peter

Indeed. I have a solution to this using apache handlers that rely on on the veracity of the persistent NameID. In that respect shib provides exactly what I need. 

Something that surprised (and delighted) me - the PerlAuthzHandler hooks into Apache _after_ shib has added the Attributes to the http headers, but _before_ the conversion to HTTP_* variables. This makes it trivial to futz with the attributes in the handler whilst still delivering consistent HTTP_* environment variables to the target rails app. Nice!

Will