testing group membership

[Bennett, Steve]

Hi,

I feel sure that this is (or should be) a FAQ, but I don't see it being asked or answered anywhere (maybe I've looked in the wrong places).

I'd like to limit access to a SP to users that are members of a specific group.

At the moment I have a filter policy like this:
    <afp:AttributeFilterPolicy id="groupauthz-filter">

        <afp:PolicyRequirementRule xsi:type="basic:AND">
          <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://testsp.example.com/shibboleth" />
          <basic:Rule xsi:type="basic:AttributeValueString" attributeID="isMemberOf" value="cn=myGroup, ou=Groups,dc=example,dc=com"/>
        </afp:PolicyRequirementRule>

        <afp:AttributeRule attributeID="transient-id">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

This works for some cases: if the user is a direct member of the group, they have an isMemberOf attribute that matches the value, the policy matches and they get access to the SP.
However, we have nested group memberships, e.g. "userA" is a member of "groupB", which is a member of "myGroup", so userA doesn't actually have an isMemberOf attribute that matches myGroup.

So... is there a straightforward way of doing nested group authorization in Shibboleth? Our group memberships are in an openLDAP directory at the moment. One approach that I can see would be to maintain a "flattened" representation of group membership (perhaps in a database rather than bloating the directory), but it would be nice if there was a more elegant solution.

Steve.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130417/b3728038/attachment.html