using Shib-Identity-Provider in XML Access Control

[Cantor, Scott]

On 8/1/13 6:23 PM, "Vladimir Mencl" <vladimir.mencl at canterbury.ac.nz>
wrote:

>I'm trying to configure access control to my SP with an external XML
>Access Control file - and in the rules, I'd like to refer to attributes
>(working all fine) and the IdP entityID (restrict access based on the
>IdP the user came from).

We strongly discourage that, and it is actually not possible without a lot
of additional configuration that happens to "accidentally" make that
possible as a byproduct of some other features.

>Is there a way to refer to the other "pseudo" attributes kept about a
>session - or in particular, the IdP entityID?

No.

You have to disable the built-in variables by turning off exportStdVars
[1], then enable the AttributeExtractor of type="Assertion" [2], and then
map the Issuer property to an attribute of your choice (which can be
Shib-Identity-Provider if you wanted, but doesn't have to be), per the
example shown in the page. At that point, the value is no longer a
"special" built-in variable, but just an attribute like any other, making
it available to the access control rules.

That was not an explicit way of making this possible, which is why it's a
lot of busy work to do it. It just happens to make something we wanted to
make hard work by accident.

-- Scott

[1] 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSetting
s
[2] 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtra
ctor