using Shib-Identity-Provider in XML Access Control

[Vladimir Mencl]

Hi Scott,

Thanks a lot - I got it working this way.

Just a questions: what is a good way of changing the content setting 
exportStdVars to false _globally_ ?

The closest I got to was adding this to my /etc/httpd/conf.d/shib.conf:

<Location />
   ShibRequestSetting exportStdVars false
</Location>

Anything more elegant?


Cheers,
Vlad

PS: Why do you discourage doing access control by IdP entityId?
Just asking to see what I'm overlooking....


On 02/08/13 13:33, Cantor, Scott wrote:
> On 8/1/13 6:23 PM, "Vladimir Mencl" <vladimir.mencl at canterbury.ac.nz>
> wrote:
>
>> I'm trying to configure access control to my SP with an external XML
>> Access Control file - and in the rules, I'd like to refer to attributes
>> (working all fine) and the IdP entityID (restrict access based on the
>> IdP the user came from).
>
> We strongly discourage that, and it is actually not possible without a lot
> of additional configuration that happens to "accidentally" make that
> possible as a byproduct of some other features.
>
>> Is there a way to refer to the other "pseudo" attributes kept about a
>> session - or in particular, the IdP entityID?
>
> No.
>
> You have to disable the built-in variables by turning off exportStdVars
> [1], then enable the AttributeExtractor of type="Assertion" [2], and then
> map the Issuer property to an attribute of your choice (which can be
> Shib-Identity-Provider if you wanted, but doesn't have to be), per the
> example shown in the page. At that point, the value is no longer a
> "special" built-in variable, but just an attribute like any other, making
> it available to the access control rules.
>
> That was not an explicit way of making this possible, which is why it's a
> lot of busy work to do it. It just happens to make something we wanted to
> make hard work by accident.
>
> -- Scott
>
> [1]
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSetting
> s
> [2]
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtra
> ctor
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>


-- 
Vladimir Mencl, Ph.D.
E-Research Services and Systems Consultant
BlueFern Computing Services
University of Canterbury
Private Bag 4800
Christchurch 8140
New Zealand

http://www.bluefern.canterbury.ac.nz
mailto:vladimir.mencl at canterbury.ac.nz
Phone: +64 3 364 3012
Mobile: +64 21 997 352
Fax: +64 3 364 3002