sp authorization with wildcard

[Ian Rifkin]

Hi,

If you can't get the IdP to send you something more useful, I think you can
specify a pattern matching rule by starting with the ~ symbol. See
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess

I haven't tried this (so far I have an IdP not an SP, so take what I say
with a grain of salt). Maybe try something like

require company-admin ~ ^Chicago.*$

Regards,
Ian



On Thu, Aug 29, 2013 at 10:08 AM, Flannery, Sean <sean.flannery at jwt.com>wrote:

>  Hello,
>
> I'm trying to protect an app based on a custom LDAP attribute that
> requires a wild card search, ie
>
>   <Location /chicagoprintstudio>
>     AuthType shibboleth
>     ShibRequireSession On
>     require company-admin *Chicago*
>   </Location>
>
> IE, all people who administrate a Chicago company can access this URL.
>
> It works if I do an exact value like
>
> require company-admin ChicagoWestLoopPrintStudio
>
> But if I do a wild card search, it doesn't let anyone in- maybe it
> interprets the "*" char literally?  Not sure.
>
> Anyway wondering: am I just using bad regex, or is this not supported?
>
> Any feedback is appreciated.
>
> Sean
>
> PS, I realize a group or a require statement that defines all the possible
> values (rather than a wild card) is the preferred solution and that will be
> our long term solution, but I'm wondering if I can do a short term solution
> while that's being worked on.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130829/b00fd76f/attachment.html