sp authorization with wildcard

[Flannery, Sean]

That's it.  Thanks, Ian.

Works fine after reading that NativeSPhtaccess link and understanding the "~" flag.


Thanks for the help.

Sean
________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Ian Rifkin <irifkin at brandeis.edu>
Sent: Thursday, August 29, 2013 9:29 AM
To: Shib Users
Subject: Re: sp authorization with wildcard

Hi,

If you can't get the IdP to send you something more useful, I think you can specify a pattern matching rule by starting with the ~ symbol. See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess

I haven't tried this (so far I have an IdP not an SP, so take what I say with a grain of salt). Maybe try something like

require company-admin ~ ^Chicago.*$

Regards,
Ian



On Thu, Aug 29, 2013 at 10:08 AM, Flannery, Sean <sean.flannery at jwt.com<mailto:sean.flannery at jwt.com>> wrote:
Hello,

I'm trying to protect an app based on a custom LDAP attribute that requires a wild card search, ie

  <Location /chicagoprintstudio>
    AuthType shibboleth
    ShibRequireSession On
    require company-admin *Chicago*
  </Location>

IE, all people who administrate a Chicago company can access this URL.

It works if I do an exact value like

require company-admin ChicagoWestLoopPrintStudio

But if I do a wild card search, it doesn't let anyone in- maybe it interprets the "*" char literally?  Not sure.

Anyway wondering: am I just using bad regex, or is this not supported?

Any feedback is appreciated.

Sean

PS, I realize a group or a require statement that defines all the possible values (rather than a wild card) is the preferred solution and that will be our long term solution, but I'm wondering if I can do a short term solution while that's being worked on.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130829/9e083e08/attachment.html