Shib, groups, external users ....

[David Langenberg]

I can't think of an exact way of setting apache to do what you're asking, however, taking a page from another project we're involved in, one solution would be to stand up another Shibboleth IdP to act as a gateway between the home IdP and your app.  Just like in our Soc2SAML gw this one could combine attributes from the home IdP and your local LDAP to present to the app's SP.  From the InC perspective, your GW would present as an SP.  From your app's perspective it'd be an IdP.  

This was just a quick thinking of how I'd initially try to do it.  Obviously there's gonna be a lot of devils running around in the details as it gets fleshed out further.

Dave

--
David Langenberg
Identity & Access Management
The University of Chicago




On Mar 6, 2013, at 11:54 AM, Steven Carmody <steven_carmody at brown.edu>
 wrote:

> Hi,
> 
> We've deployed the latest MACE Grouper, and we'll soon have groups with 
> "external" (non-Brown) members. We'll be creating user objects in our 
> local ldap directory for these people (in a different OU from community 
> members), and we'll be populating their isMemberOf attribute 
> appropriately (based on the MACE Grouper groups they're a member of).
> 
> Here's the Shib question, tho -- when these people access a resource 
> here at Brown, we want their home IDP to assert some attributes and 
> values (eg EPPN), and the Shib access control and the application will 
> use those asserted values.
> 
> However, we also want to use some values retrieved from that person's 
> local ldap user object (eg for apache's access control). The best 
> example of this is group membership -- we don't want that asserted by 
> their home campus -- we want to retrieve it from the local ldap.
> 
> Interestingly, our local VPN implementation (from F5) supports Federated 
> access, and their policy engine does what I've just described. But, I 
> can't figure out how to configure apache to do this -- I don't see how 
> to configure the various apache ldap modules to do JUST this ....
> 
> Any and all suggestions welcome!
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4512 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130306/513d8f64/attachment.bin