Need help with the Shibboleth SP configuration

[Cantor, Scott]

On 7/2/14, 10:01 AM, "anandan" <anupam.nandan at gmail.com> wrote:
>
>Till now I have tried <Accesscontrol> rules and force authentication. But
>"case a" doesn't work and whenever user with level1 authentication tries
>to
>access level2 pages, Shibboleth gives access denied.
>
>Is there any way I can fix this?

You need application intelligence to pull this off, it's not something the
SP can do with static rules. But I suppose you can do just about anything
if you build in enough intelligence into the error handling. If you can do
it with client side code, you could add Javascript into the access error
template, or you could make that response issue a redirect to a server
side script that lets you examine things and decide what to do.

Alternatively the brute force way is that you segregate the resources by
assurance level into separate SP applications. Every access to a
differently classified type of resource gets its own session which you can
initiate with whatever authnContextClassRef value you want.

-- Scott