Deny user to access SP via IdP?

[Manuel Haim]

Hi Ian,

you could have a look at our SP Access Filter:

http://www.staff.uni-marburg.de/~haimm/unimr-spaccessfilter.shib2.uapprove240.2013_08_22.zip

It is an IdP plugin based on uApprove and works as follows:
Whenever a user has the eduPersonEntitlement value
"urn:mace:dir:entitlement:common-lib-terms", it just lets the user pass
through to the SP. But whenever that value is missing, it redirects the
user to a customizable error page instead.

Installation instructions are included.

Kind regards,
Manuel


Am 12.06.2014 18:32, schrieb Ian Rifkin:
> Hi,
> 
> I run a Shib IdP and I get the difference between authentication and
> authorization, but unfortunately not every vendor I work with has this
> understanding.
> 
> One vendor recently stated their expectation that we would only be
> sending people to their application if they /should/ have access! My
> understanding is that I'm doing authentication and can give the SP
> whatever info they need to make authorization decisions --  many SPs
> understand this, but apparently not all.
> 
> My question is if it's possible for the IdP to do some kind of
> authorization for specific SPs…
> 
> I see that I can make filters to deny attributes based on the value of
> another attribute like so:
> 
>         <afp:AttributeFilterPolicy>
>           <afp:PolicyRequirementRule
>         xsi:type="basic:AttributeValueString"
>         attributeID="someAttribute" value="someValue" />
>             <afp:AttributeRule attributeID="someOtherAttribute">
>               <afp:DenyValueRule xsi:type="basic:ANY" />
>             </afp:AttributeRule>
>             <afp:AttributeRule attributeID="someOtherOtherAttribute">
>               <afp:DenyValueRule xsi:type="basic:ANY" />
>             </afp:AttributeRule>
>         …
>         </afp:AttributeFilterPolicy>  
> 
> This is close, but it's still directing the user to the SP (just not
> with much info about them). If I try this against my test SP or against
> sp.testshib.org <http://sp.testshib.org> the auth to the SP still
> "works". I think the SP doesn't get any real identifying info about the
> user, except for the IP, but it's still a successful authentication to
> the SP.
> 
> FYI, this matters for things like license agreements with vendors that
> we're paying for X number of seats or paying for a specific type of user
> to have access. Some vendors take the correct approach and look at an
> attribute like eduPersonScopedAffiliation, but alas not every vendor
> will do so.
> 
> Is it possible to not send /anything/ back to the SP for users that
> match a PolicyRequirementRule (for a given SP / AttributeRequesterString)?
> 
> Or even better…is it possible to redirect a user to a URL of my choosing
> if the they match the criteria -- basically not sending them (back) to
> the SP unless they "should" have access to it.
> 
> I imagine this is a bit…unconventional…but I would appreciate if anyone
> has any insight.
> 
> Thanks,
> Ian
> 
> -- 
> Ian Rifkin
> Software Systems Manager
> Library and Technology Services (LTS)
> Brandeis University
> 
> http://go.brandeis.edu/u:irifkin
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>