Access control using only IdP entityID

[Lukas Hämmerle]

Hello all

I would like to create an Apache access control rules that grants access
to users of one or more particular Identity Providers based on their
entityID. Ideally, without having the IdP to release any attribute or
persisent NameID.


Intuitively I first tested (with Apache 2.4) a rule like:

>   AuthType shibboleth
>   ShibRequestSetting requireSession true
>   Require shib-attr Shib-Identity-Provider https://aai-logon.switch.ch/idp/shibboleth

This did not work.

I then also tried the following:

> Require shib-attr Identity-Provider https://aai-logon.switch.ch/idp/shibboleth

> Require Identity-Provider https://aai-logon.switch.ch/idp/shibboleth

It seems that these are not working because "Shib-Identity-Provider" is
not recognized as an attribute, which technically is correct but still
would have made sense to me given that e.g. authnContextClassRef is
another session value that can be used for access contorl.

I have not found anything in the Wiki (e.g.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess)
about using the entityID in access control rules.

However, my current workaround is:

> Require shib-attr persistent-id ~ ^https://aai-logon.switch.ch/idp/shibboleth!.+

This works but could be more elegant and of course requires the
persistentId NameID or eduPersonTargetedID to be available, which I
would like to prevent if possible.


So, I was wondering: is there really no better way to perform access
control based on the entityID than the above "hack" or if I did oversee
something here?


Best Regards
Lukas

-- 
SWITCH
Lukas Hämmerle, Central Solutions
GÉANT Project Task Leader "Enabling Users"
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch