Access control using only IdP entityID

[Peter Schober]

* Lukas Hämmerle <lukas.haemmerle at switch.ch> [2015-02-27 12:04]:
> I would like to create an Apache access control rules that grants access
> to users of one or more particular Identity Providers based on their
> entityID. Ideally, without having the IdP to release any attribute or
> persisent NameID.

This should be possible as a side effect of other changes to the SP,
and doing this has been actively discouraged by the project for many
years now. As such my explanation below isn't as explicit as it could
be. ;)
AFAIK you'll have to use the Assertion type AttributeExtractor for
require directives to work. To avoid duplicate values in the
default envvars you could assign it a new name of your own.
-peter