IdP v3 intercept flow that restricts /some/ users

[Liam Hoekenga]

On Thu, Jun 11, 2015 at 10:21 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> You can write any condition you want either in Java or with a Script (a
> ScriptedPredicate exists). Your specific use case would I guess be to
> check an attribute's value in an AND with a set of OR'd together SP names.
>

This seems to work.  Could I pull the list of SPs from a properties file?

<bean id="shibboleth.guest-check.Condition"
parent="shibboleth.Conditions.OR">
    <constructor-arg>
        <list>
            <bean parent="shibboleth.Conditions.NOT">
                <constructor-arg>
                    <list>
                        <bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
                            <property name="attributeValueMap">
                                <map>
                                    <entry key="isGuest">
                                        <list>
                                            <value>true</value>
                                        </list>
                                    </entry>
                                </map>
                            </property>
                        </bean>
                    </list>
                </constructor-arg>
            </bean>

            <bean parent="shibboleth.Conditions.AND">
                <constructor-arg>
                    <list>
                        <bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
                            <property name="attributeValueMap">
                                <map>
                                    <entry key="isGuest">
                                        <list>
                                            <value>true</value>
                                        </list>
                                    </entry>
                                </map>
                            </property>
                        </bean>

                        <bean parent="shibboleth.Conditions.RelyingPartyId">
                            <constructor-arg>
                                <list>
                                    <value>
https://sp1.example.edu/shibboleth</value>
                                    <value>
https://sp2.example.edu/shibboleth</value>
                                    <value>
https://sp3.example.edu/shibboleth</value>
                                </list>
                            </constructor-arg>
                        </bean>
                    </list>
                </constructor-arg>
            </bean>
        </list>
    </constructor-arg>
</bean>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/16ac6541/attachment.html>